Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: A Chrome extension that will auto-reject non-essential cookies

blog.bymitch.com

Post reply on HN
Print view View original

61–70 of 175 posts

Re: Show HN: A Chrome extension that will auto-reject non-essential cookies

#61

Post by berkes »

coldpie wrote: post #59
berkes wrote: post #50

Earlier quoted context omitted.

> You think these websites give a shit about your privacy because you clicked on a div with a "No" in it Yes. For a subset of "these websites". Because this is enforced and EU has fined billions already. The fines for doing what you say they do, are steep and a severe risk for many "these websites".

> For a subset of "these websites". So for websites that are not in that subset, they will still track you regardless of what you click on, so you still need browser-level protections for those websites, and those browser-level protections will also work on the websites that are in that subset, so you still gain nothing by clicking the No.

Yes. But "these websites" will then be prosecuted, their owners cannot enter the EU ever again without the risk of severe penalties, they cannot do business in the EU and can and often will, lose access to many services that do want to stay on the good side the EU (i.e. will see their google ads blocked, their stripe frozen, their hosting closed etc)

Edit: what I'm trying to say is: this "technical" problem has a real and working "solution" that's not technical at all: law and enforcement. Now, that won't work for all and everything, it never does. There will always be malicious, scammy, malware, criminal and illegal webservices around. But it makes it very hard for malicious actors to do so and make money.

Re: Show HN: A Chrome extension that will auto-reject non-essential cookies

#62

Post by daveoc64 »

leoxiong wrote: post #17

I never understood why the HTTP Do Not Track header wasn’t used to signal cookie preferences. It seemed like the perfect solution.

>I never understood why the HTTP Do Not Track header wasn’t used to signal cookie preferences.

You aren't really giving preferences related to cookies with these "cookie banners".

The laws in the EU require companies to get user permission for certain types of data processing.

Cookies may be involved in that, but they may not be.

Browser features like local storage or session storage would also be covered, and a lot of processing done server-side without the use of cookies requires permission too.

A single indicator like the DNT header or the newer GPC header can't cover all of this, so it isn't suitable for complying with the ePrivacy Directive or GDPR.

Re: Show HN: A Chrome extension that will auto-reject non-essential cookies

#63

Post by mcoliver »

Love the idea. I wish chrome extensions had a more granular permissions structure and/or reminders/security checkups on installed extensions and their permissions.

As it is the content scripts manifest permission for https://*/* for content.js is always so jarring to see. For those that don’t know this allows the extension to run that script on every site you visit after clicking accept ONCE when you install the extension. That means it can see financial info, health info, legal info, your diary, etc…

Now this makes sense from a usability perspective (I never have to see a cookie banner ever again!), but the author could change content.js at any time and the extension would continue to run without prompting the user.

This is not an attack on you Mitch! It sure looks like you’re trying to provide value in this world rather than take it. Rather it’s an attack on Google’s extension security model I’m really shocked google has not taken a more careful and nuanced stance to protecting users from a security standpoint.

I write this as a fellow chrome extensions dev. I wish I had better more granular permissions structures to protect my users and give them more information about what I am requesting and why along with regular reminders so they can make informed decisions about what they want to share.

Re: Show HN: A Chrome extension that will auto-reject non-essential cookies

#64

Post by GavCo »

shmoogy wrote: post #5
mrweasel wrote: post #2

Consent-O-Matic can easily be configured to reject cookies. I suppose that technically you could also just remove the pop-ups, that means that you never agreed to anything and the site have no permission to place cookies on your computer.

This is only true in Europe - it is not required by the US privacy laws and the default most companies deal with will be set to implicit allow

Was an interesting experience travelling to Italy and suddenly starting to get cookie banners on sites I visit daily that normally don't have

Re: Show HN: A Chrome extension that will auto-reject non-essential cookies

#65

Post by coldpie »

berkes wrote: post #61
coldpie wrote: post #59

Earlier quoted context omitted.

> For a subset of "these websites". So for websites that are not in that subset, they will still track you regardless of what you click on, so you still need browser-level protections for those websites, and those browser-level protections will also work on the websites that are in that subset, so you still gain nothing by clicking the No.

Yes. But "these websites" will then be prosecuted, their owners cannot enter the EU ever again without the risk of severe penalties, they cannot do business in the EU and can and often will, lose access to many services that do want to stay on the good side the EU (i.e. will see their google ads blocked, their stripe frozen, their hosting closed etc) Edit: what I'm trying to say is: this "technical" problem has a rea…

Yeah but the question is how you, as a user, should best protect yourself. I'm saying clicking the "No" provides no advantage over using a browser that just protects you from tracking by default. Then it doesn't matter whether the website is following the law or whether the EU (where I don't live) will enforce the law or change it in the future or whatever.

> Now, that won't work for all and everything, it never does. There will always be malicious, scammy, malware, criminal and illegal webservices around.

Yeah, exactly. So if I have to protect myself from those websites anyway, I may as well apply the same protections to all websites. Clicking the "No" does nothing for me.

Re: Show HN: A Chrome extension that will auto-reject non-essential cookies

#66

Post by berkes »

coldpie wrote: post #55
charcircuit wrote: post #46

Earlier quoted context omitted.

The issue is with how browsers implemented it. Instead of implementing it with a per domain granularity it was implemented as a global option. People may enable the option to block tracking from malicous parties, but may unknowingly block tracking from good companies. So now good companies would need to ask the user if they actually want tracking since they may accidently be blocking it.

> tracking from good companies Say what?

There's proper and good tracking possible just fine.

Tracking to discover latency, errors, weird behaviour, malicious actors and so on.

Tracking to see what content does well and what not.

Tracking to see what rough demographics (mobile, desktop, country, region, time-of-day etc) visit your premises.

E.g. plausible-analytics or even Matomo do a good job at i) keeping the data rough and broad and without any PII, and ii) storing the data on-premise rather than at commercial aggregators who will either re-sell or use it for own services.

Re: Show HN: A Chrome extension that will auto-reject non-essential cookies

#67

Post by rkagerer »

coldpie wrote: post #8

uBlock Origin already has this. Enable the "Cookie notices" and "Annoyances" filters in uBlock Origin's settings. Bonus pro-tip: Firefox for Android supports uBlock Origin, which means you can get rid of these godawful banners on mobile, too. Only iOS users are stuck having to put up with them.

Could you clarify which options you mean?

https://i.imgur.com/QnedRVZ.png

Also, how's that compare to Consent-O-Matic in terms of effectiveness,safety (i.e. that it doesn't mangle the wrong thing on the site) and performance?

Re: Show HN: A Chrome extension that will auto-reject non-essential cookies

#69

Post by sneak »

raverbashing wrote: post #47
coldpie wrote: post #8

uBlock Origin already has this. Enable the "Cookie notices" and "Annoyances" filters in uBlock Origin's settings. Bonus pro-tip: Firefox for Android supports uBlock Origin, which means you can get rid of these godawful banners on mobile, too. Only iOS users are stuck having to put up with them.

My ideal solution to this would be: accept all cookies, then delete them after page unload

This is what the extension Cookie Autodelete does. It even allows you to make an exclusion list of ones you wish to persist.

Re: Show HN: A Chrome extension that will auto-reject non-essential cookies

#70

Post by coldpie »

rkagerer wrote: post #67
coldpie wrote: post #8

uBlock Origin already has this. Enable the "Cookie notices" and "Annoyances" filters in uBlock Origin's settings. Bonus pro-tip: Firefox for Android supports uBlock Origin, which means you can get rid of these godawful banners on mobile, too. Only iOS users are stuck having to put up with them.

Could you clarify which options you mean? https://i.imgur.com/QnedRVZ.png Also, how's that compare to Consent-O-Matic in terms of effectiveness,safety (i.e. that it doesn't mangle the wrong thing on the site) and performance?

I use the EasyList ones, though I don't have any particular reason for that other than it is also the default "Ads" list chosen upon installation.

> Also, how's that compare to Consent-O-Matic in terms of effectiveness,safety (i.e. that it doesn't mangle the wrong thing on the site) and performance?

Dunno. I've never had any problems with it. All it does is hide the cookie banner DOM elements.

Post reply on HN