52
submitted 3 months ago* (last edited 3 months ago) by yo_scottie_oh@lemmy.ml to c/linux@lemmy.ml

EDIT: After reading all the responses, I’ve decided to allow cookies to persist after they close the browser, which I expect will make it so that 2FA doesn’t kick in as often, at least not on their most frequently used web sites. I may also look into privacy oriented browser extensions that might offer some protection, such as Privacy Badger. Thanks, all!

OP: I know two factor authentication is considered more secure than just passwords, but here’s the deal: One of my family members uses Linux Mint on their laptop (at my recommendation and yes, they are aware that it’s not a Mac), and while they’ve mostly adapted to the different workflows (coming from a macbook), one of their biggest pain points is that web sites are constantly challenging them because they don’t recognize their machine. It’s frustrating to them because they used to just allow all cookies in Safari, whereas I’ve configured Firefox on their Linux laptop not to keep any cookies after the browser is closed. I know this isn’t a Linux/Firefox issue, but I think they might not see it that way and I worry they’ll get frustrated to the point that they’ll go out and splurge on a new macbook air when they already have a perfectly functional laptop with functional OS.

Right now I’m thinking of adding their most frequently used web sites as exceptions in Firefox settings so at least those cookies would persist after closing the browser, making them easier to log into. Or maybe I’ll just allow all cookies indefinitely, although I’d rather not just throw in the towel on Big Surveillance. Is there another way to walk that line between convenience and security that I’m not thinking of? Should I just remove my tin foil hat and allow all cookies indefinitely?

Thanks in advance for your advice.

top 33 comments
sorted by: hot top controversial new old
[-] BaalInvoker@lemmy.eco.br 70 points 3 months ago* (last edited 3 months ago)

whereas I’ve configured Firefox on their Linux laptop not to keep any cookies after the browser is closed.

Here is your issue

It has nothing to do with Linux at all. It's all about the browsers configurations you made

[-] yo_scottie_oh@lemmy.ml 3 points 3 months ago* (last edited 3 months ago)

Yes, I understand that. I suppose my reason for posting in c/Linux was I thought that maybe there was some Linux-specific tool or configuration that I hadn’t thought of.

[-] catloaf@lemm.ee 43 points 3 months ago

Yes, stop shooting yourself in the foot and allow cookies at least for those sites.

[-] yo_scottie_oh@lemmy.ml 2 points 3 months ago

Will do. Thank you.

[-] eya@lemmy.dbzer0.com 35 points 3 months ago

Just allow cookies for those websites. You can do it by clicking the lock to the left of the search bar and enabling "Always store cookis/data for this site"

[-] yo_scottie_oh@lemmy.ml 5 points 3 months ago

I did not know about that - thanks for the tip!

[-] Th4tGuyII@kbin.social 30 points 3 months ago

I'm a bit late to the party, but I would be inclined to agree with the majority here. Your choice to have their cookies deleted on browser close is adding more friction to an already quite high friction process - you managed to get them to switch over, you don't want to undo all that over cookies of all things.

You have to remember, it is their machine at the end of the day, and while you might be able to put up with having to redo 2FA loads due to cookie deletion, they're clearly not... And if that's going to be the dealbreaker, you're far better off forgetting cookie deletion for now and focusing on more passive privacy options like blocking 3rd party cookies, trackers, and ADs.

[-] yo_scottie_oh@lemmy.ml 4 points 3 months ago

Yup, I agree - thanks for chiming in.

[-] ReversalHatchery@beehaw.org 3 points 3 months ago

Don't forget to let them know that Linux is not by default this hardcore with cookies.

[-] MangoPenguin@lemmy.blahaj.zone 18 points 3 months ago

I’ve configured Firefox on their Linux laptop not to keep any cookies after the browser is closed.

Why? Like I get it on your own computers where you're willing to deal with the hassle of that. But it's a huge pain for someone who just wants to use their PC.

I may also look into privacy oriented browser extensions that might offer some protection, such as Privacy Badger.

uBlock Origin is all you need.

[-] MrFunnyMoustache@lemmy.ml 15 points 3 months ago

My first time trying to get my mother to switch from Windows to a Linux based OS wasn't successful because there was too much friction and inconvenience for her, and she wasn't willing to even entertain the idea of Linux for years after that. My second attempt was successful because Linux is much more user friendly than it used to be 13 years ago, and I changed my approach to make it as frictionless as possible.

Firefox just set to block 3rd party cookies + some basic extensions like adblocking and some easy privacy stuff is a good way to go about it, because it's better than what she used previously and it doesn't become inconvenient to her. She doesn't know what an operating system is, or what cookies are... She just uses the computer to browse the web, emails, and light office work. She even says she prefers the current setup (though that's because her old computer was chugging with Windows and runs smoothly now with a less bloated OS)

No need for noscript, deleting cookies, fingerprinting, or user agent stuff... Only introduce these to them if they express interest in privacy and are interested in learning more. If you try to thrust it upon them too suddenly they will just think "Linux isn't a good user experience and is only good for tech enthusiasts and programmers".

[-] yo_scottie_oh@lemmy.ml 3 points 3 months ago

Thanks for sharing your story, this helps.

[-] lemmyreader@lemmy.ml 2 points 3 months ago

Nice read! 👍 🐧

[-] cmnybo@discuss.tchncs.de 14 points 3 months ago

I set Firefox to save cookies for a few sites that I want to stay signed into. Everything else gets deleted when the browser is closed.

[-] boredsquirrel@slrpnk.net 4 points 3 months ago

This. Delete all, keep a few. Goodness enumeration

[-] joeldebruijn@lemmy.ml 11 points 3 months ago

For my family my setup slightly different for reasons in other comments:

  • do change browsers away from Chrome or Edge
  • do change search engines
  • allow cookies
  • drop tracking surveillance traffic at the network level with something like pihole or nextdns
[-] yo_scottie_oh@lemmy.ml 2 points 3 months ago

Gotcha, thanks for sharing your setup.

[-] xylogx@lemmy.world 10 points 3 months ago

Allowing cookies for websites you are logged into makes sense. If you are going to login the site already knows who you are can track you, so you do not lose much with the exception. What I do for some sites like google services is access them from a separate browser.

[-] 0xtero@beehaw.org 9 points 3 months ago* (last edited 3 months ago)

I’ve configured Firefox on their Linux laptop not to keep any cookies after the browser is closed. I know this isn’t a Linux/Firefox issue

It's you issue.

Block third-party cookies, but allow cookies from the site itself. I'm not sure why you'd filter those out in the first place?

[-] yo_scottie_oh@lemmy.ml 2 points 3 months ago

I'm not sure why you'd filter those out in the first place?

To be clear, the current settings do not filter out any cookies, they just don’t allow them to persist after the browser is closed. But after reading the advice in the comments, I’ll relax this setting. Thank you.

[-] soulfirethewolf@lemdro.id 8 points 3 months ago

I personally think you should just allow cookies indefinitely. There are honestly so many bigger risks from phishing and other forms of social engineering that as long as your family isn't leaving their computer unlocked in a public place, I wouldn't say there's really too much of a risk in leaving cookies enabled.

I apologize that this doesn't exactly answer your question, but I'd like to suggest an alternative. I'd like to also ask, is your family using a password manager by any chance? And if so, are they making use of passkeys on supported websites. Many modern websites, including Google and Facebook, support them. And they require virtually no interaction aside from unlocking the password manager. It's still a form of two-factor authentication, but it's far more convenient than anything out there.

I also don't really think you should try to force Linux on people who aren't particularly comfortable or familiar using it.

I worry they'll get frustrated to the point that they'll go out and splurge on new macbook air when they already have a perfectly functional laptop with functional OS.

If you're worried that they're going to go and do that, then Linux might not serve their needs. Linux might be a fully functional desktop system, but it's also one that isn't an out of the box experience either. There's certainly been a lot of improvements, But I don't think that any Linux Desktop Environment is ever going to reach the same level of intuitiveness as something like Windows or macOS. I would certainly love to see it that way. But I think it's just an issue of the people who actually use it.

I understand looking out for family and ensuring they don't spend excess amounts of money. But you also shouldn't take it upon yourself to try and dictate how your family uses the computer either. Linux wasn't built as a commercially supported desktop operating system with years of full-time researchers studying topics surrounding human computer interaction with a multi-million dollar budget. It was built to be a free as in freedom alternative to the mainstream systems that are available (I personally call it "The problem solving platform" for this reason) by a loose knit group of volunteers who love computers and know a lot about them. Most people who use a computer use them to do work, and not really for promoting a personal agenda.

I'm not saying that you shouldn't try to get your family members to use Linux, I'm just saying that you shouldn't force them. You should put their best interests first that can help them.

I'm sorry to go on such a long rant about this. I just see a lot of people who I believe to vastly overestimate the willingness of others in certain places. And the whole part of "worrying about someone spending their own money" just kind of struck a red flag to me.

[-] yo_scottie_oh@lemmy.ml 1 points 3 months ago* (last edited 3 months ago)

Thanks for your advice, and yes, they use a password manager (KeepassXC), but this is the first I’ve heard of web sites that support pass keys. I’ll look into that, thanks for the tip.

[-] lemmyreader@lemmy.ml 2 points 3 months ago

Passkeys are the newest hype. Question is whether they're really safe, and how simple end users will deal when problems with it arise. I'd say go for allowing cookies and use the 2FA you already have configured.

[-] Bitrot 2 points 3 months ago

FIDO2 has been around for a minute, it just got better branding and mainstream interest. Safe vs passwords is kind of silly, workflow for problem solving is a concern though (although not all that different than 2FA issues, they even use the same token in many cases).

[-] lemmyreader@lemmy.ml 1 points 3 months ago* (last edited 3 months ago)

I also don’t really think you should try to force Linux on people who aren’t particularly comfortable or familiar using it.

Disagree. As long as OP is willing to support them it's good to make others see that Linux can be doing just fine for just web browsing and chatting. Especially given that Microsoft seems to have completely lost it with their pushing of ads and trying to push desktop users into their cloud locking them further in.

[-] Brewchin@lemmy.world 7 points 3 months ago

If using Firefox:

  • uBlock Origin: Ads be gone. You need to select/add the blocklists you want.
  • Privacy Badger: Automatic tracker blocker with no configuration required.
  • Cookie AutoDelete: Saves cookies for the pages you want it to, and nukes everything else.
  • Firefox Multi-Account Containers: Keep your activity in separate silos. That Banking container cookie won't be visible to that Porn container's JavaScript, Meta's container can only see Meta's stuff, etc.

I use a bunch of others, but the above are my bare minimum.

Don't believe anyone who tells you that one extension does everything.

[-] ReversalHatchery@beehaw.org 7 points 3 months ago

As others have pointed out, the issue is here is not because of mint or linux, but because of the constant loss of cookies.

I was also experimenting with automatically deleting cookies but the only extension (forget me not) that allowed me the workflow I wanted was buggy and unmaintained.
I have settled on the following rules:

  • cookies are not deleted automatically
  • umatrix default denies cookie access for all sites, but if somewhere it's needed I'm ready to unblock it
  • i open most sites with the temporary containers addon and it's ctrl+click shortcut

This way, cookies are only deleted when I really want it, which I control by deciding on using a temp container or not.

[-] booty@hexbear.net 6 points 3 months ago

whereas I’ve configured Firefox on their Linux laptop not to keep any cookies after the browser is closed.

Why? Does this person care about privacy? The average person would much, much rather just have the cookies for exactly this reason.

[-] yo_scottie_oh@lemmy.ml 2 points 3 months ago

You're right - I've decided to allow cookies to persist after they close the browser. Thanks for your advice.

[-] lemmyreader@lemmy.ml 4 points 3 months ago

Right now I’m thinking I’ll need to add a bunch of web sites as exceptions in Firefox settings so at least their most frequently used web sites are easier to log into.

I'd go for allow cookies to be stored for the sites they use or allow all.

[-] yo_scottie_oh@lemmy.ml 2 points 3 months ago

Yeah, I've decided to just allow cookies to persist without having to manage some list of exceptions. Thanks.

[-] bizdelnick@lemmy.ml 3 points 3 months ago

Why not use Privacy Badger to prevent usage of tracking cookies?

[-] yo_scottie_oh@lemmy.ml 1 points 3 months ago

I hadn’t considered Privacy Badger. I’ll look into that. Thanks for the idea.

this post was submitted on 21 Apr 2024
52 points (83.3% liked)

Linux

46611 readers
872 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS