New browser signal could make cookie banners obsolete • Hacker News Board

Re: New browser signal could make cookie banners obsolete

#161

Post by mgkimsal » Wed, Jun 16, 2021, 2:11 PM UTC

ezoe wrote: post #152

mgkimsal wrote: post #101

in the 90s, we had a 'big cookie' scare. and laws were threatened (or passed?). And... MUCH of this came down to ... managing cookies (or other browser state) was (and is) largely so damn hidden behind layers of configs, menus and options. We have a home button. We have forward and back. We have 'bookmark' buttons, which many people understand. A big 'COOKIE' button, on the main browser UI, that clearly show cookie i…

The problem is, most people don't understand what cookie really is. If it's understood, you don't need to support so much clueless people and no sane politician in EU would made a cookie law. The button you suggests cause more harm than good. Because people don't understand the cookie and think "is this button delete unnecessary data from my computer? Why not" and click it. Now all the legitimate data that were saved…

"Now all the legitimate data that were saved on their local storage is gone and they complains."

Not necessarily. Cookie !== localStorage (although... localStorage didn't exist at the time, IIRC).

My point was "we" (it/tech folks, but mainly browser makers) got ourselves in to this mess in the first place, and rather than making things more obvious and easier to deal with at that time, we seemed to double down on more obscure UIs.

I swear, pretty much every Netscape release, and later, for years, every other Firefox release, changed where/what/how cookie mgt was located in their UI.

"most people don't understand what cookie really is"

And that's... whose fault? Putting a big-ass 'COOKIE' button, with transparency in to what data is there, with quick options to remove it all, would have gone a LONG way to normalizing understanding. See some unknown shit in there? Delete it. If enough important things start breaking after deletion, people would have adapted (either users, or developers).

"delete unnecessary data" - there's pretty much nothing people put in cookies that is truly 'necessary' for most folks.

We didn't give people usable tools to manage this stuff, so eventually people turned to legislative means.

Re: New browser signal could make cookie banners obsolete

#162

Post by M2Ys4U » Wed, Jun 16, 2021, 2:13 PM UTC

qwerty456127 wrote: post #13

> The mechanism serves as an automated means for users to give or refuse consent There already is the do-not-track flag, why not just force everybody to respect it?

There are a couple of reasons.

DNT is primarily about tracking, this new spec is more general and covers much more processing of personal data, and allows one to opt-in (or out) of specific instances of processing of specific (categories) of data.

Re: New browser signal could make cookie banners obsolete

#163

Post by nickpp » Wed, Jun 16, 2021, 2:13 PM UTC

M2Ys4U wrote: post #157

nickpp wrote: post #151

Earlier quoted context omitted.

There are many opinions online, but there is no authoritative, definitive answer. GDPR was made vague by design "to prevent future exploits". Even lawyers are arguing the details, three years after its introduction. This made GDPR in effect one of the most expensive regulations we had to implement as IT companies. It is also so incredibly punitive that everybody choose to implement it in the most conservative way pos…

The GDPR doesn't even mention cookies. It's the ePrivacy Directive that regulates them (or, more precisely, "information stored in the terminal equipment of a subscriber"). And the ePrivacy Directive does , in fact, define what's allowed without notifying the user: "any technical storage or access for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communication…

This kind of vague, high-level language is exactly why, if you reject cookies, you'll receive the same damn popup next time you visit the website until you relent and click Yes.

They never tried applying their abstract concepts to the real world until we had to and the result is "The Web of Cookie Popups".

Re: New browser signal could make cookie banners obsolete

#164

Post by nickpp » Wed, Jun 16, 2021, 2:17 PM UTC

hnarn wrote: post #158

nickpp wrote: post #151

Earlier quoted context omitted.

There are many opinions online, but there is no authoritative, definitive answer. GDPR was made vague by design "to prevent future exploits". Even lawyers are arguing the details, three years after its introduction. This made GDPR in effect one of the most expensive regulations we had to implement as IT companies. It is also so incredibly punitive that everybody choose to implement it in the most conservative way pos…

Instead of ranting and providing nothing but conjecture about how "expensive" GDPR is (whatever that means), or insinuating that lawyers "arguing" about something proves that legislation is ineffective (that's literally their job), refer to first hand sources and ask constructive questions in good faith about what you don't understand. Here's one example: https://gdpr.eu/cookies/ Both first party session cookies and…

Then why does the very gdpr.eu website have a cookie banner at the bottom of the page?! There is clearly no session or shopping cart going on.

Re: New browser signal could make cookie banners obsolete

#165

Post by majewsky » Wed, Jun 16, 2021, 2:21 PM UTC

ComodoHacker wrote: post #94

bwindels wrote: post #69

Earlier quoted context omitted.

As I understand it, the idea would be to make respecting these automatic signal mandatory in an update to the GDPR. See https://techcrunch.com/2021/06/14/europe-needs-to-back-brows... for some more context. Granted though that enforcement of the existing rules seems to be the biggest problem today.

And if a browser or extension abuses these signals (i.e. always sends them without user's explicit and informed consent), who is liable?

Liable for what? GDPR says you can only collect data if you have informed consent from the user. It does not imply any right on the side of the business to be able to obtain such consent.

Re: New browser signal could make cookie banners obsolete

#166

Post by dvfjsdhgfv » Wed, Jun 16, 2021, 2:23 PM UTC

MagnumOpus wrote: post #73

dvfjsdhgfv wrote: post #35

Earlier quoted context omitted.

> They want you to associate them with privacy, and conclude that privacy laws are pointless and should be repealed. This is a sentiment expressed surprisingly often even here on HN.

A huge proportion of posters either work at adware companies or are big time owners of adware stocks. And as the Sinclair adage goes, it is difficult to get a man to understand something when his salary depends on his not understanding it.

Well, just like many others I own - both directly and indirectly - some tech stocks, but it doesn't influence my view on privacy at all.

Actually, the view that they have to either do unethical things like tracking or perish is one of the greatest fallacies and a sign of lazy thinking.

Re: New browser signal could make cookie banners obsolete

#167

Post by handrous » Wed, Jun 16, 2021, 2:27 PM UTC

hoppla wrote: post #160

leokennis wrote: post #103

Earlier quoted context omitted.

This exactly. This is also why I never feel "ashamed" when sites ask me to please disable my ad blocker because when I block ads they'll go out of business. Or why I'll always decline even "user respecting" ads on sites. We're fighting the ad and tracking industry here, the internet equivalent of a gang member with a shiv and a length of pipe. I'm not going to fight nicely. I'll deny you any chance and any method I g…

You might show me ads, but not track me, privacy badger stops you from doing that. But if your ads are trying to track me, then privacy badger stops that too.

I'm not likely to bother blocking first-party images or other content so-delivered. Odds are I won't be bothered enough by those to block them, or if I am I'm more likely to abandon the site than to start blocking that kind of ad on every site.

The problems are the tracking and the ad networks that kinda treat both the viewer and their site-hosts as consumable resources, but that sites can't realistically avoid if they want/need ad support, because that's where all the money is. Break the ad networks, break tracking (and I mean legally, in both cases—tech means for blocking are doomed, IMO) and ad money won't go away, it'll be redirected to less-awful ways of delivering ads.

Re: New browser signal could make cookie banners obsolete

#168

Post by kissgyorgy » Wed, Jun 16, 2021, 2:27 PM UTC

I understand that standards like these take years to make, but this should have been in the browsers for a loooong time at this point instead of every website implementing them differently.

Re: New browser signal could make cookie banners obsolete

#169

Post by SiempreViernes » Wed, Jun 16, 2021, 2:37 PM UTC

nickpp wrote: post #164

hnarn wrote: post #158

Earlier quoted context omitted.

Instead of ranting and providing nothing but conjecture about how "expensive" GDPR is (whatever that means), or insinuating that lawyers "arguing" about something proves that legislation is ineffective (that's literally their job), refer to first hand sources and ask constructive questions in good faith about what you don't understand. Here's one example: https://gdpr.eu/cookies/ Both first party session cookies and…

Then why does the very gdpr.eu website have a cookie banner at the bottom of the page?! There is clearly no session or shopping cart going on.

Uh, are you asking why a site with that doesn't use cookies in a purely functional manner has a cookie banner?

In any case, it's the usual reason: they have google tracking, and it seems like they embed content from other sides the easy way. You too can learn the answer to the mystery of why there is a consent banner by clicking the "Privacy policy" button, this one actually explains it clearly, like it was supposed to be a model example or something.

Re: New browser signal could make cookie banners obsolete

#170

Post by virgilp » Wed, Jun 16, 2021, 2:41 PM UTC

delfinom wrote: post #107

virgilp wrote: post #55

Earlier quoted context omitted.

I mean, a good first step would be to start fining companies 2% of the revenue. Especially Google. And then maybe automate the GDPR fines, because it's definitely possible to identify that a site puts up a non-compliant banner. No need to add the threat of jail time, _especially_ if it isn't enforced.

2% of revenue while stalling the GDPR process and taking it to court for 10 years makes it only 0.2% ;)

Even so, it would be 0.2% per EU country, right? Because the legislation is transposed into member states legislation. I doubt that anybody would really want to fight (& risk losing) in even 5 member states per year...