Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Slack stores browser cookies without user consent

twitter.com

Post reply on HN
Print view View original

101–110 of 118 posts

Re: Slack stores browser cookies without user consent

#101

Post by lol768 »

iamacyborg wrote: post #86
lol768 wrote: post #51

Earlier quoted context omitted.

> Have us testify before technologically illiterate politicians and fine us 1% of what we pay our CEO? Slack operates in the EU and has paying customers in the EU. It also likes to take advantage of anti-competition regulations when convenient: https://slack.com/intl/en-in/blog/news/slack-files-eu-compet... CEO pay seemed to be $356,952 at time of Slack's IPO. Maximum fine under GDPR is the greater of 4% annual turno…

> Regulations here have teeth; it's not the United States - and it's a good thing for society that they do. sadly, the regulators are yet to show that the GDPR has any teeth. Most recently, the ICO gave British Airways and Marriott significant reductions on fines they raised last year.

£20M and £18.4M are still reasonably sizeable amounts - and given the pandemic has likely impacted BA & Marriott's profits substantially already, I think some sort of adjustment was likely the fair thing to do.

H&M have been fined £32M. This wasn't hugely far off the 4% annual turnover cap.

Compared to the previous Data Protection Act limits, these fines are definitely significant.

Re: Slack stores browser cookies without user consent

#102

Post by lol768 »

whimsicalism wrote: post #91
lol768 wrote: post #51

Earlier quoted context omitted.

> Have us testify before technologically illiterate politicians and fine us 1% of what we pay our CEO? Slack operates in the EU and has paying customers in the EU. It also likes to take advantage of anti-competition regulations when convenient: https://slack.com/intl/en-in/blog/news/slack-files-eu-compet... CEO pay seemed to be $356,952 at time of Slack's IPO. Maximum fine under GDPR is the greater of 4% annual turno…

> Regulations here have teeth Citing the maximum possible fine here does essentially nothing to convince me of that fact.

What're you implying? That non-trivial amounts are never actually fined?

TIM were fined 2780% of the CEO's base salary recently.

Re: Slack stores browser cookies without user consent

#103

Post by Nextgrid »

BlueTemplar wrote: post #54
Nextgrid wrote: post #44

Earlier quoted context omitted.

We did, it was called Do-Not-Track. If websites were respecting it we wouldn't have the current situation. The problem? Websites were not only ignoring it but using it as yet another tracking vector.

Couldn't all these 'pick cookies' dashboards be integrated in the browser without running in the same issue ?

The problem is that the GDPR consent prompts ask for tracking/data processing consent regardless of any technical methods like cookies, local storage or browser fingerprinting.

A browser implementing a cookie consent UI would not fully solve the problem because websites might still want to track you through other means (browser fingerprinting, server-side analytics, etc) and if they want to respect the regulation then they still need to ask for consent.

Re: Slack stores browser cookies without user consent

#104

Post by Seb-C »

iamacyborg wrote: post #85
merb wrote: post #67

Earlier quoted context omitted.

bullshit. any site with a form needs a cookie, unless the site is stupid. any site that tries to use post requests might need some. heck even the confirmation or storing which cookies should be saved needs a fucking cookie.

I have a form on my site. My site has no cookies. I have no issues.

If you don't even have a CSRF you actually probably have an issue that you are not aware of.

Re: Slack stores browser cookies without user consent

#105

Post by nunorbatista »

g_p wrote: post #89
yonixw wrote: post #53

Earlier quoted context omitted.

But for the business, bot protection is essential. And GDPR talks about business perspective.

When placing cookies, the bar to essential is actually really high. It has to be essential and unavoidable for the delivery of the bytes to the browser, or it has to be essential for the requested functionality. The UK ICO has some pretty good guidance. I'd not be confident at all arguing that recaptcha is at all essential under PECR, even though it may be a legitimate interest under GDPR. Important to note that PECR…

Not sure if I agree. Taken from your ICO link:

"This means you are unlikely to need consent for: - load-balancing cookies that ensure the content of your page loads quickly and effectively by distributing the workload across several computers."

You can put a lot of things in this exemption list. I risk to say, even Google Analytics.

Re: Slack stores browser cookies without user consent

#106

Post by knorker »

wlll wrote: post #97
knorker wrote: post #70

Earlier quoted context omitted.

Back in the 90s we had cookie confirmation things. A browser called konqueror even had it on by default. Every time a server tried to set a cookie you got a chance to say no, etc… For users it was as awful then as the experience is now. The people who made this law seemed to be under the impression that sites would react by removing cookies. This is naive or plain stupid. Instead what we have now is that every single…

> Back in the 90s we had cookie confirmation things. A browser called konqueror even had it on by default. Every time a server tried to set a cookie you got a chance to say no, etc… > > For users it was as awful then as the experience is now. Yes, I remember. Back in the 90s you could always choose another browser that didn't do that, and we didn't yet have the rampant data collection and exploitation that we have se…

> Sorry, which websites were warning users of potential security issues before?

Not just websites, but applications too. If you had to click "fuck off" to 100 cookie popups today, then when your email client pops up "exe files are dangerous", or your browser says "this website is not secure" you won't even read that, but just press "fuck off, make it happen".

> Any website that is doing that is basically being forced to wave a big red flag "I AM DOING DODGY THINGS WITH YOUR DATA" when you visit.

But since that's every website, it's meaningless. Especially since nobody looks at that red flag because of popup fatigue.

Re: Slack stores browser cookies without user consent

#107

Post by BlueTemplar »

Nextgrid wrote: post #103
BlueTemplar wrote: post #54

Earlier quoted context omitted.

Couldn't all these 'pick cookies' dashboards be integrated in the browser without running in the same issue ?

The problem is that the GDPR consent prompts ask for tracking/data processing consent regardless of any technical methods like cookies, local storage or browser fingerprinting. A browser implementing a cookie consent UI would not fully solve the problem because websites might still want to track you through other means (browser fingerprinting, server-side analytics, etc) and if they want to respect the regulation the…

Well, this would still offload most of it to the browser, and I guess that plenty of websites (especially smaller ones, for which GDPR compliance is likely to be a heavy drag) do not use these other means ?

Re: Slack stores browser cookies without user consent

#108

Post by contravariant »

wlll wrote: post #98
contravariant wrote: post #31

Earlier quoted context omitted.

I mean sure, but technically you already have that choice. It's entirely up to you whether to keep, discard or modify cookies. Your user agent is doing a bad job of managing this for you.

GDPR isn't a cookie law, it's a data privacy law. Cookies aren't the problem, it's what people are doing with the data that's the issue. You can track people with all sorts of other means other than cookies, you would also need to get people's permission to do this.

We were specifically discussing the cookie banners though.

Re: Slack stores browser cookies without user consent

#109

Post by kmlx »

wlll wrote: post #99
kmlx wrote: post #17

Earlier quoted context omitted.

it’s actually a sign of a fragmented internet, and brings into question the very idea of an open and free internet. but alas, if this is what politicians want, this is what we’re getting.

It's not a free Internet if there's a hidden price the visitor has to pay, which is being tracked and monitored wherever they go.

0. the price is close to zero. that’s why most people don’t care about it.

1. it’s not hidden. open dev tools, see what the page does.

2. someone has got to pay. either a subscription or with your data, the salaries need paying once per month.

Re: Slack stores browser cookies without user consent

#110

Post by dusted »

I would be outraged if I didn't know what cookies were, but since I do, I think it's entirely reasonable, any half modern browser provides a mechanism to allow or disallow, and otherwise manage cookies, and I'd much prefer that we abandon these idiotic "we value your privacy" nag-screens and bars and let it be up to the browser and user settings.

Even the smallest change to the Set-Cookie header could have made it trivial to implement a browser-side UI for this:

Set-Cookie: =; Max-Age=; Description=; Importance=

If people don't want cookies, they can disable them in their browser.

This is still one of the most idiotic laws the EU has made so far.

Post reply on HN