Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop Saying, ‘We Take Your Privacy and Security Seriously’

techcrunch.com

Post reply on HN
Print view View original

31–40 of 112 posts

Re: Stop Saying, ‘We Take Your Privacy and Security Seriously’

#31

Post by ckastner »

wirrbel wrote: post #11
emilis_info wrote: post #5

Also stop saying "Before you go further..." we need to share your data with tens of corporations. /s Note to non-EU users: Techcrunch is completely blocking the page with a popup asking me to share my location and behavioral data (for advertising purposes) with a probably very long list of companies (something called "Oath" family). The logos shown are for Yahoo, Aol, Autoblog, Huffpost and Engadget. Nah. I'll skip a…

I just clicked through the links of that banner and I landed on https://www.oath.com/de/my-data/#protectingdata anyways, I will not read the article because I am sure these dialogs are built in a way to gain "consent" by trickery.

...and after landing on that page, you have to click through to the privacy Dashboard, where you can supposedly opt-out of individual partners.

I say "supposedly", because the first partner I clicked on led me to the "I'm not a robot" captcha.

After which I just closed the window. Guess I'll not read the article after all.

How on earth they expect this to fly under the GDPR, expecially considering that "[t]hese partners may access your device to collect data for ad selection, delivery and measurement", is beyond me.

Re: Stop Saying, ‘We Take Your Privacy and Security Seriously’

#32

Post by _jomo »

vntok wrote: post #4
atoav wrote: post #2

Say it, when you do. Say: We take your Privacy and Security seriously that is why we won’t ever store a tracking cookie on your machine. If you still want to support us by different means, click here Anybody who takes your privacy seriously won’t even have to ask for consent, because there is nothing to ask for

Tracking cookies provide incommensurable value to site owners for improving the quality of their web properties, which ultimately benefits users. Example abound: finding out where people are the most frustrated (high exit rates), what content drives the most interest (page views), what content is missing or inaccurate (high bounce rate and low visit duration for visitors coming from Google), how they are using the si…

You can get most of this by analyzing server logs with IP addresses. No cookies required. You might need some JavaScript tracking for more detailed analytics, but there is absolutely no need for external tracking by Google or the likes.

Examples for self-hosted analytics include GoAccess (server log analyzer) [0] or Matomo (JavaScript tracking, formerly Piwik) , although I think it uses tracking cookies by default [1]

0: https://github.com/allinurl/goaccess

1: https://matomo.org

Re: Stop Saying, ‘We Take Your Privacy and Security Seriously’

#33

Post by jjjensen90 »

arethuza wrote: post #30
emilis_info wrote: post #5

Also stop saying "Before you go further..." we need to share your data with tens of corporations. /s Note to non-EU users: Techcrunch is completely blocking the page with a popup asking me to share my location and behavioral data (for advertising purposes) with a probably very long list of companies (something called "Oath" family). The logos shown are for Yahoo, Aol, Autoblog, Huffpost and Engadget. Nah. I'll skip a…

I just realised I had been reading "Oath" as "OAuth" - not that I am aware of visiting the site but I wonder if they chose that name to get some additional credibility?

Probably not directly tied to its similarity to OAuth, but I'm sure the name Oath came from thousands of man hours of brand psychology assessment and audience testing. Oath is the stapled together corpses of the adtech of Verizon and AOL and was/is ridiculed for being a poor name choice, but branding decisions at corporations of that size go through so many committees and data points and marketing schlubs, who knows how it came out as Oath.

Re: Stop Saying, ‘We Take Your Privacy and Security Seriously’

#34

Post by nightcracker »

formatkaka wrote: post #28
claudius wrote: post #23

Earlier quoted context omitted.

All of these. Do not store user data on your end unless you absolutely have to. Do not give user data to third parties unless you absolutely have to. Do not do anything without the user explicitly or implicitly consenting to it. Example: You have to momentarily store the users IP address in order to serve their request for a website. Remove the IP address as soon as you served their request, because you don’t absolut…

To make the product better, we require information about how the user interacts with it. What about if we: 1. Save data anonymously. OR 2. If we have to save some data, we give them an option to access what we have saved. something like 'Data Settings'.

3. Ask

Re: Stop Saying, ‘We Take Your Privacy and Security Seriously’

#35

Post by kapep »

wirrbel wrote: post #11
emilis_info wrote: post #5

Also stop saying "Before you go further..." we need to share your data with tens of corporations. /s Note to non-EU users: Techcrunch is completely blocking the page with a popup asking me to share my location and behavioral data (for advertising purposes) with a probably very long list of companies (something called "Oath" family). The logos shown are for Yahoo, Aol, Autoblog, Huffpost and Engadget. Nah. I'll skip a…

I just clicked through the links of that banner and I landed on https://www.oath.com/de/my-data/#protectingdata anyways, I will not read the article because I am sure these dialogs are built in a way to gain "consent" by trickery.

The dialogs are really confusing.

1st popup page: Some text about Oath with big "OK" button and same size "Manage Options" link. By clicking OK you agree to everything.

2nd popup page when clicking "Manage Options" link: Some more text about Oath with big "OK" button and tiny "Manage Options" link next to a headline. I have no idea what happens when I click OK here. Is the same as the "OK" button on the first page? I didn't manage anything here yet so I guess it could mean agree to everything again. On the other hand there are some settings you can change on the next screen (you don't know that at this point though), so maybe "OK" now means continue and use these settings? You have to trust that they are opt-in rather than opt-out, otherwise you need to check the settings.

3rd popup page when clicking manage "Manage Options" link: Some text about Oath partners with links within the text. The big button is called "Done" now but at this point it is not clear what exactly that means because there was nothing to manage yet. Clicking the link to show partners displays a list of 10 essential partners (Amazon, Google, ebay etc.) with links to 10 data privacy policies that you apparently automatically have to agree with. A bit hard to notice but there's another tab for IAB partner with 224 more partners. At least they aren't enabled by default.

I guess "Done" means use these options and it brings you back to the 2nd popup. I actually have no idea at which point I disagreed or disabled something, I just got trained to click a bunch of "OK" buttons with unclear meaning.

Re: Stop Saying, ‘We Take Your Privacy and Security Seriously’

#36

Post by cr1895 »

formatkaka wrote: post #28
claudius wrote: post #23

Earlier quoted context omitted.

All of these. Do not store user data on your end unless you absolutely have to. Do not give user data to third parties unless you absolutely have to. Do not do anything without the user explicitly or implicitly consenting to it. Example: You have to momentarily store the users IP address in order to serve their request for a website. Remove the IP address as soon as you served their request, because you don’t absolut…

To make the product better, we require information about how the user interacts with it. What about if we: 1. Save data anonymously. OR 2. If we have to save some data, we give them an option to access what we have saved. something like 'Data Settings'.

Maybe a good place to start:

https://ico.org.uk/for-organisations/guide-to-data-protectio...

Re: Stop Saying, ‘We Take Your Privacy and Security Seriously’

#40

Post by claudius »

formatkaka wrote: post #28
claudius wrote: post #23

Earlier quoted context omitted.

All of these. Do not store user data on your end unless you absolutely have to. Do not give user data to third parties unless you absolutely have to. Do not do anything without the user explicitly or implicitly consenting to it. Example: You have to momentarily store the users IP address in order to serve their request for a website. Remove the IP address as soon as you served their request, because you don’t absolut…

To make the product better, we require information about how the user interacts with it. What about if we: 1. Save data anonymously. OR 2. If we have to save some data, we give them an option to access what we have saved. something like 'Data Settings'.

1) Ask the user if they consent. If they don’t, let them continue using the product and do not collect any data. Make both the "Yes, I consent" and the "No, I do not consent" buttons equally large.

2) If they do consent, consider every individual part of data you save. Do not save complete user sessions, instead, before doing anything, decide what you want to test, which information you require to do so and then save only this information. E.g. (using the example elsewhere) if you want to check how long people stay on individual pages, collect a signal on each page how long the user stayed on this page (and nothing else).

3) Anonymize the data as quickly as possible. For the example above, do not store data for each user how long they stayed on each page. Instead, have one counter per page which is incremented by the time the user stayed on the page (and the individual time subsequently immediately discarded). This way you can still figure out which pages are left early but you cannot tie this data to any individual user.

4) If you want to look at individual user sessions, pay people to use the website while you stand behind them (physically), do not collect data from random customers.

Post reply on HN