Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No Cookie for You

github.blog

Post reply on HN
Print view View original

171–180 of 634 posts

Re: No Cookie for You

#171

Post by laurent123456 »

Blikkentrekker wrote: post #153
laurent123456 wrote: post #122

I wish there was a browser option "I don't care about being tracked" and that would get rid of all cookie banners (and, more often than not, full page popups). This EU law comes from a good idea, but it's terribly implemented - it implies that everybody out there is a lawyer and can make sense and agree on multiple pages of confusing legalese, and this every time they open a new website. This is so absurd, and the re…

Or blanket non-consent of course. I too find it quite annoying. The other issue is that sometimes the banners do not properly work with various aids for disability and keyboard-operated browsers.

There is the "Do not track" option, but as I understand it's ignored by most websites. That's why I wouldn't mind a "Do what ever you want" option, and in exchange popups are removed.

That's how it was before and I'm not certain that it caused that much harm. Users can always block ads and third-party cookies anyway if they wish to do so.

Re: No Cookie for You

#172

Post by merb »

Macha wrote: post #160
merb wrote: post #135

Earlier quoted context omitted.

well most sites still generate at least some kind of csrf cookie. multi language site sometimes even have tz/lang

TZ/lang preferences do not require consent, a CSRF token for a logged in user seems to me to be legitimate interest too, but I suppose you could see it as an identifier that can be linked back to the user. I still think if you're using it just for security purposes it counts, but the fact that the same identifier could be used for tracking based on differences on the backend is one of the reasons why this isn't just…

well it's legal to create a hash and save it inside a database to count unique users. if the hash is not connected to any info that would identify a user (btw. user agent is some kind of identifing stuff) it is fine.

what I wanted to say is that cookies are not illegal by gdpr means and gdpr does not make a lot of stuff illegal, it's just that SAVING personal information or information that could identify somebody needs explicit permission.

edit: another thing ip addresses, by german law you are required to save it, when a user can register on your site and your site allows users to submit data. because authorities force you to give them out when a user did something illegal. (§ 7 Abs.1 Satz1 Nr.4 TKÜV, https://www.gesetze-im-internet.de/tk_v_2005/__7.html) In germany it's basically: fuck the privacy if they harmed our law! or at least you need a way to "activate" saving ip addresses.

Re: No Cookie for You

#173

Post by oneplane »

> EU law requires you to use cookie banners if your website contains cookies that are not required for it to work.

No it doesn't. EU Law requires you to not harvest data at will, and you either must have a basic functional requirement (i.e. 'remember my login'), or you must ask the user if you can have their data to profile them so the advertisements can make a few percent more money (yes, the whole profiling thing doesn't even add that much to the bottom-line!).

Re: No Cookie for You

#174

Post by jwr »

dry_soup wrote: post #3

A lot of people have the misconception that the EU cookie law applies to all cookies, but as the blog post correctly points out, that just isn't the case.

Yes! If you use cookies for essential functionality (like keeping track of logged in status), you don't have to do anything. No banners, no annoyance for your users.

I dropped all third-party crap from my site way back and haven't ever needed a cookie banner.

Re: No Cookie for You

#176

Post by [deleted] »

tgb wrote: post #130
munchbunny wrote: post #90

Earlier quoted context omitted.

That's correct. Using cookies for the user session is fine and does not require consent as long as you really are just using them for the user session. The moment you use them for analytics, you have to request consent for analytics, even if they are primarily for maintaining the user session.

But wouldn't that consent be in the EULA? So long as they only track logged-in people, they'd have agreed to that.

[deleted]

Re: No Cookie for You

#177

Post by mumblemumble »

thomascgalvin wrote: post #128
random5634 wrote: post #103

Earlier quoted context omitted.

Good lord, everyone needs banners and popups? Why not just let browsers controls who sets what cookies? I'm tired the endless cookie popups, can we come up with an "allow cookies if the browser accepts them" standard as long as that guarantees no cookie popups? Then browser vendors can ship a delete all non same origin cookies on tab close or something.

This is (mostly) based on EU law; entities that set cookies and track user data are required to get opt-in permission from users before doing so, and if the user declines, the entity cannot offer a degraded service. At least that's the idea. In practice, almost everyone just throws up a banner that says "fuck you, we're selling your data as hard and as fast as we can," with no opt-out available, but they pretend that…

Would it be possible to set up a global cookie exchange? Some sort of browser plugin that lets us all swap tracking cookies?

Sharing is caring.

Re: No Cookie for You

#178

Post by tuna-piano »

marvinblum wrote: post #114
tuna-piano wrote: post #54

Earlier quoted context omitted.

Looked for a few minutes and couldn't find the full answer. How does Plausible calculate unique users if it can't store some type of identifier on the page? I see this... "We do not generate any persistent identifiers either. We generate a random string of letters and numbers that is used to calculate unique visitors on a website and we reset this string once per day." But where is that ID stored?

Probably like we do it for pirsch.io, by calculating a hashed fingerprint and throwing away the individual page hits once per day: https://github.com/pirsch-analytics/pirsch

Seems like a good method and actually more accurate than they do... seems like they just do a hash of IP.

Re: No Cookie for You

#179

Post by Macha »

merb wrote: post #172
Macha wrote: post #160

Earlier quoted context omitted.

TZ/lang preferences do not require consent, a CSRF token for a logged in user seems to me to be legitimate interest too, but I suppose you could see it as an identifier that can be linked back to the user. I still think if you're using it just for security purposes it counts, but the fact that the same identifier could be used for tracking based on differences on the backend is one of the reasons why this isn't just…

well it's legal to create a hash and save it inside a database to count unique users. if the hash is not connected to any info that would identify a user (btw. user agent is some kind of identifing stuff) it is fine. what I wanted to say is that cookies are not illegal by gdpr means and gdpr does not make a lot of stuff illegal, it's just that SAVING personal information or information that could identify somebody ne…

How do you create the hash? If it's based on something that you can derive from the user (let's say sha1(IP address + User Agent), that seems pretty clearly identifying. If you generate a random identifier but save that identifier in their cookies and send it back next time, also pretty clearly identifying.

Re: No Cookie for You

#180

Post by Bakary »

robgibbons wrote: post #116

I understand the need for GDPR, but its consequence of obtrusive cookie consent banners is easily one of the worst things to happen to the web in recent memory.

That's like blaming the flashlight for revealing rats under the kitchen sink
Post reply on HN