EDIT: After reading all the responses, I’ve decided to allow cookies to persist after they close the browser, which I expect will make it so that 2FA doesn’t kick in as often, at least not on their most frequently used web sites. I may also look into privacy oriented browser extensions that might offer some protection, such as Privacy Badger. Thanks, all!
OP: I know two factor authentication is considered more secure than just passwords, but here’s the deal: One of my family members uses Linux Mint on their laptop (at my recommendation and yes, they are aware that it’s not a Mac), and while they’ve mostly adapted to the different workflows (coming from a macbook), one of their biggest pain points is that web sites are constantly challenging them because they don’t recognize their machine. It’s frustrating to them because they used to just allow all cookies in Safari, whereas I’ve configured Firefox on their Linux laptop not to keep any cookies after the browser is closed. I know this isn’t a Linux/Firefox issue, but I think they might not see it that way and I worry they’ll get frustrated to the point that they’ll go out and splurge on a new macbook air when they already have a perfectly functional laptop with functional OS.
Right now I’m thinking of adding their most frequently used web sites as exceptions in Firefox settings so at least those cookies would persist after closing the browser, making them easier to log into. Or maybe I’ll just allow all cookies indefinitely, although I’d rather not just throw in the towel on Big Surveillance. Is there another way to walk that line between convenience and security that I’m not thinking of? Should I just remove my tin foil hat and allow all cookies indefinitely?
Thanks in advance for your advice.
I’ve configured Firefox on their Linux laptop not to keep any cookies after the browser is closed.
Why? Like I get it on your own computers where you’re willing to deal with the hassle of that. But it’s a huge pain for someone who just wants to use their PC.
I may also look into privacy oriented browser extensions that might offer some protection, such as Privacy Badger.
uBlock Origin is all you need.
whereas I’ve configured Firefox on their Linux laptop not to keep any cookies after the browser is closed.
Here is your issue
It has nothing to do with Linux at all. It’s all about the browsers configurations you made
I set Firefox to save cookies for a few sites that I want to stay signed into. Everything else gets deleted when the browser is closed.
This. Delete all, keep a few. Goodness enumeration
Just allow cookies for those websites. You can do it by clicking the lock to the left of the search bar and enabling “Always store cookis/data for this site”
I did not know about that - thanks for the tip!
Yes, stop shooting yourself in the foot and allow cookies at least for those sites.
I’m a bit late to the party, but I would be inclined to agree with the majority here. Your choice to have their cookies deleted on browser close is adding more friction to an already quite high friction process - you managed to get them to switch over, you don’t want to undo all that over cookies of all things.
You have to remember, it is their machine at the end of the day, and while you might be able to put up with having to redo 2FA loads due to cookie deletion, they’re clearly not… And if that’s going to be the dealbreaker, you’re far better off forgetting cookie deletion for now and focusing on more passive privacy options like blocking 3rd party cookies, trackers, and ADs.
As others have pointed out, the issue is here is not because of mint or linux, but because of the constant loss of cookies.
I was also experimenting with automatically deleting cookies but the only extension (forget me not) that allowed me the workflow I wanted was buggy and unmaintained.
I have settled on the following rules:- cookies are not deleted automatically
- umatrix default denies cookie access for all sites, but if somewhere it’s needed I’m ready to unblock it
- i open most sites with the temporary containers addon and it’s ctrl+click shortcut
This way, cookies are only deleted when I really want it, which I control by deciding on using a temp container or not.
Allowing cookies for websites you are logged into makes sense. If you are going to login the site already knows who you are can track you, so you do not lose much with the exception. What I do for some sites like google services is access them from a separate browser.
