Why users want to disable cookies?

Question

I just started to create a new web application. In the documentation, it is written that I have to prepare for the situation where users have disabled cookies. This is not the first time I have read this condition. Can anyone explain me why users want to disable cookies in their browsers?

Answer 1

Cookies have, historically, been a source of numerous security and privacy concerns.

For example, tracker cookies can be used to identify which websites you've visited and what activities you've done on them:

1. Site A includes hidden iframe that points at a tracker service.
2. Tracker service issues a cookie that identifies you, and logs your visit.
3. Site B includes the same hidden iframe.
4. Tracker service recognises your cookie, and logs that visit too.
5. Site A and Site B pay the tracker to get information about what other sites their users visited.

This is just one application. There are other ways to use tracker cookies, some of which allow all sorts of nasty attacks such as identity theft.

Another problem is cookie-stealing, which can be used to hijack insecure (i.e. non-HTTPS) sessions. Using an exploit (e.g. XSS) a page might manage to post another site's cookies back to itself, allowing an attacker to steal your session ID. Turning off cookies prevents this.

Due to these problems, users often disable cookies or block them on certain sites for increased privacy and security.

Answer 2

With tracking cookies, advertisers can track users across different websites and even across IP addresses (e.g. for laptop users). This has been going on since forever (literally since the beginning of advertising networks, like Google Adwords), but recently the media has been inciting the public against those cookies, blaming them as the root cause for privacy violation. It's gone so far that the EU passed something that is supposed to forbid unnecessary cookies without opt-in. Ironically, the Dutch government's website (here the law came into effect a few months ago) doesn't follow the law either.

These cookies are actually, partially, a cause of privacy intrustion. It makes you easy to track, but there are plenty other ways to tell one user from another. Also there is hardly any reason to block this kind of targeted advertising, it cuts both ways, but that's another subject and a hot debate.

Without cookies, you can hardly keep a user logged-in. Give the appropriate error when cookies turn out to be disabled ("You may not be able to log in, cookies are disabled in your browser, click here for more info."), and I think it's case closed. Most other websites like Facebook and Twitter also won't work without cookies anyway.

Answer 3

The most common reason is that they've done it accidentally and have no idea they've done it (see paragraph 4 below).

Second most common reason is privacy (paranoia?). Some people are anti-tracking at any expense. I tend to find they don't really understand what cookies are in this instance. More likely they just think "tracking is bad" and turn them off - without having any idea for instance, what the difference is between session cookies, 1st/3rd party cookies etc.

However more importantly, I do not believe it's realistic to account for the situation where a user has disabled cookies on anything but extremely basic websites. It's not possible to avoid using cookies (or an URL based equivalent) in anything other than a basic website with very little user-interaction other than following links to static content. You can forget about logins and shopping baskets, because to create those, you need at least a session or a cookie (and session tracking requires a cookie, or URL equivalent).

In 12 years as a website developer, the only people I've ever encountered who have disabled cookies, have it done it accidentally. With NO exceptions, this is because they've been in the settings screen of Internet Explorer and thought that pushing that security/privacy slider up to "High" has got to be better than "Medium". In all cases, they've put it back down to medium, once I've pointed out what effect it has and how many websites it breaks. Often the user has installed a second browser, believing their original browser is "broken" as no websites work with it. As such I believe it's important to tell users they have cookies disabled (using a suitable detection method) if you have a high traffic site.

You an avoid using cookies by storing a unique ID in the URL (.NET and other frameworks suppport this natively) but I believe this simply moves the problem to the URL - and paranoid users may be put off by a URL which is clearly tracking them. Be sure to ensure that if you come up with a homebrew method of doing the same thing, that any URL IDs are tied to the users IP address. If not, you will create an extremely easy method for session hijacking - as a user simply sending a link, will acquire the session state of the sending user.

The vast majority of major websites which require a login, or have a shopping cart function require cookies to work and I do not think it's sensible to try and work around this. You're probably talking of a tiny fraction of 1% of users who have cookies disabled. Ignore stats produced from automatic systems like WebTrends as these will include things like web-crawlers and bots which do not (and have no need to) support cookies, as this will give you a falsely high reading of the number of users who've disabled cookies. You're certainly talking more like 1 in 5000 rather than 1 in 10 users who've disabled cookies and actually still expect websites to work :)

Answer 4

In the documentation, it is written that I have to prepare for the situation where users have disabled cookies.

Being "prepared" is not the same thing as making a fully functional login system that works without HTTP cookies.

Users may turn off HTTP cookies to avoid "being tracked"; in this case, you could think of using another approach for session management, like using a secret URL. Keeping the session ID in the URL has some security and usability merits, but also really serious security and usability issues, and this message is not recommending this approach. Because the question was not about the security of keeping the session ID in the URL, I do not want to discuss this (interesting) issue here.

The issue is not just technical, it is an acceptability issue: if the user voluntarily turn off cookies, you can bet he does not want to be tracked. Trying to get around the blocking of cookies (even "for his own good") is very likely to upset him.

Instead, you can explain users that only session cookies are needed for session management within your Web application, and that it is possible to automatically erase all cookies when the browser is closed.