Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

151–160 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#151

Post by isbvhodnvemrwvn »

lkramer wrote: post #84
questiondev wrote: post #68

Earlier quoted context omitted.

that is true but it increases the barrier to entry for those who use google fonts for system resource issues, a lot of people offload because they don’t have the space or money to self host everything one could argue that it is less eco friendly as well given how much space is going to be used repeating the same file on a multitude of servers

An interesting question. Someone should do a environment cost impact on self hosting fonts (and other resources) vs client having to make lot's of requests to various hosts for those resources.

None of the standard browsers share third-party cache across different domains. Made it too easy to leak data.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#152

Post by mro_name »

ZeroGravitas wrote: post #67
iqanq wrote: post #53

Earlier quoted context omitted.

Isn't regulation precisely the act of acting in behalf of the citizens because they are seen as "too stupid" to know what they are doing?

When talking about UX, there's this bad habit of using people's mothers or grandmothers as examples, because they are 'too stupid' to understand the UI that was built. Aside from the obvious problems, this also implicitly removes blame from the designer/implementor of the interface. I always prefer to reframe it as someone with a very important, intelligence requiring job, say vaccine reasearcher, who doesn't have ti…

first I don't agree with coining any group as stupid per se.

Second, if they are a target group, a website has no excuse but to deal with them.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#153

Post by tomp »

HL33tibCe7 wrote: post #118

Reductio ad absurdum: if serving fonts from Google is “unnecessary” and leaks information, so would be using any CDN service to deliver any content.

A CDN that sells your data (or doesn’t otherwise protect it) is more accurately termed “spying network”

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#154

Post by HL33tibCe7 »

ianpurton wrote: post #19

Hopefully we won't see popups like "This site will forward your IP address to Google is that OK?", because I'm already beyond bored with "This site uses cookies do you accept?".

Non-technical users that I’ve seen interacting with these prompts literally just look for the button with the most prominent colour and click it.

Frankly, I’ve even found myself doing this without thinking on occasion. The prompts are beyond useless.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#155

Post by jeroenhd »

ianpurton wrote: post #19

Hopefully we won't see popups like "This site will forward your IP address to Google is that OK?", because I'm already beyond bored with "This site uses cookies do you accept?".

There's no difference between that popup and IP sharing consent. It's not about cookies, it's about tracking and tracking risk.

Smart websites would just host the font files on their own domains but I guess the dumber ones will just add Google Fonts and similar to their consent list, yes.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#156

Post by foepys »

leobg wrote: post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

Who does make my browser request the resource? Clearly the website owner who can also decide to make the browser load a resource fully under their own control. The user could block it, certainly. But I don't want my browser to ask me for every single URL if it's okay to request a resource.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#157

Post by Andrew_nenakhov »

isbvhodnvemrwvn wrote: post #122
leobg wrote: post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

Using this logic I can send full fingerprinting data as long as I do it from the front-end? I mean courts are not that dumb, it's still the website owner which decides what is done.

Browser can be configured not to send this data.

If I ask you to jump from the bridge, and you do, how is it my fault that you chose to comply?

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#159

Post by youngtaff »

mawadev wrote: post #104
rokizero wrote: post #38

As a Deutscher this sounds completely nuts. Correct me if I'm wrong but any not 100% technically necessary third party request is considered illegally leaking personal data?! Or do I 'just' have to inform the users that their fonts, images and other data that could be stored in source but is not? In the case of fonts I'm pretty sure they get cached in the browser, so bundling them with the source just doesn't make se…

Exactly. Why would you serve your own copy of the fonts if a previous request to that cdn may have cached them in your browser already? Opt-In goes against the architecture of websites. What's next? A popup for each third party request? It is not feasible and just another stumbling block - like Impressum for private persons and third party cookie consent to host websites in Germany. It makes more sense to fix the iss…

> a previous request to that cdn may have cached them in your browser already? Opt-In goes against the architecture of websites

Browsers partition their caches by origin and third-party origin (it's a bit more complex than that in reality) so common third-party resource e.g. fonts, used on one site won't be reused on another

Instead a fresh version of the font will will be fetched

Safari's done this since 2013 (?), and Chromium & Firefox adopting the same behaviour in 2020 (?)

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#160

Post by DavideNL »

HL33tibCe7 wrote: post #118

Reductio ad absurdum: if serving fonts from Google is “unnecessary” and leaks information, so would be using any CDN service to deliver any content.

Well, a font is not equal to "any content".

So perhaps the issue is whether it is necessary/sensible, just for providing a simple font, to contact Google/any cdn.

Spoiler, of course we all know it is not...

Post reply on HN