Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Slack stores browser cookies without user consent

twitter.com

Post reply on HN
Print view View original

71–80 of 118 posts

Re: Slack stores browser cookies without user consent

#71

Post by knorker »

mikrosom wrote: post #4
wlll wrote: post #3

Earlier quoted context omitted.

Care to elaborate on that? I rather like it. As a developer it's a pain, but as a citizen I find it to be a step in the right direction.

I'd also be interested in an elaboration. It isn't much about the violation of the law itself but the violation of privacy; why do I have linkedin.com, spiceworks.com, techtarget.com, godknowswhat.com suspiciously dumping cookies in my browser?

And that has changed now?

(more text here: https://news.ycombinator.com/item?id=25028296)

Re: Slack stores browser cookies without user consent

#72

Post by 0df8dkdf »

merb wrote: post #67
0df8dkdf wrote: post #63

Earlier quoted context omitted.

No cookies are 'necessary' for site functionality, unless there is a login needed. No cookies are 'necessary' to just display information, pics and videos.

bullshit. any site with a form needs a cookie, unless the site is stupid. any site that tries to use post requests might need some. heck even the confirmation or storing which cookies should be saved needs a fucking cookie.

no you don't unless authentication is needed. How is post request and cookie even related? It is simple web dev 101.

Re: Slack stores browser cookies without user consent

#73

Post by jeofken »

yladiz wrote: post #8
ffpip wrote: post #5

1. Block 3rd party cookies (useless on 99.99% of the sites) 2. Install uBlock Origin ( https://www.ublockorigin.com )

Don't forget step 0: 0. Don't illegally put nonessential cookies in the browser without the user's consent.

Let’s remember that the http response asks the user agent to keep the cookie - it is voluntary to do so.

Browsers may not have white lists but rather always set cookies, but it is not a given.

For this reason, I wish my government would have rejected the ridiculous cookie law, and GDPR as well.

Re: Slack stores browser cookies without user consent

#74

Post by blueblisters »

Honestly what's more annoying is websites presenting non-EU visitors with consent banners.

I understand doing an IP based geolocation filter might not meet stringent compliance requirements/might be technically involved, but I resent a UX pattern that repeatedly requests my consent for cookies because, ironically, I do a lot of my browsing in incognito mode.

Re: Slack stores browser cookies without user consent

#75

Post by yeahforsureman »

BlueTemplar wrote: post #56
piva00 wrote: post #40

Earlier quoted context omitted.

This is on purpose. It's done to be as painful as possible while being legal to make the user hate the experience and blame the law, not the implementation. I'm hoping the EU cracks down on dark pattern implementations, malicious compliance (as another comment mentioned) very likely goes against the spirit of the law. The ad-tech industry is quite powerful so I think this will drag on for a while. While it drags out,…

> There are some implementations creating hundreds of lines of opt-outs, some where you have to opt-out vendor by vendor on their own website. If I'm not mistaken, if there isn't a big 'Refuse All' (non critical) button on the 1rst dashboard 'page', then that implementation is considered to be illegal by the GDPR ?

The part of GDPR that gets applied here is the general standard for obtaining consent. It's very high-level stuff... So, without very specific case law, it's hard to say. The requirement that it should be as easy to revoke consent as it is to give one certainly resembles your argument.

Re: Slack stores browser cookies without user consent

#76

Post by jeofken »

rafram wrote: post #29
burke wrote: post #26

Earlier quoted context omitted.

In my opinion, it’s solving the problem at the wrong level. If you, as a government, want to coerce someone into solving this problem, it should be forcing browser vendors to provide more visibility into and control over (especially third-party) cookies. Instead, we have a banner you have to interact with as the price to visit pretty much any website.

I don’t know, I think the banner is a pain but it is absolutely the responsibility of web developers to allow user choice in tracking. Cookies don’t have to be third-party to be harmful. If the roads are bad, we need to fix the roads, not just tell everyone to drive better cars.

A HTTP response may ask the user agent to keep a cookie.

The user agent is free to do so, reject it, or ask the user (as Konqueror did).

It is not the responsibility of everyone responding to HTTP requests to ask to ask “I ask you if I can ask you to keep this cookie”.

Remembering that HTTP is a format of messages being sent between people, it’s clear to me that this law is unwise. Likely written by Eurocrats who don’t understand HTTP.

Re: Slack stores browser cookies without user consent

#77

Post by jeofken »

mikrosom wrote: post #4
wlll wrote: post #3

Earlier quoted context omitted.

Care to elaborate on that? I rather like it. As a developer it's a pain, but as a citizen I find it to be a step in the right direction.

I'd also be interested in an elaboration. It isn't much about the violation of the law itself but the violation of privacy; why do I have linkedin.com, spiceworks.com, techtarget.com, godknowswhat.com suspiciously dumping cookies in my browser?

Keeping cookies is voluntary - the HTTP header can only ask if you wish to keep it.

Most popular user agents just keep all cookies by default, but it’s by no means given.

Re: Slack stores browser cookies without user consent

#78

Post by TheRealPomax »

yladiz wrote: post #39
TheRealPomax wrote: post #20

Earlier quoted context omitted.

except that -1: there's nothing illegal about not asking for consent when cookies are not related to, in the cookie itself, personally identifiable information. You don't need permission to set cookies, every server with session management relies on them. You do need permission to set cookie that may leak PII. This person should try again, but this time actually look at the content of the cookies to see whether their…

No, it’s not a PII related issue. You need consent to set nonessential cookies, regardless if they contain PII. An example is Segment, which sets cookies but may not be tied to a particular user. Segment, at least using just for analytics, isn’t necessary for the function of a website or app, so even if the cookies don’t have any PII you still need to get consent. You’re right that you don’t need permission to set se…

No, you don't: GDPR makes zero stipulations about that, and only requires consent if you're dealing with cookies that either contain PII, or themselves act as PII for cross-site tracking purposes.

Sites are entirely free to set as many cookies as they like for any and all "non-essential" site purposes because anything in place to make a website work can be trivially argued in any court to be essential to running that particular business in the most cost effective manner: page metrics, heat maps, front door proxying, A/B testing, optimization etc. are all part of running a business on the web. Whether you as user consider that essential, or what your opinion is on what qualifies as "cost effective" is entirely irrelevant. Will the site work without an analytics cookie, and an optimizely cookie, and a cloudfront cookie, etc. ? Sure. But if a business decides they need a service that needs cookies set to work properly, as long as no PII is involved, that is not GDPR's concern in the slightest.

Re: Slack stores browser cookies without user consent

#79

Post by WhyNotHugo »

blueblisters wrote: post #74

Honestly what's more annoying is websites presenting non-EU visitors with consent banners. I understand doing an IP based geolocation filter might not meet stringent compliance requirements/might be technically involved, but I resent a UX pattern that repeatedly requests my consent for cookies because, ironically, I do a lot of my browsing in incognito mode.

The real problem is that companies insist on doing so much non-essential user tracking.

The intent of GDPR is to reduce this, but companies seems to prefer providing a terrible UX instead of respecting user's privacy.

Post reply on HN