I don't care about cookies • Hacker News Board

Re: I don't care about cookies

#151

Post by mavhc » Sat, Mar 20, 2021, 1:01 PM UTC

speleding wrote: post #111

MakersF wrote: post #108

Earlier quoted context omitted.

The law forced the companies to be explicit about what they do, and ask for consent. The user experience is made shit by the companies doing shady things. If they didn't do shady shit, they wouldn't have to display any banner. I'd rather be informed, at least I can make a decision that way. Why shoot the messenger? The part that is missing is making rejecting as easy as accepting. So far there are a lot of dark patte…

How is something like having Google Analytics on your site "shady shit"? I would think counting unique visitors is a legitimate business interest for most businesses. And there is no way to do that without a cookie, or without storing IP address (which is considered personally identifiable info). The law could have been much better if it simply asked browser makers to provide a single place to configure your preferen…

What's wrong with parsing your own log files locally?

Re: I don't care about cookies

#152

Post by koonsolo » Sat, Mar 20, 2021, 1:27 PM UTC

rlpb wrote: post #7

The consent popups you see aren't just about cookies though. They want (and sometimes illegally force) you to consent to processing of your personal information for reasons beyond just providing you with a service (or more commonly just reading an article). Cookies might be one technical means to assist with that, but it's not the only means.

I'm bracing myself for the downvotes, but I'm going to post this anyway.

What do you mean with personal data anyway? In GDPR this means:

a name and surname;

a home address;

an email address such as name.surname@company.com; (NOT info@company.com!!!!)

an identification card number;

location data (for example the location data function on a mobile phone);

an Internet Protocol (IP) address;

a cookie ID;

the advertising identifier of your phone;

data held by a hospital or doctor, which could be a symbol that uniquely identifies a person.

For the IP address, I never count on the fact that they don't track it. Who does??? Same for location. Why would you think a website wouldn't be able to get your location, unless you take some real measure to prevent it.

Some consent popup isn't going to convince me that they will or will not track it. I don't give a shit, I expect EVERY website to track this.

For the rest, well, if I provide my info to the website, I'm guessing that they can also identify me with it, no? If I don't want the website to know it, I just don't provide it.

Same thing here: I really don't care what their consent message says.

So long story short: If I want to keep some privacy, I will definitely not rely on the "word of the website" that they will handle it any way they say. If I want privacy, I will take care of that myself.

And for the rest of the legal bullshit, I never read it anyway. EULA's etc.... who does?

Re: I don't care about cookies

#153

Post by Aerroon » Sat, Mar 20, 2021, 1:30 PM UTC

ckastner wrote: post #129

sfvisser wrote: post #99

Earlier quoted context omitted.

> Yes, I can't fathom why the hate is on the law, and not the companies now being exposed by the law.. Because the law obviously didn't help stopping companies from doing shady shit and made the user experience of the web worse?

> Because the law obviously didn't help stopping companies from doing shady shit It helped immensely . I work in the financial sector in an EU country, and most institutions in my country are terrified about the GDPR. The fact that some people will happily operate on the border or even closely beyond the border of law, applies to any other regulation as well.

How is it helpful if most institutions are terrified? Doesn't it indicate that the regulation is unreasonable instead? If the EU commission can't run a website without a popup, then why would you expect anyone else to be able to?

Re: I don't care about cookies

#154

Post by Aerroon » Sat, Mar 20, 2021, 1:33 PM UTC

CogitoCogito wrote: post #145

Aerroon wrote: post #142

Earlier quoted context omitted.

> Yes, I can't fathom why the hate is on the law, and not the companies now being exposed by the law. Because it's clearly not easy to run a service without these types of practices. If you want to get ad revenue then you have to have them. Even the EU commission's own website has the pop up: https://europa.eu/ And they don't even have to worry about paying the bills for the website.

The EU's site is actually a pretty nice example. The banner is small, non-obtrusive and simple. It has the positive and negative options on equal footing. I don't think many would complain about that.

It's still a popup. And yeah, of course a website that doesn't ever have to care about paying the bills has leeway. Make the commission's website pay for their own hosting, maintenance, and development and see whether their website stays the way it is.

Re: I don't care about cookies

#155

Post by Sebb767 » Sat, Mar 20, 2021, 1:53 PM UTC

hnedeotes wrote: post #70

Sebb767 wrote: post #50

Earlier quoted context omitted.

No, this is about boundaries, abstractions and context really. When a browser sets a bound, the website usually has no way to override that, as the browser is above it permission-wise. Similarly, if the OS sets a boundary, the browser looses out, since it's below the OS. Fittingly, when you deny crossing such a boundary, you'd expect it to be denied. Imagine, for example, if the dialog to allow push notifications for…

> Imagine, for example, if the dialog to allow push notifications for a website would be an UAC window. It would not make sense since a) the OS would ask for something which is clearly contained within the context of the browser and b) the OS has no reasonable [0] way to know whether a notification sent by the browser is on behalf of the denied/allowed website. Similarly, it makes sense to have the prompt for trackin…

> I see these answers and I always get the feeling that they treat existing software (browsers, websites, os) like something that was handed down by God in the book of law.

There's two sides for this. For one, this is the infrastructure that already exists and that is out there in the wild. If you start selling 500V electric appliances, people can of course buy transformers or the state could upgrade its grid, but in reality, changing the existing infrastructure to suddenly support something different is a huge effort. It's far easier and more economical to treat the given infrastructure as fixed and working within its bounds.

On the other hand, it usually adds a lot of needless complexity to break layers. Sometimes it is worth it (ZFS might be a good example), but usually it isn't. Imagine, for example, if Firefox needed to be patched to support SSDs or SD cards because it did some magic and accessed the HDD firmware directly - this would arguably be a bad idea.

> The browser already asks the user for permission through the OS - it does for location, webcam, filesystem, etc - there's no context needed because you're actively engaged with it, the browser or the os system don't need any more context than the user clicked Yes or No for this request.

Sure it does. The OSBrowser boundary is basically about what the browser executable itself can do to the OS; the OS has no context on the finer granularity of websites. Going back to the electrical grid: My power company is worried about bringing electricity to my flat connection; turning specific appliances on or off is my part. It would be very strange if the power company would suddenly be in charge on whether my kettle specifically should have power.

> The other part of the implementation is fining the companies. I'm sure after a few millions every month they'll stop making SDK's that don't enforce collecting authorisation from the user before tracking.

I fully agree on that and we need more of that, but that is irrespective of how the user is asked whether he wants to accept cookies/tracking.

Re: I don't care about cookies

#156

Post by speleding » Sat, Mar 20, 2021, 2:04 PM UTC

anang wrote: post #143

speleding wrote: post #116

Earlier quoted context omitted.

It really isn't that easy. Something like an IP address is considered personally identifiable information, and most web servers and frameworks log that by default. If you really want to comply it takes quite a bit of effort you are not accidentally logging IP addresses somewhere. You can argue you need that info for the operation of your site, but it's been established that you would still need to ask permission in t…

I don’t think the only factor considered is whether or not something is PII, rather even the intent is considered. If you were storing IP addresses to track and market to users, you need consent. If you’re using them for logging and security purposes, I think that falls under legitimate interest.

Just Google "IP addresses GDPR" and you will see several different conclusions. I actually looked at the site of the enforcement authority in my country and they say you can only store the first 3 bytes of an IP address. But enforcement authorities in other countries may claim differently.

My point is: it's really not that easy. It should be easy to get clear guidance on something straightforward like this, and not have to resort to Stack overflow answers.

Re: I don't care about cookies

#157

Post by JohnJamesRambo » Sat, Mar 20, 2021, 2:07 PM UTC

akvadrako wrote: post #95

JohnJamesRambo wrote: post #45

I think this would actually massively increase security because you won’t be mindlessly clicking Yes to whatever a website says.

Why would you click "yes"? On legally implented sites it's just as easy to always click "no".

I guess I thought they wouldn’t let me in if I click no!

I still think it is easy for a malicious site to make both the yes and no button install X malware when you click it. I don’t know if that fear is valid but as a Windows 95 and 98 ptsd person we were trained don’t click and agree to anything.

Re: I don't care about cookies

#158

Post by speleding » Sat, Mar 20, 2021, 2:08 PM UTC

mavhc wrote: post #151

speleding wrote: post #111

Earlier quoted context omitted.

How is something like having Google Analytics on your site "shady shit"? I would think counting unique visitors is a legitimate business interest for most businesses. And there is no way to do that without a cookie, or without storing IP address (which is considered personally identifiable info). The law could have been much better if it simply asked browser makers to provide a single place to configure your preferen…

What's wrong with parsing your own log files locally?

Whether you parse log files locally, or in the cloud, or use a cookie really doesn't matter to the GDPR. They only mention the word "cookie" once in the entire law, it's independent of technology, as it should be. If you store personal information (like IP address) in your log files, you still need consent.

Re: I don't care about cookies

#159

Post by Nextgrid » Sat, Mar 20, 2021, 2:14 PM UTC

3np wrote: post #28

Nextgrid wrote: post #24

Earlier quoted context omitted.

This is wrongly downvoted despite being absolutely right. There's a big misunderstanding behind these "cookie" consent prompts. They are actually about overall data processing consent regardless of technical means - this includes cookies but also things like browser fingerprinting, IP addresses, etc which will persist despite clearing cookies. Using an extension that automatically grants consent and merely deletes co…

At least if you’re in EU, active consent is required to comply with the GDPR. This means that if you do what this extension does (filter out the UI elements and ignore dialogs), it’s illegal for a website to save PII about you and your visit. Many websites and data processors violate this, but since that’s the case for those sites the only winning move is not to play.

It could be argued that if the consent prompt can’t be dismissed without providing an answer (whether accept or decline) and you use technical means to circumvent that then it’s fair for the system to track you anyway as it’s undefined behavior?

Re: I don't care about cookies

#160

Post by artursapek » Sat, Mar 20, 2021, 2:29 PM UTC

Izkata wrote: post #69

Sebb767 wrote: post #46

Earlier quoted context omitted.

> why isn’t it treated like every other native browser permission dialog? Because it's not a browser permission. The browser could offer to send a "no" for you, but the site could just go on and track you anyway. It would be like having a permission dialog where clicking "no" just would ask the program kindly not to run with admin permissions. Now, you might argue that the browser could start blocking cookies, but th…

> The browser could offer to send a "no" for you, but the site could just go on and track you anyway. Not just "could", this was already tried: https://en.wikipedia.org/wiki/Do_Not_Track It's still in Firefox at least, and Mixpanel does respect it (a tracking service akin to Google Analytics), but not a whole lot else.

Exactly