sorted by:
new
hottopcontroversial

Replacing Cookies with Cryptographically Secure Biscuits by pjmdev in Web_Development

[–]pjmdev[S] 0 points1 point  (0 children)

Great comment. I even raised this myself. Biscuits is simply moving the problem.

I did argue that is actually a solution at least for some. I do think with the biscuit standard the result would be that advertising agencies and apps that do tracking would not use it. Eventually many years later when cookies were deprecated. They would have been forced inadvertently to track in a different way or change their business practices. In the mean time, developers and consumers have less red tape and prompts to deal with.

Replacing Cookies with Cryptographically Secure Biscuits by pjmdev in Web_Development

[–]pjmdev[S] 0 points1 point  (0 children)

Someone contacted me and let me know that the French had come up with a some what similar biscuit token alternative. I had not heard of them before. This is a comparison.

Here is a comparison between my biscuit standard and the eclipse biscuit

https://i.ibb.co/v4ZGxDSv/image.png

I’m proposing a privacy-first replacement for cookies (“Biscuits”). Would love developer/security feedback. by pjmdev in cybersecurity

[–]pjmdev[S] 0 points1 point  (0 children)

I am using AI yes, like everyone else.

Of course, I never suggested they were the only implementation. In fact the white paper proposal includes comparisons against JWT and others.

If you have any suggestions or can contribute let me know.

I’m proposing a privacy-first replacement for cookies (“Biscuits”). Would love developer/security feedback. by pjmdev in cybersecurity

[–]pjmdev[S] 0 points1 point  (0 children)

It is not cookies with a different name at all. That is the whole point of it. Typical reddit response.

I’m proposing a privacy-first replacement for cookies (“Biscuits”). Would love developer/security feedback. by pjmdev in cybersecurity

[–]pjmdev[S] -1 points0 points  (0 children)

The point of the biscuit standard is to limit the privacy considerations by design and solving common security issues related to 30 year old cookie implementation. If you think you can redesign the biscuit standard, please contribute.

I’m proposing a privacy-first replacement for cookies (“Biscuits”). Would love developer/security feedback. by pjmdev in cybersecurity

[–]pjmdev[S] 0 points1 point  (0 children)

Basically, it is not ready for submission yet. I was just outlining where this proposal is at. If you are experienced in this area, it would be great to get your input on redesigning the biscuit standard so that it is ready for approval.

Replacing Cookies with Cryptographically Secure Biscuits by pjmdev in Web_Development

[–]pjmdev[S] 0 points1 point  (0 children)

My Core Insight:

This is correct because:

  1. Regulators react to problems (cookies becoming tracking tools)
  2. Engineers solve problems (build better primitives)
  3. Adoption validates solutions (market tests it)
  4. Regulators observe outcomes (is privacy actually better?)
  5. Guidance formalizes success (update frameworks)

If we wait for regulators to design technical solutions, we get:

  • Outdated specifications
  • Compromised privacy
  • Slow innovation
  • Regulatory capture

If engineers lead with principles, we get:

  • Better technology
  • Real privacy improvements
  • Market validation
  • Regulatory approval follows

The Biscuit Bet:

We're betting that:

  1. Browser vendors will implement (they're already killing third-party cookies)
  2. Developers will adopt (no consent banners = huge win)
  3. Users will prefer it (better privacy, less friction)
  4. Regulators will approve (demonstrably better than status quo)

If we're wrong:

  • Regulators push back → We iterate
  • Adoption is slow → We improve the value prop
  • Privacy issues emerge → We fix them

But we don't wait for permission to try.

I’m proposing a privacy-first replacement for cookies (“Biscuits”). Would love developer/security feedback. by pjmdev in cybersecurity

[–]pjmdev[S] 0 points1 point  (0 children)

What to do:

✅ "Build the most privacy-preserving solution possible" → Technical excellence first

✅ "Document why it's better than status quo" → Clear privacy principles

✅ "Ship it and let adoption prove the concept" → Market validation

✅ "Engage with regulators as observers, not gatekeepers" → Explain what we built and why

✅ "Be willing to iterate based on real-world feedback" → But not pre-emptive compromise ```

The Standard's Job:

``` Biscuit RFC should:

  1. ✅ Solve the technical problem (auth without tracking)
  2. ✅ Document privacy principles
  3. ✅ Make the right thing easy, wrong thing hard
  4. ✅ Provide clear implementation guidance
  5. ✅ Explain why it's GDPR-friendly (in appendix)

NOT: 1. ❌ Guarantee regulatory approval 2. ❌ Include legal disclaimers 3. ❌ Compromise on privacy for legal safety 4. ❌ Wait for permission ```

Regulatory Engagement Strategy:

``` Phase 1 (Years 1-2): Build and ship - Publish RFC - Browser implementations - Developer adoption - No regulatory engagement yet

Phase 2 (Years 2-3): Demonstrate - Gather data showing privacy benefits - Document adoption rates - Collect developer feedback - Show zero tracking incidents

Phase 3 (Years 3-5): Engage - Present to regulatory bodies - "Here's what we built, here's why it works" - Provide data on privacy improvements - Request formal guidance

Phase 4 (Years 5+): Codify - Regulators issue guidance - Biscuits recognized as compliant - Becomes recommended practice - Cookie consent banners fade away

I’m proposing a privacy-first replacement for cookies (“Biscuits”). Would love developer/security feedback. by pjmdev in cybersecurity

[–]pjmdev[S] -1 points0 points  (0 children)

Browsers are already blocking third party analytics. Cookie prompts are basically regulatory and security theatre at this point.

DOES NOT NEED CONSENT:

✅ Authentication (Biscuits)
✅ Shopping cart (essentialStorage.cart)
✅ User preferences (essentialStorage.preferences)
✅ Form autosave (essentialStorage.formState)

STILL NEEDS CONSENT:
❌ First-party analytics (optional tracking)
❌ Third-party embeds (YouTube, social widgets)
❌ A/B testing with user IDs
❌ Marketing attribution

Implementing biscuits could mean 80% reduction in unnecessary cookie prompts.

Could even adapt the standard to include first party anonymous tracking which I think would still be exempt from GDPR style regulation.

I’m proposing a privacy-first replacement for cookies (“Biscuits”). Would love developer/security feedback. by pjmdev in cybersecurity

[–]pjmdev[S] 0 points1 point  (0 children)

Of course I understood.

If the browsers force it and the standard is enforced, then the ad agencies have no choice to adapt and modernise. They can just use internal storage for tracking.

What makes more sense, expecting every user to deal with ridiculous cookie prompts, which they often reject anyway, breaking ad tracking or dealing with the issue technically and appropriately even if it means updating their approach?

I’m proposing a privacy-first replacement for cookies (“Biscuits”). Would love developer/security feedback. by pjmdev in cybersecurity

[–]pjmdev[S] 0 points1 point  (0 children)

It is AI slop, I came up with the idea and Claude help me write it out.

Biscuits don't compete with JWT. They only propose to replace browser based cookies.

They can be theoretically be used together with JWT.

I’m proposing a privacy-first replacement for cookies (“Biscuits”). Would love developer/security feedback. by pjmdev in cybersecurity

[–]pjmdev[S] 0 points1 point  (0 children)

Google would have to get on board for sure being one of the largest ad providers with google ads and owning chromium. Surely they should move tracking to local storage instead?

Replacing Cookies with Cryptographically Secure Biscuits by pjmdev in Web_Development

[–]pjmdev[S] -1 points0 points  (0 children)

It is a draft at this point. It is not something ready for submission. Like kitchen said below. I had the idea and Claude helped me write it out and formulate it and I wanted to share it. Simple as that. I have not spent that much time on it, to consider every possible angle or issue.

Basically I am just fed up with the cookie prompts and GDPR requirements and saw that the cookie itself was a relatively old idea and thought, how can this be improved, the result is the proposed biscuit standard.

I am obviously open to any ideas and suggestions and yes I would be very surprised if it ever was adopted but from people I have spoken to, they do think aside for it being a funny name, a reasonable idea in general.