Gary Smith said:
How do you do whitelisting?
As an end user, I would use a cookie manager. However, the popup blocker
program that I use (PopUpCop) also includes the cookie whitelisting function
so I don't need to bother with running a cookie manager. PopUpCop only
loads when IE is loaded. That is the only time you have to manage cookies,
anyway. Cookie managers load as a background process that continually
consumes memory and some CPU cycles even when you are not in a browser.
Whitelisting merely means that you will keep those cookies left when
visiting domains that are in that list. However, you still need an option
that says all non-whitelisted domains will get their cookies deleted. In
PopUpCop, whitelisting a domain in the cookie list means it gets kept; if
the domain is not in the whitelist, the cookie for that domain gets deleted
upon exit from the last instance of IE. Cookie managers work similarly but
may provide both a whitelist and blacklist. I wouldn't bother maintaining a
blacklist. I only keep cookies from a few domains so whitelisting them and
deleting all others makes my implied blacklist very huge (i.e., all domains
for cookies are blacklisted unless whitelisted).
This is really an end-user solution because they are using a cookie manager
on their own host. It lets them manage just a dozen domains to keep their
cookies rather than download a blacklist from someone else to whom you are
relegating the authority in deciding which are the good and bad domains.
Besides, just because a domain is good (because of its absence in the
blacklist) doesn't mean I want to keep their cookie. I occasionally log
onto Yahoo Mail using the browser interface and they use a cookie and it is
a good domain but I don't bother whitelisting them because I don't want
their cookie around after the mail session. So I whitelist a few good
domains, the other good domains will get the cookies removed, and the bad
domains gets their cookies removed. This lets the site function normally
that uses cookies, sometimes for security purposes, but gets rid of them
when they are no longer needed (because if I exit the browser then I don't
need their cookie for proper painting of their pages or to authorize
navigation around their site).
IE has its Allow list for cookie domains. It also has its Block list. The
problem with IE's Allow list is that it allows the cookie to remain but does
NOT auto-delete all the other cookies upon exit from IE. A Block list will
not list every bad domain nor will it list the good domains that I still
don't want their cookies. So if IE had the option "purge non-whitelisted
cookies on exit" then its whitelist or Allow list would be of practical use
(and I would never be bothered with having to continually maintain an
ever-increasing and sometimes outdated blacklist of domains).
With PopUpCop, I can add a list of good to-keep domains (versus good
not-to-keep domains) in its own whitelist. It also has an option to
auto-retain cookies from sites listed in the Trusted Sites security zone.
All other cookies are purged (so they are effectively handled as per-session
cookies). If I didn't have PopUpCop, or if I used a different browser, I
would look into using a cookie manager even if I had to pay for one.
However, I'm speaking as an end-user that manages his own cookie whitelist
versus a network admin trying to force a whitelist upon the users (and,
again, the whitelist is reduced in effectiveness without the option to purge
all non-whitelisted cookies). Firefox also has its cookie settings and
cookie manager with its Allow (white) and Block (black) lists but it still
lacks an option to purge all *non-whitelisted* cookies on *exit* (which
would totally obviate the need for a blacklist but allows ALL cookies during
the browser session so sites work okay). I only want to *keep* the
whitelisted cookies AFTER exiting the browser. I don't want to block any
[1st party] cookies during the browser session. The privacy threat of
cookies is not during the browser session but between browser sessions.
Marketing doesn't care about your first visit but about your revisits
(tracking a one-time visit is worthless).
