How is Lockdown Mode supposed to work? I really do not understand. While it is enabled, my cookies still get stuffed with cookies. Hundreds of them, including ad cookies. That just doesn't seem right. It doesn't seem locked down at all. It seems to permit sites to put any cookies it desires on my desktop. Almost like it is just requesting the site to be nice, which is not very comforting.
Mac mini, macOS 13.7
My impression is that Lockdown Mode is designed to guard against attack by highly sophisticated and targeted malware – at the possible expense of making your computer much less useful and convenient to use.
About Lockdown Mode – Apple Support
"Lockdown Mode is an optional, extreme protection that’s designed for the very few individuals who, because of who they are or what they do, might be personally targeted by some of the most sophisticated digital threats. Most people are never targeted by attacks of this nature.
When Lockdown Mode is enabled, your device won’t function like it typically does. To reduce the attack surface that potentially could be exploited by highly targeted mercenary spyware, certain apps, websites, and features are strictly limited for security and some experiences might not be available at all."
While cookies can be used to track you, Macs are not in the habit of treating cookies as executable code or scripts. Even if a site loaded a highly sophisticated piece of Mac-specific malware onto your system via a cookie, that code would be inert and harmless unless there was some other system compromise that let an attacker run it. (In which case the attacker wouldn't bother with the cookie and would use the other compromise to attack you directly.)
Note that even if you block all cookies, or purge them all on a regular basis, Web sites can still track you based upon things like your router's IP address (if you didn't have a return address, you couldn't communicate with remote sites at all), any accounts you are using on those sites – or data mining techniques that might not be 100% accurate, but which might be "good enough" from an advertiser's point of view.
My impression is that Lockdown Mode is designed to guard against attack by highly sophisticated and targeted malware – at the possible expense of making your computer much less useful and convenient to use.
About Lockdown Mode – Apple Support
"Lockdown Mode is an optional, extreme protection that’s designed for the very few individuals who, because of who they are or what they do, might be personally targeted by some of the most sophisticated digital threats. Most people are never targeted by attacks of this nature.
When Lockdown Mode is enabled, your device won’t function like it typically does. To reduce the attack surface that potentially could be exploited by highly targeted mercenary spyware, certain apps, websites, and features are strictly limited for security and some experiences might not be available at all."
While cookies can be used to track you, Macs are not in the habit of treating cookies as executable code or scripts. Even if a site loaded a highly sophisticated piece of Mac-specific malware onto your system via a cookie, that code would be inert and harmless unless there was some other system compromise that let an attacker run it. (In which case the attacker wouldn't bother with the cookie and would use the other compromise to attack you directly.)
Note that even if you block all cookies, or purge them all on a regular basis, Web sites can still track you based upon things like your router's IP address (if you didn't have a return address, you couldn't communicate with remote sites at all), any accounts you are using on those sites – or data mining techniques that might not be 100% accurate, but which might be "good enough" from an advertiser's point of view.
Whickwithy wrote:
How is Lockdown Mode supposed to work? I really do not understand. While it is enabled, my cookies still get stuffed with cookies. Hundreds of them, including ad cookies. That just doesn't seem right. It doesn't seem locked down at all. It seems to permit sites to put any cookies it desires on my desktop. Almost like it is just requesting the site to be nice, which is not very comforting.
Website cookies are necessary for normal operations of much of the web. Fully blocking all cookies would render much of the web inaccessible or inoperable. And what Lockdown blocks here is not specifically documented.
Privacy threat discussions including browser fingerprinting aside, cookies themselves are not a particular security threat, and Apple has taken steps elsewhere (e.g. Advanced Tracking and Fingerprinting Protection) to better manage cookies both with blocking common trackers, and with infrequently-accessed websites’ cookies becoming ephemeral, as well as features attempting to provide better privacy including iCloud+ Private Relay. In this realm, Advanced Tracking and Fingerprinting Protection is enabled by default in macOS 26. This feature was first available for Mac in Safari for macOS 14.
If cookies are something that you consider a privacy or security threat, then consider migrating to Lynx as your web browser, or block all cookies. Lynx is a text-only browser, and can be built with cookie support disabled. Or to newer macOS with Safari enhancements.
More about Lockdown Mode and security here:
If you believe Lockdown Mode should also block particular cookies that you are encountering (and that are not already blocked by Advanced Tracking and Fingerprinting Protection or other such work), log feedback:
If security is a particular concern, macOS 13 is getting old.
Servant of Cats wrote:
My impression is that Lockdown Mode is designed to guard against attack by highly sophisticated and targeted malware – at the possible expense of making your computer much less useful and convenient to use.
Yep. Exactly that. Lockdown is a security feature intended to isolate or to disable what might potentially be explotable features, and not a privacy feature.
Whickwithy wrote:
While I appreciate the insights, it is still true that some (very, very few) sites supply less cookies when in lockdown mode. The rest just flood the computer with ad cookies. It's just kinda creepy.
Want Lockdown Mode, run it.
Don’t want Lockdown Mode, don’t.
Don’t expect Lockdown Mode to particularly alter cookies, except incidentally.
Don’t expect cookies to be the only tracking, as receipts are purchased and collated, browser characteristics are identified and tracked, add-on “security” products and “coupon” apps and weather apps and such can collect and re-sell data, etc.
There are other mechanisms and newer macOS features that target cookies and related.
How Lockdown Mode protects your device
When Lockdown Mode is enabled, some apps and features will function differently, including:
Predicated on above, I do not see any specific mention of Cookies via vie from Websites using a Web Browser application
About Apple threat notifications and protecting against mercenary spyware
Whickwithy wrote:
While I appreciate the insights, it is still true that some (very, very few) sites supply less cookies when in lockdown mode. The rest just flood the computer with ad cookies. It's just kinda creepy.
It would be suggested to read up on the various types of internet " Cookies "
https://en.wikipedia.org/wiki/HTTP_cookie
There are " Authentication cookies ", " Tracking cookies " and then , Evercookies
They are everywhere and unavoidable
Where to start? First of all, I think you meant to say "vis a vis".
Secondly, I am a lot more thorough than just reading documentation. Some respectable websites do limit their cookies when in lockdown mode (sorry it's not in the documentation), which is why I said "Almost like it is just requesting the site to be nice, which is not very comforting."
So, it certainly does affect cookies. It just does it when the site feels like being a respectable site. It is amazing how few sites are respectable (only one of which I know). I bet that's not in the documentation, either.
Whickwithy wrote:
Where to start? First of all, I think you meant to say "vis a vis".
Secondly, I am a lot more thorough than just reading documentation. Some respectable websites do limit their cookies when in lockdown mode (sorry it's not in the documentation), which is why I said "Almost like it is just requesting the site to be nice, which is not very comforting."
So, it certainly does affect cookies. It just does it when the site feels like being a respectable site. It is amazing how few sites are respectable (only one of which I know). I bet that's not in the documentation, either.
Then it is suggested to read and digest the provided info and then re-state the question
If you concern is about " Evercookies" ?
Again, suggest reading and digesting the info and re-state the question
While I appreciate the insights, it is still true that some (very, very few) sites supply less cookies when in lockdown mode. The rest just flood the computer with ad cookies. It's just kinda creepy.
Just to add
From within Safari Version 26.3 (21623.2.7.11.6)
Owl-53 wrote:
Just to add…
iCloud Private Relay, as well. Though that feature available on macOS 13 with an iCloud subscription.
MrHoffman wrote:
Owl-53 wrote:
Just to add…
iCloud Private Relay, as well. Though that feature available on macOS 13 with an iCloud subscription.
👍
Lockdown mode doesn't seem to lock down anything
