No Cookie for You • Hacker News Board

Re: No Cookie for You

#81

Post by ballenf » Thu, Dec 17, 2020, 5:45 PM UTC

ocdtrekkie wrote: post #18

kayson wrote: post #9

If they've gotten rid of 3rd party analytics, does this mean they're just using their own? Presumably session cookies count as "required", and could be used to track your actions at least on github.com.

Sure, but considering GitHub doesn't have advertising[1], and they're not sending it to a third party (like Google, who does), it's very hard to imagine any use for first party "tracking" that might harm you. Presumably the most they're using this for is recommending potentially interesting repos to you. [1] Potential concern would be if "Microsoft" was considered "their own", since Bing does have an ad network. But…

I get ads on GH homepage for open positions. They seem targeted to me or maybe I just notice the relevant ones.

Re: No Cookie for You

#82

Post by munchbunny » Thu, Dec 17, 2020, 5:45 PM UTC

shuckles wrote: post #42

louhike wrote: post #38

Earlier quoted context omitted.

Another solution is to do all the tracking in the backend. I'm not saying it's a good solution.

Wouldn't that still violate the law but just be harder to detect from the client? If so, I don't think GitHub (i.e. Microsoft) would find it a compelling approach.

It would still be a violation because of how you're using it. The law isn't purely about what data you track, it's primarily about what you do with the data.

Re: No Cookie for You

#83

Post by drcongo » Thu, Dec 17, 2020, 5:45 PM UTC

owaislone wrote: post #50

shuckles wrote: post #42

Earlier quoted context omitted.

Wouldn't that still violate the law but just be harder to detect from the client? If so, I don't think GitHub (i.e. Microsoft) would find it a compelling approach.

The backend already stored all the information about the users. Why would it violate any laws if it stored a bit more or a bit less info? Things can get tricky if Github exported the collected data to third party for analytics.

I can't reply to the reply to this for some reason, but it's worth noting that GDPR and the cookie law are different, though related.

Re: No Cookie for You

#84

Post by crazydoggers » Thu, Dec 17, 2020, 5:45 PM UTC

sildur wrote: post #48

fluidcruft wrote: post #34

Earlier quoted context omitted.

Authentication and authorization cookies seem pretty essential for any website that has accounts. If you block those cookies the website stops working -- they're essential. If you block ad networks and analytics the site functions just fine -- they're not essential. Beyond that there's probably some sort of "need to know" test to prevent convoluted fake dependencies.

They are not really, really essential. No cookie is essential. A long, long time ago I worked with a web system that kept session info in a URL parameter, and carried it over all the links. I think it was a C# website, but I'm not sure.

Yes ASP.NET allows (allowed? Haven’t used it in years) cookieless sessions this way. The problem is it has to rewrite all the relative links on the page to ensure session state is not lost.

The problem is it’s makes urls horribly unwieldy if a user wants to bookmark or paste in links from emails etc etc, or writing JS to interact with links, not to mention the security issues of being able to accidentally share your session.

Possibly, yes, but not at all user friendly.

Re: No Cookie for You

#85

Post by lloeki » Thu, Dec 17, 2020, 5:45 PM UTC

agency wrote: post #62

sildur wrote: post #48

Earlier quoted context omitted.

They are not really, really essential. No cookie is essential. A long, long time ago I worked with a web system that kept session info in a URL parameter, and carried it over all the links. I think it was a C# website, but I'm not sure.

Would this mean that if you shared a URL with someone you would be sharing your session as well?

Yes. Some sites operating like that eventually tried to work around this issue by tying it to the IP, but you can see how that is hopelessly broken anyway.

Re: No Cookie for You

#86

Post by s14ve » Thu, Dec 17, 2020, 5:46 PM UTC

AndrewStephens wrote: post #31

I hate the standard wording on Cookie banners. Most of them should read: "The site uses cookies. Actually it doesn't - you are not logged on and we don't need to maintain state. But our advertising partners, their partners, and their partner's partners all love to set tracking cookies. Click here to consent to three dozen cookies from around the globe."

This wording should be required by GDPR. :)

If that would be the case, maybe more sites would follow GitHub here.

Re: No Cookie for You

#87

Post by p410n3 » Thu, Dec 17, 2020, 5:47 PM UTC

brtkdotse wrote: post #28

austinl wrote: post #19

Can anyone familiar with the topic explain what distinguishes essential from non-essential cookies? GitHub gives the example of "those used by third-party analytics, tracking, and advertising services", but curious if the law defines some sort of bright line here.

I can guarantee that you could throw a rock in your city’s business district and hit a lawyer that is in the process of doing incredible mental acrobatics to wrangle Google Analytics to be an “essential part of the offering”.

I work a lot with GDPR and making sites compliant, and some agency's do in fact tell this to their customers. I suspect it's to sell their Services for cheaper.

Luckily where I work we are pretty serious about this stuff. Since one of our main revenue's is Data protection consulting, anything else would be idiotic anyway

Re: No Cookie for You

#88

Post by OJFord » Thu, Dec 17, 2020, 5:47 PM UTC

drcongo wrote: post #83

owaislone wrote: post #50

Earlier quoted context omitted.

The backend already stored all the information about the users. Why would it violate any laws if it stored a bit more or a bit less info? Things can get tricky if Github exported the collected data to third party for analytics.

I can't reply to the reply to this for some reason, but it's worth noting that GDPR and the cookie law are different, though related.

For very recent comments, click on the timestamp to get the single comment view and be able to reply.

(I had to do it here too.)

Re: No Cookie for You

#89

Post by Privacy846 » Thu, Dec 17, 2020, 5:48 PM UTC

Spivak wrote: post #78

AndrewStephens wrote: post #31

I hate the standard wording on Cookie banners. Most of them should read: "The site uses cookies. Actually it doesn't - you are not logged on and we don't need to maintain state. But our advertising partners, their partners, and their partner's partners all love to set tracking cookies. Click here to consent to three dozen cookies from around the globe."

“And we would rather not have this crap but nobody pays for content are there only two types of ad networks: privacy preserving and paying so we’re stuck. Please call your congressperson to complain [here].”

”Businesses are the real victims.”

—Another fake quote

Re: No Cookie for You

#90

Post by munchbunny » Thu, Dec 17, 2020, 5:48 PM UTC

SilasX wrote: post #58

dry_soup wrote: post #3

A lot of people have the misconception that the EU cookie law applies to all cookies, but as the blog post correctly points out, that just isn't the case.

Right but it still seems like this could violate the GDPR, right? They say: >>So, we have removed all non-essential cookies from GitHub, and visiting our website does not send any information to third-party analytics services. But you’re still only allowed to use the cookies for the purpose the user gave you them for , right? So, if: a) the cookies are essential for the user session, and b) you collect the cookies, w…

That's correct. Using cookies for the user session is fine and does not require consent as long as you really are just using them for the user session. The moment you use them for analytics, you have to request consent for analytics, even if they are primarily for maintaining the user session.