Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: WebSession, a Secure Replacement for Cookies

websession.dev

Post reply on HN
Print view View original

61–70 of 113 posts

Re: Show HN: WebSession, a Secure Replacement for Cookies

#61

Post by diggan »

Beldin wrote: post #27

From the article: > As a result of increasingly strict privacy laws across the world, users are now beset with cookie banners across the Web In the words of a law prof from the Radboud University, more accurate is to say "as a result of an entire industry colluding to undermine legislation".

Seems like more companies than needed are confessing to misusing people's data. If you only use cookies for login or other essential information (not related to tracking people), you do not need to show any cookie banner. Same with the GDPR stuff, if you don't store more data about users than absolutely needed for essential functionality, GDPR isn't affecting you.

Re: Show HN: WebSession, a Secure Replacement for Cookies

#62

Post by contravariant »

psd1 wrote: post #54
grammers wrote: post #44

Cookies are not really about security, but privacy. Their tracking of your online habits are bad; how would that change with WebSessions?

I don't clear cookies because session cookies are useful. If cookies are never session cookies, then I can treat all cookies as useless.

Just clear all cookies after the session. That's what I do, I just need to make a couple of exceptions for the few webpages I want to remember me across multiple sessions.

Re: Show HN: WebSession, a Secure Replacement for Cookies

#63

Post by jampekka »

latexr wrote: post #58
jampekka wrote: post #52

Earlier quoted context omitted.

Nobody ever got fired for joining the cargo cult.

I wouldn’t be so sure. Joining the cargo cult doesn’t make you immune to the law. https://noyb.eu/en/noyb-aims-end-cookie-banner-terror-and-is...

Very unlikely this will cause anybody to be fired. Will not probably even lead to company fines, nor the disappearance of the illegal dark patterns. E.g. a lot of sites used the IAB nag that was found illegal by the regulators. But IIUC only IAB had to pay a small fine and I'm quite sure nobody got fired for it because it was the "industry standard".

NOYB is fighting the good fight, and without it GDPR would be even more useless. But it's a losing battle, and NYOB itself is sort of admitting that. https://noyb.eu/en/statement-4-years-gdpr

GDPR is in theory a good law (although things like mandatory honoring of do-not-track headers should have been obviously included). But it's not being enforced almost at all probably due to regulatory agencies and EU being corrupt AF.

Having a lot of money, lobbyists and lawyers makes you immune to the law.

Re: Show HN: WebSession, a Secure Replacement for Cookies

#64

Post by Aachen »

spiderfarmer wrote: post #47
janosdebugs wrote: post #41

> Because WebSession is dedicated to session maintenance and nothing else, a client could theoretically reject all cookies on any supporting site, ideally skipping the jarring cookie banner experience. This has nothing to do with cookies, the banner is required if the site is processing data that is not just technically necessary. In this case the site needs to ask the user for consent or at least inform them of proc…

Still lots of sites have cookie banners because the legal department demands them, even though they are not needed for the cookies they use.

If they had asked a legal department whether a banner is needed for functional data storage (such as a cookie), they'd know it isn't demanded by them

Re: Show HN: WebSession, a Secure Replacement for Cookies

#66

Post by latexr »

jampekka wrote: post #63
latexr wrote: post #58

Earlier quoted context omitted.

I wouldn’t be so sure. Joining the cargo cult doesn’t make you immune to the law. https://noyb.eu/en/noyb-aims-end-cookie-banner-terror-and-is...

Very unlikely this will cause anybody to be fired. Will not probably even lead to company fines, nor the disappearance of the illegal dark patterns. E.g. a lot of sites used the IAB nag that was found illegal by the regulators. But IIUC only IAB had to pay a small fine and I'm quite sure nobody got fired for it because it was the "industry standard". NOYB is fighting the good fight, and without it GDPR would be even…

> Will not probably even lead to company fines, nor the disappearance of the illegal dark patterns.

NOYB’s intervention has lead to fines and I’ve been seeing way more banners have a “Reject All” at the top level. I remember noticing that at the same time NOYB posted about it. Unfortunately I don’t remember any useful keyword to search their website and post the source.

Though I’m not disagreeing with you. I have no doubt the dark patterns will continue and these companies will be as vampiric as they can get away with.

My strategy is to use that as a useful signal: the more a company or website bends over backwards to try to get me to accept data collection, the more I know I can’t trust them and will simply leave.

Re: Show HN: WebSession, a Secure Replacement for Cookies

#67

Post by account42 »

> Even with all of these, a compromised client, an unsecured application log, or an eavesdropper on the connection after TLS termination could result in a cookie being stolen.

So it can be stolen from the client or the server. Same applies to this proposal.

Re: Show HN: WebSession, a Secure Replacement for Cookies

#68

Post by psd1 »

contravariant wrote: post #62
psd1 wrote: post #54

Earlier quoted context omitted.

I don't clear cookies because session cookies are useful. If cookies are never session cookies, then I can treat all cookies as useless.

Just clear all cookies after the session. That's what I do, I just need to make a couple of exceptions for the few webpages I want to remember me across multiple sessions.

Yeah, turning that on and setting the exceptions is on my to-do list...

Re: Show HN: WebSession, a Secure Replacement for Cookies

#69

Post by porridgeraisin »

lolinder wrote: post #29
porridgeraisin wrote: post #13

The only real advantage I see here is having a dedicated storage for session identifiers as opposed to clubbing it with other non-essential cookies. Everything else in the proposal isn't really required. Considering this, simply choosing a standard name for session cookies suffices. Browsers can give an option to the user to rejects all cookies that don't have the name "WebSession". This is already achievable using e…

The instant you implement that, then everyone will just start squeezing all the tracking information they need into the WebSession cookie. Plus, this isn't backwards compatible with all the existing servers that use custom names for the session cookie. PHPSESSID, session_id, etc.

It's already unique, so no need to cram more information.

About the backwards compatibility - the whole idea suggested in the article is that the user can block all cookies and use WebSession. That isn't backwards compatible with PHPSESSID either.

Re: Show HN: WebSession, a Secure Replacement for Cookies

#70

Post by jampekka »

latexr wrote: post #66
jampekka wrote: post #63

Earlier quoted context omitted.

Very unlikely this will cause anybody to be fired. Will not probably even lead to company fines, nor the disappearance of the illegal dark patterns. E.g. a lot of sites used the IAB nag that was found illegal by the regulators. But IIUC only IAB had to pay a small fine and I'm quite sure nobody got fired for it because it was the "industry standard". NOYB is fighting the good fight, and without it GDPR would be even…

> Will not probably even lead to company fines, nor the disappearance of the illegal dark patterns. NOYB’s intervention has lead to fines and I’ve been seeing way more banners have a “Reject All” at the top level. I remember noticing that at the same time NOYB posted about it. Unfortunately I don’t remember any useful keyword to search their website and post the source. Though I’m not disagreeing with you. I have no…

Do you have a reference for the fines? Can't find much on the enforcement tracker [1], but seeing if the decision is about a nag or not is not easy to see quickly, so I may have missed them. NOYB also gave them a "grace period" before filing complaints, so I don't know how many complaints they actually made.

A lot of the nags have indeed gotten less illegal lately. Although I have very little faith in that even clicking Reject All really prevents tracking and selling me out. There are still those "legitimate interests" etc loopholes. And probably no regulator actually checks that the Reject is honored at all. Nowadays I don't even care. Used to go private mode for those but don't bother anymore. Hopefully at least my aggressive ad blocking makes spying on me mostly worthless on them.

Implementation of the GDPR consent was broken from the getgo (likely due to corruption). The spirit of the law is clearly that people shouldn't be tracked if they don't want it. Vast majority don't want to be tracked but vast majority are tracked.

If EU would have actually wanted this to work it would have been something like DNT. Also the promised megafines have not (and will not be) materialized and the (widespread and blantant) violations are at best just cost of doing business.

But making an actually effective implementation would have closed many revolving doors and fancy dinners.

Sorry for being so negative on this but I think entertaining hopes for such a fundamentally broken system may prevent less broken ones from arising.

https://www.enforcementtracker.com/ (going through the cases also shows that the DPAs are mostly fiddling with small fish who don't have the corruption power and/or lawyer army)

Post reply on HN