Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Slack stores browser cookies without user consent

twitter.com

Post reply on HN
Print view View original

111–118 of 118 posts

Re: Slack stores browser cookies without user consent

#111

Post by wlll »

knorker wrote: post #106
wlll wrote: post #97

Earlier quoted context omitted.

> Back in the 90s we had cookie confirmation things. A browser called konqueror even had it on by default. Every time a server tried to set a cookie you got a chance to say no, etc… > > For users it was as awful then as the experience is now. Yes, I remember. Back in the 90s you could always choose another browser that didn't do that, and we didn't yet have the rampant data collection and exploitation that we have se…

> Sorry, which websites were warning users of potential security issues before? Not just websites, but applications too. If you had to click "fuck off" to 100 cookie popups today, then when your email client pops up "exe files are dangerous", or your browser says "this website is not secure" you won't even read that, but just press "fuck off, make it happen". > Any website that is doing that is basically being forced…

I think you're speculating here. Anyway, I don't think the solution to these problems are to just get out of the way and let companies play fast and loose with our data, it's to continually push them to do better.

Re: Slack stores browser cookies without user consent

#112

Post by wlll »

contravariant wrote: post #108
wlll wrote: post #98

Earlier quoted context omitted.

GDPR isn't a cookie law, it's a data privacy law. Cookies aren't the problem, it's what people are doing with the data that's the issue. You can track people with all sorts of other means other than cookies, you would also need to get people's permission to do this.

We were specifically discussing the cookie banners though.

Yes, but in the context of GDPR, which doesn't really go into detail about cookies, "…throughout its’ 88 pages, it only mentions cookies directly once" - https://gdpr.eu/cookies/.

The issue is handling of PII, tracking users and the hoops companies are jumping through to try to trick users into agreeing to allow this. In reality forcing users to select through the myriad of cookies that many sites set isn't practical, and doesn't get round the fact that you still would have to "Receive users’ consent before you use any cookies except strictly necessary cookies."

A better technical solution would be to enforce that web applications respect a client header that specifies the level of cookies the client will allow (see https://gdpr.eu/cookies/).

An even better solution to this would be to stop the invasive tracking and profiling of users that has brought us to this point at all.

Re: Slack stores browser cookies without user consent

#113

Post by wlll »

kmlx wrote: post #109
wlll wrote: post #99

Earlier quoted context omitted.

It's not a free Internet if there's a hidden price the visitor has to pay, which is being tracked and monitored wherever they go.

0. the price is close to zero. that’s why most people don’t care about it. 1. it’s not hidden. open dev tools, see what the page does. 2. someone has got to pay. either a subscription or with your data, the salaries need paying once per month.

0. But I do, and I make my choice when presented with one.

1. That's still hidden. "read the code" has never been an acceptable answer to how to inform users, and wouldn't even get close to being allowed under the current GDPR or ePrivacy directives.

2. If you want me to pay then you have to tell me how much I have to pay. It's why there are laws on the clear display of prices in restaurants, and that bars in the UK have to have the prices of drinks listed.

If you want me to pay the price to enter your wensite then tell me what that is and let me make he choice.

Over the last 20 years or so companies have been playing fast and loose with people's data, they could have not done that, but the continued, and now this is what they have to deal with. Forgive me if I don't feel sorry for them in the slightest bit

Re: Slack stores browser cookies without user consent

#114

Post by wlll »

dusted wrote: post #110

I would be outraged if I didn't know what cookies were, but since I do, I think it's entirely reasonable, any half modern browser provides a mechanism to allow or disallow, and otherwise manage cookies, and I'd much prefer that we abandon these idiotic "we value your privacy" nag-screens and bars and let it be up to the browser and user settings. Even the smallest change to the Set-Cookie header could have made it tr…

> I would be outraged if I didn't know what cookies were, but since I do, I think it's entirely reasonable, any half modern browser provides a mechanism to allow or disallow, and otherwise manage cookies…

Unfortunately that mechanism doesn't exist.

> I'd much prefer that we abandon these idiotic "we value your privacy" nag-screens and bars

There's an easy way of fixing this, and that's to just not send the cookies. See basecamp.com or amazon.co.uk (from the UK). No cookie popups, and (respectively) 0 and 3 (seemingly essential) cookies.

> let it be up to the browser and user settings.

That ship has sailed. You now require user consent before you set all but essential cookies https://gdpr.eu/cookies/

> Even the smallest change to the Set-Cookie header could have made it trivial to implement a browser-side UI for this:

Set-Cookie: =; Max-Age=; Description=; Importance=

That ship has, as I said above, sailed.

> If people don't want cookies, they can disable them in their browser.

Ditto. But, seriously, do you know how ridiculous that argument sounds? Don't like people speeding? Don't drive! You are unlikely to be so thick to think that turning cookies off on a web browser will make the web anything other than completely unusable.

> This is still one of the most idiotic laws the EU has made so far.

The butthurt from people about this is amazing. We've had companies playing fast and loose with our data for 20+ years and they had all this time to sort themselves out, and they didn't. They kept on abusing the system to attempt to squeeze out ever more marginal gains from users personal data.

This is on them.

Re: Slack stores browser cookies without user consent

#115

Post by rafram »

jeofken wrote: post #76
rafram wrote: post #29

Earlier quoted context omitted.

I don’t know, I think the banner is a pain but it is absolutely the responsibility of web developers to allow user choice in tracking. Cookies don’t have to be third-party to be harmful. If the roads are bad, we need to fix the roads, not just tell everyone to drive better cars.

A HTTP response may ask the user agent to keep a cookie. The user agent is free to do so, reject it, or ask the user (as Konqueror did). It is not the responsibility of everyone responding to HTTP requests to ask to ask “I ask you if I can ask you to keep this cookie”. Remembering that HTTP is a format of messages being sent between people, it’s clear to me that this law is unwise. Likely written by Eurocrats who don…

In principle, yes, but if a browser asks a non-technical user whether they want to accept a cookie called "__Secure-3PAPISID" (an actual Google tracking cookie) with gibberish contents, what are they supposed to say? How can they understand what that means?

Re: Slack stores browser cookies without user consent

#116

Post by jeofken »

rafram wrote: post #115
jeofken wrote: post #76

Earlier quoted context omitted.

A HTTP response may ask the user agent to keep a cookie. The user agent is free to do so, reject it, or ask the user (as Konqueror did). It is not the responsibility of everyone responding to HTTP requests to ask to ask “I ask you if I can ask you to keep this cookie”. Remembering that HTTP is a format of messages being sent between people, it’s clear to me that this law is unwise. Likely written by Eurocrats who don…

In principle, yes, but if a browser asks a non-technical user whether they want to accept a cookie called "__Secure-3PAPISID" (an actual Google tracking cookie) with gibberish contents, what are they supposed to say? How can they understand what that means?

It’s true that those who don’t understand what a HTTP cookie is, are unable to make informed decisions about them.

Forcing those who reply to HTTP messages to ask if they can send a header asking if they can save a cookie does not change that - the user who clicks the cookie popup may still now understand what they do.

Many do understand things like private mode though, which is nice.

Re: Slack stores browser cookies without user consent

#117

Post by knorker »

wlll wrote: post #111
knorker wrote: post #106

Earlier quoted context omitted.

> Sorry, which websites were warning users of potential security issues before? Not just websites, but applications too. If you had to click "fuck off" to 100 cookie popups today, then when your email client pops up "exe files are dangerous", or your browser says "this website is not secure" you won't even read that, but just press "fuck off, make it happen". > Any website that is doing that is basically being forced…

I think you're speculating here. Anyway, I don't think the solution to these problems are to just get out of the way and let companies play fast and loose with our data, it's to continually push them to do better.

Am i speculating that all sites of nontrivial size has a cookie popup (or legally should have)? Or that popup fatigue is a thing? Could you be more specific?

I'm not saying there's no problem. I'm saying this doesn't even close to address the problem, and it makes everything much worse.

Re: Slack stores browser cookies without user consent

#118

Post by iamacyborg »

Seb-C wrote: post #104
iamacyborg wrote: post #85

Earlier quoted context omitted.

I have a form on my site. My site has no cookies. I have no issues.

If you don't even have a CSRF you actually probably have an issue that you are not aware of.

It's an email signup form so it's fine.
Post reply on HN