Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I don't care about cookies

i-dont-care-about-cookies.eu

Post reply on HN
Print view View original

131–140 of 193 posts

Re: I don't care about cookies

#131

Post by skinkestek »

speleding wrote: post #116
matsemann wrote: post #109

Earlier quoted context omitted.

GDPR is sooo easy to follow as a startup. Just gather the data you need and not everything else,and ask for consent. If anything, it was the big players getting work to do. Thousands of people on mailing lists with no control of how they got there. Asked and kept insane amounts of not necessary data. Data floating in hundreds of database tables spread over various services and third party vendors and data centers wit…

It really isn't that easy. Something like an IP address is considered personally identifiable information, and most web servers and frameworks log that by default. If you really want to comply it takes quite a bit of effort you are not accidentally logging IP addresses somewhere. You can argue you need that info for the operation of your site, but it's been established that you would still need to ask permission in t…

Speculation here, but informed speculation:

I highly doubt you as a non shady actor will be punished because of your server logs as such.

Start selling or otherwise sharing them with ad companies, directly or indirectly and you deserve and should expect a GDPR fine as soon as they can if you are in a jurisdiction where GDPR applies.

Same if you involuntary leak data because of gross negligence: passwords in cleartext, unnecessary data collected and stored and later leaked etc etc

In many cases I understand authorities will even contact companies first and try to guide them toward a compliant solution first instead of fining tjem right away.

That said I wish there were some clarifications given wrt to server logs and IP addresses; running without is in many cases gross negligence in itself.

Basic logging is first year defense against black arts curriculum.

Re: I don't care about cookies

#132

Post by TeMPOraL »

polocode wrote: post #55

Honestly, I think it is our job as the creators/hackers to come up with a better solution. The problem is very real, and needs to be fixed. But no good solution has ever been created by lawyers. Ever. So here we are, left with a forest of cookie warnings that perfectly break the internet. So here is a proposal: What if a user could declare her/his consent settings _before_ opening the website? There would no longer b…

> I think it is our job as the creators/hackers to come up with a better solution.

Here's a radical idea for a solution: pressure EU member state data protection agencies to start seriously enforcing GDPR violations. Internet is so good at amplifying messages, so why not amplify that?

GDPR is already a good solution to this problem. The only reason it works so poorly is because it's not being enforced - so most websites feel safe choosing to break the law. If there was an uptick in fines being issued against all players, big and small, the situation would change very quickly.

Re: I don't care about cookies

#133

Post by rrobukef »

luckylion wrote: post #84
dheera wrote: post #78

Earlier quoted context omitted.

They don't work for me. > disable some cookies No, f*k "some cookies". I block ALL cookies except for a few sites I need to log into. That means, ironically, the godawful popups can't set a cookie to remember that I don't want cookies, and they keep popping up every time I go back to that site. The popups are a horrible experience, as are "please sign up for the newsletter" popups. I don't read any newsletters. I use…

> No, f*k "some cookies". I block ALL cookies except for a few sites I need to log into. That means, ironically, the godawful popups can't set a cookie to remember that I don't want cookies, and they keep popping up every time I go back to that site. I do that in reverse: everybody can set all the cookies they like, but only a few sites are allowed to keep their cookies after I close the tab. I do use I Don't Care Ab…

And did you consent to setting cookies or did you enter a contract allowing tracking you with other means as well? If you consent on one site for one ad-company and reject on the other, can/will they use the original contract and track you on the rejected website? Or do you need to opt-out with the hidden form which can take 'up to 100 years? "

Legitimate interests" are supposed to be interests integral to the running of your business. Ads are the core of an ad-business. Is this a loop-hole? I don't know.

Yes, the web is more usable. But does anything anyone does actually limit the information? I don't know, maybe I'm too cynical.

Re: I don't care about cookies

#134

Post by sergeykish »

speleding wrote: post #111
MakersF wrote: post #108

Earlier quoted context omitted.

The law forced the companies to be explicit about what they do, and ask for consent. The user experience is made shit by the companies doing shady things. If they didn't do shady shit, they wouldn't have to display any banner. I'd rather be informed, at least I can make a decision that way. Why shoot the messenger? The part that is missing is making rejecting as easy as accepting. So far there are a lot of dark patte…

How is something like having Google Analytics on your site "shady shit"? I would think counting unique visitors is a legitimate business interest for most businesses. And there is no way to do that without a cookie, or without storing IP address (which is considered personally identifiable info). The law could have been much better if it simply asked browser makers to provide a single place to configure your preferen…

There was a simple place — Do Not Track (DNT), ignored by industry.

Truly open culture does not accept tracking, for example there is no way to count Linux users. And people would not be kin to those who track physical news papers.

Meanwhile I use uMatrix and uBlock Origin.

Re: I don't care about cookies

#135

Post by sergeykish »

0x0 wrote: post #101
hutghkiuhg wrote: post #80

Earlier quoted context omitted.

Speculating here, we could call the checbox "Do Not Track", and make it a browser setting. HN would probably love this. Oh, wait...

Or you know, people could just disable cookies IN THE BROWSER SETTINGS if they don't like them. Which is the only place technical measures against cookies can be enforced anyways. And stop bothering the rest of us with these pointless popups.

Unfortunately disabling cookies is not enough — there is localStorage (can be disabled) and fingerprinting (nothing we can do).

Why don't you advertise "Don't Mind Tracking" header?

Re: I don't care about cookies

#136

Post by HenryBemis »

TeMPOraL wrote: post #124
speleding wrote: post #111

Earlier quoted context omitted.

How is something like having Google Analytics on your site "shady shit"? I would think counting unique visitors is a legitimate business interest for most businesses. And there is no way to do that without a cookie, or without storing IP address (which is considered personally identifiable info). The law could have been much better if it simply asked browser makers to provide a single place to configure your preferen…

> How is something like having Google Analytics on your site "shady shit"? I would think counting unique visitors is a legitimate business interest for most businesses. Just because it's free and somewhat nice looking, doesn't mean it isn't shady shit. Maybe all you care about is counting unique visitors, but by doing that with Google Analytics, you're exposing your visitors to a complex surveillance product that col…

What people don't see about GA, is that the data doesn't stop at you: "here is your data, X unique visitors, have a nice day".

It has a wider lifecycle: "this is YOUR data, and we collect, maintain, process, sell these data to a myriad other sources for a myriad other purposes". GA just feeds these monsters.

Most GA users just don't care about their clients/readers privacy. Or they care 'a little' but they care 'a lot more' in monetizing.

We externalize the costs, or find shady revenue streams. As long as people think "it's free therefore it is good and I like it" we are not progressing.

Re: I don't care about cookies

#137

Post by sdfhbdf »

luckylion wrote: post #103
Odenwaelder wrote: post #96

This browser plugin automatically accepted a Notion.so pop up to upgrade to enterprise plan. Beware of this plugin!

Uhh, that's bad. Come to think of it, a malicious company could probably set up their systems so they get auto-confirmed by the plugin. I'm not sure they'd be valid in that case. Similar attacks: load the fine print via JS and stick it into an /ads/advertisement.js so adblockers will block the loading of it. Can the company claim "we showed it to the user, if their software hides it, that's not our problem"?

No, the user did not consent. They have to be aware of such systems not game it. The intent and the consent have to be clear to both parties. Agreement is about respect not about malice. If an consent is maliciously hidden away, no matter how technically then it's not valid. Law is not binary in these cases, it's all about the circumstance.

Re: I don't care about cookies

#138

Post by sdfhbdf »

fctorial wrote: post #23
ronjouch wrote: post #18

Or, if you already use uBlock Origin and would rather use its performant, customizable, extensible filtering capabilities instead of adding (and trusting!) yet another addon, just check the "EasyList Cookie" list in your Filter Lists :) .

Browsers should allow users to install extensions from github.

It's a balancing act of security and opennes. Extensions so far had a really bad track record of having too much permissions. They could be detrimental to user's life if an extension can easily grab login cookies/credentials or whatever to your banking if you ever enter it in your own browser.

I think more restrictions should be put on extensions but it's always hard to balance between accesible developers tools to people who know what they're doing and somebdoy writing down the instructions how to circumvent it to lure the user to install a malicious extension in developer mode.

Re: I don't care about cookies

#139

Post by sergeykish »

systemvoltage wrote: post #38
nic-waller wrote: post #35

Earlier quoted context omitted.

Some sites use localstorage instead of cookies for session tracking.

Thank you. According to a quick search [1], """ Cookies and local storage serve different purposes. Cookies are primarily for reading server-side, local storage can only be read by the client-side. So the question is, in your app, who needs this data — the client or the server? If it's your client (your JavaScript), then by all means switch. You're wasting bandwidth by sending all the data in each HTTP header. If it'…

Both cookie and localStorage are just a way to identify session. Basically:

    GET /user/#{localStorage.id}
vs

    GET /user
    Cookie: id=#{Cookie.id}
In both cases GDPR restricts user tracking and allows storing data that's required for domain to function properly.

Re: I don't care about cookies

#140

Post by germanier »

throwaway53453 wrote: post #31
sixothree wrote: post #16

Earlier quoted context omitted.

Lol. Do they really.

Yes, they do. Google doesn't use fingerprinting for ads. Go look at the privacy policy.

I don't see a anything in that policy that would prevent them (although I grant that many clauses try to give that impression without explicitly stating they don't). What they do say though is

> The information we collect includes unique identifiers, browser type and settings, device type and settings, operating system, mobile network information including carrier name and phone number, and application version number. We also collect information about the interaction of your apps, browsers, and devices with our services, including IP address, crash reports, system activity, and the date, time, and referrer URL of your request. ... We may also collect information about you from trusted partners, including marketing partners who provide us with information about potential customers of our business services, and security partners who provide us with information to protect against abuse. We also receive information from advertisers to provide advertising and research services on their behalf. We use various technologies to collect and store information, including cookies, pixel tags, local storage, such as browser web storage or application data caches, databases, and server logs. ... We use the information we collect to customize our services for you, including providing recommendations, personalized content, and customized search results

Post reply on HN