Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Slack stores browser cookies without user consent

twitter.com

Post reply on HN
Print view View original

91–100 of 118 posts

Re: Slack stores browser cookies without user consent

#91

Post by whimsicalism »

lol768 wrote: post #51
hdudjdididbbfk wrote: post #42

Earlier quoted context omitted.

“We need these super high tech cookiemotrons to provide you with the best user experience possible. We consider it a technical necessity to meet your need to have your data harvested. You should be thanking us. We would explain further, but you’re too stupid. What are you gonna do? Have us testify before technologically illiterate politicians and fine us 1% of what we pay our CEO?.”

> Have us testify before technologically illiterate politicians and fine us 1% of what we pay our CEO? Slack operates in the EU and has paying customers in the EU. It also likes to take advantage of anti-competition regulations when convenient: https://slack.com/intl/en-in/blog/news/slack-files-eu-compet... CEO pay seemed to be $356,952 at time of Slack's IPO. Maximum fine under GDPR is the greater of 4% annual turno…

> Regulations here have teeth

Citing the maximum possible fine here does essentially nothing to convince me of that fact.

Re: Slack stores browser cookies without user consent

#93

Post by jchw »

g_p wrote: post #90
jchw wrote: post #65

Earlier quoted context omitted.

From GDPR.eu: > Strictly necessary cookies — These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. Cookies that allow web shops to hold your items in your cart while you are shopping online are an example of strictly necessary cookies. These cookies will generally be first-party session cookies. While it is not required to obtain consent for these…

Only if it's needed for giving the user functionality they explicitly request (i.e. after adding something to their basket, they implicitly accept a session cookie that's solely used to hold their basket content). That wouldn't extend to using that cookie for analytics or retargeting though. https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a... So I'd argue it does need to be a specific reason, at least if…

Strictly necessary can also include security measures, of which session IDs tend to be a part of.

Re: Slack stores browser cookies without user consent

#94

Post by burke »

rafram wrote: post #29
burke wrote: post #26

Earlier quoted context omitted.

In my opinion, it’s solving the problem at the wrong level. If you, as a government, want to coerce someone into solving this problem, it should be forcing browser vendors to provide more visibility into and control over (especially third-party) cookies. Instead, we have a banner you have to interact with as the price to visit pretty much any website.

I don’t know, I think the banner is a pain but it is absolutely the responsibility of web developers to allow user choice in tracking. Cookies don’t have to be third-party to be harmful. If the roads are bad, we need to fix the roads, not just tell everyone to drive better cars.

In this analogy though, browsers really feel more analogous to roads and sites to cars to me, rather than the other way around, being the common infrastructure on which the other operates.

Re: Slack stores browser cookies without user consent

#95

Post by knorker »

rafram wrote: post #29
burke wrote: post #26

Earlier quoted context omitted.

In my opinion, it’s solving the problem at the wrong level. If you, as a government, want to coerce someone into solving this problem, it should be forcing browser vendors to provide more visibility into and control over (especially third-party) cookies. Instead, we have a banner you have to interact with as the price to visit pretty much any website.

I don’t know, I think the banner is a pain but it is absolutely the responsibility of web developers to allow user choice in tracking. Cookies don’t have to be third-party to be harmful. If the roads are bad, we need to fix the roads, not just tell everyone to drive better cars.

Why is it the responsibility of a host to provide labour for free? If you don't accept the price of admission, then just don't go in.

Say I have a dress code at my club. You don't have the right to a "meaningful choice" of wearing flip flops and shorts and still enter my property.

I don't have the right to a meaningful choice of bypassing paywall either.

Re: Slack stores browser cookies without user consent

#96

Post by thotsBgone »

yonixw wrote: post #53
avian wrote: post #52

Earlier quoted context omitted.

From my perspective as a user making me click those traffic lights isn't essential functionality.

But for the business, bot protection is essential. And GDPR talks about business perspective.

Surely, for a business, things like advertisement, tracking, etc. may also be essential.

Re: Slack stores browser cookies without user consent

#97

Post by wlll »

knorker wrote: post #70
wlll wrote: post #3

Earlier quoted context omitted.

Care to elaborate on that? I rather like it. As a developer it's a pain, but as a citizen I find it to be a step in the right direction.

Back in the 90s we had cookie confirmation things. A browser called konqueror even had it on by default. Every time a server tried to set a cookie you got a chance to say no, etc… For users it was as awful then as the experience is now. The people who made this law seemed to be under the impression that sites would react by removing cookies. This is naive or plain stupid. Instead what we have now is that every single…

> Back in the 90s we had cookie confirmation things. A browser called konqueror even had it on by default. Every time a server tried to set a cookie you got a chance to say no, etc… > > For users it was as awful then as the experience is now.

Yes, I remember. Back in the 90s you could always choose another browser that didn't do that, and we didn't yet have the rampant data collection and exploitation that we have seen since. Back in the 90s it was a novel thing when $known_company got a website at all. In the intervening years a huge amount of our life and identity has moved online.

> The people who made this law seemed to be under the impression that sites would react by removing cookies. This is naive or plain stupid. Instead what we have now is that every single site has a popup saying "Lorem ipsum" (nobody reads this), and you have to click "fuck off" to get to the content.

Where there is no way of opting out of the data collection I leave, and I have taught my family to do the same.

It is possible to run a website that doesn't use cookie popups. Amazon UK sets 3 essential cookies (i18n prefs and two session cookies) on first page load. https://basecamp.com/ doesn't set any.

> ACTUAL security problems now, or ACTUAL choices, now cannot be warned about. Because if users were not good at reading actual meaningful warnings before, they sure as hell don't read them now.

Sorry, which websites were warning users of potential security issues before? What choices were users being asked to make? I am not sure we were browsing the same web.

> So not only is this law (1) not helping, people still have cookies. It's also (2) annoying absolutely everyone every day, with up to four "fuck off" buttons users need to click per page load, and (3) actively hurting via huge externalities, as described above.

Remember that this law isn't about cookies. It's not a cookie law, it's a law about data privacy and control. Cookies are just one part of it. The law also deals with the safe and appropriate handling of user data, and when a website does pop up a huge hard to use banner that uses dark patterns to get you to click it then it's not the EU being annoying and forcing users through this annoying process, it's forcing websites to effectively tell users that they want to do extra things with their data. It's like forcing bank robbers to dress up in stripey shirts and use bags labelled "SWAG".

Any website that is doing that is basically being forced to wave a big red flag "I AM DOING DODGY THINGS WITH YOUR DATA" when you visit. You can at that point blindly click the "Accept" button if you want, I choose to leave.

The web industry, and avertisers in particular, have had over 20 years to pull their shit together to avoid this, but they didn't, so now we have this.

> Oh, and for extra bonus on a weekly basis I run into websites that chose to simply block users from EU IPs, presumably after a ROI calculation. Thanks, EU.

I've hit very few of those, and to be honest it's not been a particularly big deal. It's also their choice. Don't want to stick to the EU speed limit? Don't drive on the EU roads.

> Are you in Europe?

For now.

Re: Slack stores browser cookies without user consent

#98

Post by wlll »

contravariant wrote: post #31
rafram wrote: post #29

Earlier quoted context omitted.

I don’t know, I think the banner is a pain but it is absolutely the responsibility of web developers to allow user choice in tracking. Cookies don’t have to be third-party to be harmful. If the roads are bad, we need to fix the roads, not just tell everyone to drive better cars.

I mean sure, but technically you already have that choice. It's entirely up to you whether to keep, discard or modify cookies. Your user agent is doing a bad job of managing this for you.

GDPR isn't a cookie law, it's a data privacy law. Cookies aren't the problem, it's what people are doing with the data that's the issue.

You can track people with all sorts of other means other than cookies, you would also need to get people's permission to do this.

Re: Slack stores browser cookies without user consent

#99

Post by wlll »

kmlx wrote: post #17
trickstra wrote: post #13

Earlier quoted context omitted.

Those notices also often say "This site uses cookies to make your experience better", so yes, in this sense it's useless. But that's not all the law is doing. Many websites from US simply stopped serving anything for European IP addresses, responding just with error 451, which I always take as a sign that this site wants to sell my data more than they want to show me ads, so I'm glad I didn't accidentally visit it.

it’s actually a sign of a fragmented internet, and brings into question the very idea of an open and free internet. but alas, if this is what politicians want, this is what we’re getting.

It's not a free Internet if there's a hidden price the visitor has to pay, which is being tracked and monitored wherever they go.

Re: Slack stores browser cookies without user consent

#100

Post by danhor »

merb wrote: post #69
Nextgrid wrote: post #44

Earlier quoted context omitted.

We did, it was called Do-Not-Track. If websites were respecting it we wouldn't have the current situation. The problem? Websites were not only ignoring it but using it as yet another tracking vector.

if gdpr would have used a framework like do-not-track it would have not happend. but as always in the eu. NIH syndrome. also they did not cared besides multiple people telling the rulemakers that this will happen.

There's nothing about the gdpr that forced cookie banners for each website. The tech industry could have implemented the requirements differently, but they haven't done that, instead taking the most annoying and obvious route. The closest thing to a technical solution that was widespread is do-not-track, but since it gets thoroughly ignored nowadays, it's worthless. As an example, since the DNT header is a pretty clear signal that you don't want to consent for various tracking, websites wouldn't have to display the consent-form for that and could only use essential cookies (or leave a choice for cookies for other purposes, if there are any). Recital 32: "This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance of the proposed processing of his or her personal data."

And according to the ico (https://ico.org.uk/for-organisations/guide-to-data-protectio...), the common click-this-button-to-get-through or do annoying things is not valid consent: "You may not rely on silence, inactivity, default settings, pre-ticked boxes or your general terms and conditions, or seek to take advantage of inertia, inattention or default bias in any other way.".

The reason why you don't want a specific technical provision in this law (and almost all laws) is that they get outdated in less than five years. For example, imagine a framework based on http-headers fixed in law. That would've made it (almost) impossible for google to introduce spdy in europe, since it isn't http. Or, more general, the EU initiative to use micro-usb connectors would have made the switch to usb-c impossible, if they were written into law. And that's a comparatively slow moving field, with a very specific applications (charging mobile phones).

Post reply on HN