Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cookie Warning Shenanigans Have Got to Stop

troyhunt.com

Post reply on HN
Print view View original

411–420 of 509 posts

Re: Cookie Warning Shenanigans Have Got to Stop

#411

Post by roel_v »

cortesoft wrote: post #314
rkeene2 wrote: post #294

Earlier quoted context omitted.

There was e-commerce before cookies. The same functionality of correlating multiple requests for a single request (building sessions upon packets) was just more difficult to use by encoding the session ID as a parameter in query string for each request. Many frameworks still support this mode.

Cookies pre-date SSL, so how were they securing that e-commerce that existed before cookies?

Nobody cared. I submitted CC numbers over http connections for years in the late 1990's. I emailed them sometimes, too. I also used telnet across the public internet and never got my passwords sniffed or mitm'd (only on hacker meetups where I would lure people into honeypots by doing fake telnet sessions :) )

Re: Cookie Warning Shenanigans Have Got to Stop

#412

Post by mafuy »

School-Cotton wrote: post #371
wsy wrote: post #357

Earlier quoted context omitted.

Illegal simply because it is murder, regardless how much money the murderer pays in advance. Immoral because human life and dignity should not become a tradeable commodity. A society allowing this would quickly deteriorate into a system where the rich just buy the desired behavior from the poor, and we would end up with an oligarchy instead of a democracy. Another angle to object would be Rawls's theory of justice: s…

Edit to state the central point clearly at the top: why do you think restricting their range of possible choices "protects the poor and weak" ? If you have a shitty job, would you be better off getting fired? No, because presumably you already had the ability to quit. (Anticipating someone jumping on me for the analogy: I'm obviously not saying having a shitty job is equivalent to being in such dire straits that some…

From your reply I think you did not entirely understand the parent's reasoning. I think you don't follow the consequences of your points to the end, where it becomes visible that they are not desirable. I believe that is what the parent is aiming at.

Re: Cookie Warning Shenanigans Have Got to Stop

#413

Post by subroutine »

ITT people are suggesting GDPR mandated cookie warnings are pointless because people have been trained to automatically tap "accept" or not gain access.

I don't buy it, and was the main point of this latest GDPR clarification [1]:

> "Cookie walls that demand a website visitor agrees to their internet browsing being tracked for ad-targeting as the “price” of entry to the site are not compliant..." [adding] "...There is no objection to software for the proper functioning of the website and the general analysis of the visit on that site... sharing of this information with 3rd parties is only allowed with permission."

Basically the mere presence of a cookie warning (regardless of the specifics) should not be signaling to the visitor "[agree] to enter" or "[agree] to enable features". They should be signaling "[agree] to us sharing some identity elements and browsing behavior with 3rd parties, mostly for ad targeting; or [decline] the aforementioned; either way, welcome to the site."

Once users realize they can still enter the site if they click deny, their (automatic) choice will better align with their actual preference.

[1] https://techcrunch.com/2019/03/08/cookie-walls-dont-comply-w...

Re: Cookie Warning Shenanigans Have Got to Stop

#414

Post by lixtra »

adventured wrote: post #182
bunderbunder wrote: post #57

Earlier quoted context omitted.

The law doesn't just apply to pages being served to the EU, it applies to pages being served to EU citizens, wherever they happen to be at the moment. So geolocation is not a satisfactory option.

> wherever they happen to be at the moment In the vast majority of cases that's not how laws actually work from one nation to the next. That isn't how legal jurisdiction works. If it were, any nation could impose its laws on any other nation at any time. > So geolocation is not a satisfactory option. In fact it is. I can safely disregard the EU and nearly all of its laws including GDPR and privacy laws in the EU. I d…

Of course, if you fly to Paris for honeymoon they get access to you and can hold you responsible. Just like bankers coming to Las Vegas and being held responsible for aiding tax fraud overseas.

Re: Cookie Warning Shenanigans Have Got to Stop

#415

Post by [deleted] »

mort96 wrote: post #311
jrochkind1 wrote: post #268

Earlier quoted context omitted.

" in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service." If I need to get explicit opt-in for "So, remembering your shopping cart when you come back requires cookies, that okay with you?" I'm not sure how much better that would be. It's still gonna be information overload "false positives". But I think that is what the regulations actually i…

I'm fairly sure I agree with out that the law wouldn't achieve its purpose even if it was implemented "correctly", and it certainly doesn't achieve its purpose with how it's implemented by websites today. I considered adding a short sentence about that, but ended up not doing it. I'm just tired of the vast amount of misinformation out there, and people discussing as if the directive applies to all cookies and only to…

[deleted]

Re: Cookie Warning Shenanigans Have Got to Stop

#416

Post by [deleted] »

Veen wrote: post #290
goto11 wrote: post #238

Earlier quoted context omitted.

I'm not totally sure what you are arguing, but if you don't use the cookies for tracking, then you don't need to warn or inform the user. And if you use some other kind of tracking beside cookies, you still need to warn.

Yes, there is a lot of nonsense talked about this. The GDPR makes it clear that sites don’t have to ask for permisssion to place session cookies and other cookies that are essential to the functioning of the site.

[deleted]

Re: Cookie Warning Shenanigans Have Got to Stop

#417

Post by sbov »

mort96 wrote: post #311
jrochkind1 wrote: post #268

Earlier quoted context omitted.

" in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service." If I need to get explicit opt-in for "So, remembering your shopping cart when you come back requires cookies, that okay with you?" I'm not sure how much better that would be. It's still gonna be information overload "false positives". But I think that is what the regulations actually i…

I'm fairly sure I agree with out that the law wouldn't achieve its purpose even if it was implemented "correctly", and it certainly doesn't achieve its purpose with how it's implemented by websites today. I considered adding a short sentence about that, but ended up not doing it. I'm just tired of the vast amount of misinformation out there, and people discussing as if the directive applies to all cookies and only to…

> I'm not entirely sure if a user account at an online store would require consent; in my view, cookies would be "strictly necessary" to provide the user experience a user expects

You can 100% support a logged in account experience without cookies. Java, for example, supports jsession id in the URL for people with cookies disabled. This id belongs to a session that is managed by the app server, which you can use to store information such as the cart, logged in account id, etc. If Java can do it, other languages and web frameworks that currently only support cookies can do it too.

I think the better angle to look at it is: session cookies expire when someone closes their browser. They aren't that good at tracking people.

Re: Cookie Warning Shenanigans Have Got to Stop

#418

Post by sarcasmOrTears »

radium3d wrote: post #25

As a web developer I gotta say the only true solution to this is to stop using the internet altogether. Might as well shut the internet down. We can't authenticate you without cookies or some other form of identification, so that throws out any site with an account. Even if I am not even remotely interested in tracking what pages you view on my website if I need to have you login and authenticate I need some form of…

Your post is at the bottom, as a proof of why we can't have nice things. People don't understand that it's MY webiste, not a property of the users or some EU's fattie bureaucrat. If they don't like my website they can just not visit instead of telling me how my w3bsite must behave.

Re: Cookie Warning Shenanigans Have Got to Stop

#419

Post by white-flame »

cortesoft wrote: post #314
rkeene2 wrote: post #294

Earlier quoted context omitted.

There was e-commerce before cookies. The same functionality of correlating multiple requests for a single request (building sessions upon packets) was just more difficult to use by encoding the session ID as a parameter in query string for each request. Many frameworks still support this mode.

Cookies pre-date SSL, so how were they securing that e-commerce that existed before cookies?

Does placing an order on a website, then sending a check in the mail still count as e-commerce?

Re: Cookie Warning Shenanigans Have Got to Stop

#420

Post by white-flame »

paulcole wrote: post #224
DavideNL wrote: post #128

In The Netherlands the Data Protection Authority announced this month that websites are no longer allowed to block access when people click "NO" in the cookie warning; Clicking 'no' should still allow people to view the website, but without placing any tracking cookies. Source (in Dutch): https://autoriteitpersoonsgegevens.nl/nl/nieuws/websites-moe...

> Clicking 'no' should still allow people to view the website, but without placing any tracking cookies. No! It doesn't. Viewing a website isn't anyone's god-given right. The tracking cookies are part of the business model. If you don't agree with how a business makes money, stop patronizing them. If this is serious, look for companies to just block all traffic from The Netherlands. Why even bother dealing with the h…

Slavery and child labor were also just "part of the business model".

Some business models are predatory societal negatives and should be done away with at a government level of respecting individual rights. Behind-the-scenes tracking and data brokering are in that class.

Post reply on HN