61–70 of 193 posts
I use Firefox Focus as my primary browser on the phone. I get some kind of thrill agreeing to cookies from sites that are going to disappear from my history in minutes.
Honestly, I think it is our job as the creators/hackers to come up with a better solution. The problem is very real, and needs to be fixed. But no good solution has ever been created by lawyers. Ever. So here we are, left with a forest of cookie warnings that perfectly break the internet. So here is a proposal: What if a user could declare her/his consent settings _before_ opening the website? There would no longer b…
Standardize an extension to the Set-Cookie header for a "Purpose" field. This field if unset means the cookie is essential (local laws now still apply so if a website misrepresents a non-essential cookie as essential then that's illegal just the same way as implementing a fake cookie banner or not implementing one (if you need it) is illegal). Now in my browser I can set my cookie preferences to only store and send essential cookies.
For other tracking methods that don't use cookies there's already DNT and all that's needed is for a local law update to clarify what it means and to enforce its use.
These things would actually make sense as opposed to the current situation where the EU makes it sound like cookies are something a website forcibly stores on your computer and uses.
Honestly, I think it is our job as the creators/hackers to come up with a better solution. The problem is very real, and needs to be fixed. But no good solution has ever been created by lawyers. Ever. So here we are, left with a forest of cookie warnings that perfectly break the internet. So here is a proposal: What if a user could declare her/his consent settings _before_ opening the website? There would no longer b…
Surely there's an easier way: Standardize an extension to the Set-Cookie header for a "Purpose" field. This field if unset means the cookie is essential (local laws now still apply so if a website misrepresents a non-essential cookie as essential then that's illegal just the same way as implementing a fake cookie banner or not implementing one (if you need it) is illegal). Now in my browser I can set my cookie prefer…
Earlier quoted context omitted.
> The consent popups you see aren't just about cookies though. I don't care about all the other stuff the popups are about either. The popups are pointless, click-through damage and they serve no purpose. The laws that caused them to exist are equally pointless. There is no measurable benefit to any of this privacy theater and no less tracking is occurring since the advent of all of these pointless popups.
Have you tried going through these new popups? If they are trustworthy then the current ones allow you to disable some cookies and give you an idea of who is doing the tracking. Even though there are far better ways to manage cookies with browser settings and extensions: the options are sometimes quite limited (e.g. Chrome on Android) and many people would simply be unaware of cookies without these popups. Those peop…
I have. I found what the cynic in me expected to find: ambiguity enough to pass a convoy of container ships. This, coupled with the certainty that there are effectively no authorities policing these claims in detail (particularly the non-FAANG sites, being far less lucrative lawsuit targets) has only further convinced me of the utter pointlessness of consent popups.
Honestly, I think it is our job as the creators/hackers to come up with a better solution. The problem is very real, and needs to be fixed. But no good solution has ever been created by lawyers. Ever. So here we are, left with a forest of cookie warnings that perfectly break the internet. So here is a proposal: What if a user could declare her/his consent settings _before_ opening the website? There would no longer b…
We could stop using tracking cookies.
Earlier quoted context omitted.
Surely there's an easier way: Standardize an extension to the Set-Cookie header for a "Purpose" field. This field if unset means the cookie is essential (local laws now still apply so if a website misrepresents a non-essential cookie as essential then that's illegal just the same way as implementing a fake cookie banner or not implementing one (if you need it) is illegal). Now in my browser I can set my cookie prefer…
Beautiful technical solution. Wouldn’t it depend on all website creators and all browser makers to pretty much commit to changes in their code at the same time, before the first consent banner would actually go away? How do you get them to do that?
Of course user agent sniffing tends to cause a lot of problems, so this probably isn't a good idea.
Earlier quoted context omitted.
idgi, is it harder for a malicious website to ask you if you accept cross site tracking cookies and then ignore your refusal than it is for them to ignore the same instruction from your browser?
No, this is about boundaries, abstractions and context really. When a browser sets a bound, the website usually has no way to override that, as the browser is above it permission-wise. Similarly, if the OS sets a boundary, the browser looses out, since it's below the OS. Fittingly, when you deny crossing such a boundary, you'd expect it to be denied. Imagine, for example, if the dialog to allow push notifications for…
Earlier quoted context omitted.
> The consent popups you see aren't just about cookies though. I don't care about all the other stuff the popups are about either. The popups are pointless, click-through damage and they serve no purpose. The laws that caused them to exist are equally pointless. There is no measurable benefit to any of this privacy theater and no less tracking is occurring since the advent of all of these pointless popups.
Have you tried going through these new popups? If they are trustworthy then the current ones allow you to disable some cookies and give you an idea of who is doing the tracking. Even though there are far better ways to manage cookies with browser settings and extensions: the options are sometimes quite limited (e.g. Chrome on Android) and many people would simply be unaware of cookies without these popups. Those peop…
Earlier quoted context omitted.
Its failure to make any real difference, together with the total lack of standard around implementation (why isn’t it treated like every other native browser permission dialog?) make it truly despicable.
> why isn’t it treated like every other native browser permission dialog? Because it's not a browser permission. The browser could offer to send a "no" for you, but the site could just go on and track you anyway. It would be like having a permission dialog where clicking "no" just would ask the program kindly not to run with admin permissions. Now, you might argue that the browser could start blocking cookies, but th…
Not just "could", this was already tried: https://en.wikipedia.org/wiki/Do_Not_Track
It's still in Firefox at least, and Mixpanel does respect it (a tracking service akin to Google Analytics), but not a whole lot else.
Earlier quoted context omitted.
idgi, is it harder for a malicious website to ask you if you accept cross site tracking cookies and then ignore your refusal than it is for them to ignore the same instruction from your browser?
No, this is about boundaries, abstractions and context really. When a browser sets a bound, the website usually has no way to override that, as the browser is above it permission-wise. Similarly, if the OS sets a boundary, the browser looses out, since it's below the OS. Fittingly, when you deny crossing such a boundary, you'd expect it to be denied. Imagine, for example, if the dialog to allow push notifications for…
I see these answers and I always get the feeling that they treat existing software (browsers, websites, os) like something that was handed down by God in the book of law.
The browser already asks the user for permission through the OS - it does for location, webcam, filesystem, etc - there's no context needed because you're actively engaged with it, the browser or the os system don't need any more context than the user clicked Yes or No for this request.
The other part of the implementation is fining the companies. I'm sure after a few millions every month they'll stop making SDK's that don't enforce collecting authorisation from the user before tracking.