Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kill The Cookie Banner

killthecookiebanner.eu

Post reply on HN
Print view View original

171–180 of 621 posts

Re: Kill The Cookie Banner

#171

Post by tangotaylor »

echelon wrote: post #45
Phemist wrote: post #22

> Tired of misleading cookie banners? The EU Commission has finally proposed a solution: set your privacy preferences in the browser once, and never see another banner. So lawmakers do know how to make legally binding preferences based on device settings? What a crazy innovation.. now if only parents were given these options to indicate their child is using a device.. we could do away with all this Online Safety Act…

>>>>>>> now if only parents were given these options to indicate their child is using a device.. we could do away with all this Online Safety Act nonsense... THIS Holy shit. This is such an obvious fix. And it shuts up those surveillance state goons immediately. My God, why have we tried to summon up the ghost of 1984 when such a simple fix as this will do. Parents can lock devices into "child mode" that emits "user…

> Parents can lock devices into "child mode" that emits "user is child" headers. Websites can then block.

CA tried this with AB 1856. I wasn't a fan of this (neither was EFF) because of the privacy and tracking concerns of blasting the fact that the user is a child to all websites.

https://www.eff.org/deeplinks/2026/05/one-step-forward-two-s...

It would better for the block to happen at the device level. That is, the browser knows it's on a child's device and has a whitelist of allowed sites.

There is already an RTA (Restriced to Adults) header where the website self-labels that it's for adults only and the browser can block it while protecting the user's privacy. I'd prefer expanding the use of RTA.

Re: Kill The Cookie Banner

#172

Post by readread »

tgv wrote: post #36
Phemist wrote: post #22

> Tired of misleading cookie banners? The EU Commission has finally proposed a solution: set your privacy preferences in the browser once, and never see another banner. So lawmakers do know how to make legally binding preferences based on device settings? What a crazy innovation.. now if only parents were given these options to indicate their child is using a device.. we could do away with all this Online Safety Act…

The problem there is that parent's won't know how to do it, or won't care. Many can hardly operate the most user-friendly phone, let alone manage accounts. The online safety acts and its EU counterparts are somewhat risky, but nobody wants the mention the only proper alternative: a total ban on "social media." Not just for kids, but for everyone. Or a ban on smart phones, that would work too, at least short term. But…

I've build some moderately sophisticated server systems up on "bare metal" (as the kids say), know my way around a shell better than most programmers, understand networking better than most programmers, et c., and I still find restricting and monitoring kids' devices to be a huge pain in the ass. The only places it's not extremely shitty are the Switch (which still isn't great) and Apple devices.

Options between "we don't have tech in the house" and "wide-open tech, we have it all" are all some amount of painful, usually for no good reason.

(I remember once investigating how to do some pretty basic stuff for this in Linux, hoping to find something nicer than manually setting some executable permissions and firewall rules and then having to go back and change them all the time, and the closest thing to a guide I found was an old article from Red Hat that basically lead with "LOL, good luck you poor sap, Linux sucks at this" before going on to explain the various bad ways available to sort-of, but not entirely, accomplish it with a lot of work, and significant ongoing time-burden)

Re: Kill The Cookie Banner

#173

Post by tappio »

tempestn wrote: post #119
estebarb wrote: post #108

Earlier quoted context omitted.

Session cookies do not require a banner.

Aggregated analytics do, and you can't run a serious website without some kind of analytics. Preference-storing does as well, despite any reasonable user expecting that, if they set a preference, it will be saved.

There are many analytics solutions that dont require cookies. You can do aggregated analytics just fine without. Saving preferences does not require consent either.

Re: Kill The Cookie Banner

#174

Post by readread »

otterley wrote: post #170
readread wrote: post #161

Earlier quoted context omitted.

Oh good, nothing's possible then, we should give up on regulating bad things because hitmen think murder isn't bad when they do it.

How did you arrive at that conclusion? Laws are the result of debate between sides and the prevailing opinion. The fact that laws aren’t identical in every jurisdiction worldwide reflects that there isn’t universal agreement on every question. Also, sarcasm isn’t welcome here. Please read the HN guidelines.

> Also, sarcasm isn’t welcome here. Please read the HN guidelines.

Ah yes, I didn't couch my post in any of the various, rampant HN-friendly versions of shitposting. I'll try to follow your example from here on out. Excellent touch citing the guidelines at me after your role in this thread, A+.

Re-reads this thread, taking notes

Re: Kill The Cookie Banner

#175

Post by frollogaston »

dymk wrote: post #3
paulddraper wrote: post #2

Doesn't this lead to an all-or-nothing approach? I don't want randomnewssite to track me. But a favorite online store...I do want help with recommendations.

Then sign in, thats enough signal for them to track you

Logging in isn't consent for tracking. They can even support login by itself without a tracking banner.

Re: Kill The Cookie Banner

#176

Post by frollogaston »

Phemist wrote: post #28
qurren wrote: post #6

Earlier quoted context omitted.

Just disable cookies on your browser by default, and enable it for the sites that you need to log in to. Ironically, this has the effect of cookie banners reappearing every time because they cannot place a cookie that says that you have rejected them.

Malicious compliance. You do not need a cookie to "store" the fact you have rejected them. They can simply assume you have rejected them from the lack of cookies. They can store a cookie once you (have gone out of your way to) accept them.

Lack of cookies could mean you never visited the site before.

Re: Kill The Cookie Banner

#178

Post by tappio »

reddalo wrote: post #127
hollowturtle wrote: post #116

I always wondered though why a website in the eu, for the love of their users, won't just drop cookie usage and instrusive third party scripts. Just do analytics on the backend and don't set any cookie, except for tokens in authenticated areas

That's what I'm doing with a service I made. But I don't have any ads, and ad-supported websites can't easily do that.

There are privacy respecting ad brokers that dont require user tracking. Its just that people are too lazy or greedy to use those.

Re: Kill The Cookie Banner

#179

Post by Paracompact »

alexandre_m wrote: post #154
echelon wrote: post #45

Earlier quoted context omitted.

>>>>>>> now if only parents were given these options to indicate their child is using a device.. we could do away with all this Online Safety Act nonsense... THIS Holy shit. This is such an obvious fix. And it shuts up those surveillance state goons immediately. My God, why have we tried to summon up the ghost of 1984 when such a simple fix as this will do. Parents can lock devices into "child mode" that emits "user…

That works well for controlled devices like phones, tablets, and TVs, but it’s much harder on desktops unless you expect parents to become IT administrators.

What's wrong with asking the user on account creation and OS install?

Re: Kill The Cookie Banner

#180

Post by frollogaston »

mzajc wrote: post #10
qurren wrote: post #6

Earlier quoted context omitted.

Just disable cookies on your browser by default, and enable it for the sites that you need to log in to. Ironically, this has the effect of cookie banners reappearing every time because they cannot place a cookie that says that you have rejected them.

Unless disabling cookies means treating all cookies as session cookies (meaning you can still be followed within a session), this has the fun side effect of breaking pretty much every CAPTCHA firewall like Anubis, Cloudflare Turnstile, and any other that relies on cookies. Unfortunately this means you have to view a lot of the web through archive.today or web.archive.org - I would know because I have uMatrix configur…

Session cookies for non-whitelisted sites is a nice balance between usability and privacy.

Session cookies for all sites would be fine if passkeys weren't like "We support passkeys. Do you want to use a passkey? Press ok again to use your passkey. Do you consent to using your passkey? Now please authenticate yourself to use the passkey... √ Thank you for using passkeys. Press ok to continue."

Post reply on HN