Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We removed advertising cookies, here's what happened

blog.sentry.io

Post reply on HN
Print view View original

151–160 of 191 posts

Re: We removed advertising cookies, here's what happened

#151

Post by lloeki »

shkkmo wrote: post #127
mark_story wrote: post #121

Earlier quoted context omitted.

That's fair, not having a cookie could work for session, how would you handle CSRF protection on a login form without cookies?

Why would you ever use a cookies to store a CSRF token? A CSRF token is a per request value and that's not what cookies are designed for. Generally the CSRF token is a hidden value on the login form.

Session cookies are often encrypted by frameworks using a server side secret.

This allows storing data such as the CRSF token value to check against the one in the hidden form element or X-CSRF-Token without inserting in a DB every time someone loads up a form.

That's how e.g Rails does it by default:

https://guides.rubyonrails.org/security.html#cross-site-requ...

https://api.rubyonrails.org/classes/ActionController/Request...

Note that to prevent session fixation, the session ought to be reset on a successful login (and logout), so it would require additional code to perform tracking across a successful login.

https://guides.rubyonrails.org/security.html#session-fixatio...

Session cookies are also used for Rails flash messages, commonly used to display errors in forms (including login forms), which often do HTTP redirects to GET routes in their non-GET controller actions.

https://api.rubyonrails.org/classes/ActionDispatch/Flash.htm...

https://api.rubyonrails.org/classes/ActionDispatch/Flash/Req...

https://stackoverflow.com/questions/24877244/rails-is-the-fl...

The underlying subtext is that these session cookies can be a necessity of securing the provided service, and thus can fall under valid "strictly necessary" usage, as long as they are not abused for tracking (by default nothing in the session cookie is stored nor logged anywhere)

Re: We removed advertising cookies, here's what happened

#152

Post by ogotai »

shkkmo wrote: post #132
ogotai wrote: post #84

Earlier quoted context omitted.

I judge the headline as clickbait as well, and skipped reading it because of it. Sounds like I made the right decision based on other comments. It (probably) could've easily said, in say one to ten words, what actually happened, in the headline, so that I could decide whether I wanted to read into the details or whether it didn't interest me at all. With the headline being "something happened" and you'll have to read…

If you skipped reading the article then don't comment on it.

I wasn't commenting on the article, just the fact that its headline is clickbait.

Re: We removed advertising cookies, here's what happened

#153

Post by jefftk »

the_mitsuhiko wrote: post #150
jefftk wrote: post #145

Earlier quoted context omitted.

> A lot of these cookies are used to prevent CSRF Maybe I'm being dense, but I don't see CSRF risks with a login form? > once you go to a login page I'm pretty sure you will log in That seems very reasonable to me, but I don't think it's what the e-Privacy directive says? (I'm in general very sympathetic, and wish the directive set a lower bar than "strictly necessary" for functional client-side storage.)

The ePrivacy directive is not that descriptive. The use of this cookie is fine as per legal review. All our forms have the same CSRF protection, that goes for login and other things too.

I really don't see how a duration of one year and Same-Site=Lax on the sentry-sc cookie passed legal review, but perhaps your legal team is comfortable with a more aggressive approach than I'm used to.

Re: We removed advertising cookies, here's what happened

#154

Post by guiambros »

zelphirkalt wrote: post #114
masto wrote: post #43

Earlier quoted context omitted.

And other than being stressed and annoyed and having to fuss with a bunch of extra stuff to use the Internet, this makes your life better how?

Websites load faster. I filter out BS websites with low information density. I avoid ads and being tracked by random companies that I don't trust. I feel more comfortable visiting websites knowing, that my personal data does not automatically flow to random companies. I don't have to sit through YouTube ads either. I get what I came for, then I leave. To me this is a great benefit. But lets not forget, that we are al…

> "I filter out..."

> "I avoid ads... companies that I don't trust"

> "I feel more comfortable..."

> "...my personal data...""

> "I don't have to sit through..."

> "I get what I came for, then I leave"

> "I hope some day more of us can look beyond immediate personal benefit."

Look, I'm ok if you want to be individualistic and say "screw the creators, content producers, journalists, and everyone else I'm freeloading their work for MY personal benefit". It's immoral in my book, but it's certainly not illegal.

But at least be honest with yourself, and stop pretending you're doing this for the greater good of human society.

Re: We removed advertising cookies, here's what happened

#155

Post by wellpast »

b2bsaas00 wrote: post #29

I have a campaign with a UTM link, once the user lands on our page we save this UTM as cookie and then we persist on our db at sign up. Is this complaint with GDPR and will it still possible in the future?

Presumably that's a first-party cookie you're persisting not a cross-site third-party cookie, so wholly different standards apply for your case.

Re: We removed advertising cookies, here's what happened

#156

Post by the_mitsuhiko »

jefftk wrote: post #153
the_mitsuhiko wrote: post #150

Earlier quoted context omitted.

The ePrivacy directive is not that descriptive. The use of this cookie is fine as per legal review. All our forms have the same CSRF protection, that goes for login and other things too.

I really don't see how a duration of one year and Same-Site=Lax on the sentry-sc cookie passed legal review, but perhaps your legal team is comfortable with a more aggressive approach than I'm used to.

The purpose and functionality of the cookie is what matters, not the duration.

Re: We removed advertising cookies, here's what happened

#157

Post by m3047 »

troupe wrote: post #85

> 42.7% of internet users worldwide use ad blockers. Given how many people I know that still type google into the google search bar, I find this number to be extraordinarily high.

It's trackers. I don't block ads, I block trackers. I block large swathes of rentable name / address space (being vague, don't know you, protecting my TTPs) that trackers like to rent by default; anything that lives in there that I decide I want I whitelist. So my actions affect those who utilize the network(s) I administer.

Re: We removed advertising cookies, here's what happened

#158

Post by jefftk »

the_mitsuhiko wrote: post #156
jefftk wrote: post #153

Earlier quoted context omitted.

I really don't see how a duration of one year and Same-Site=Lax on the sentry-sc cookie passed legal review, but perhaps your legal team is comfortable with a more aggressive approach than I'm used to.

The purpose and functionality of the cookie is what matters, not the duration.

The duration is part of the functionality. In interpreting the e-Privacy directive a general principle is that durations should not be longer than required to implement the required functionality. If you read through https://ec.europa.eu/justice/article-29/documentation/opinio... you'll see lots of discussion of appropriate durations.

Re: We removed advertising cookies, here's what happened

#159

Post by dspillett »

MuffinFlavored wrote: post #103
ThePowerOfFuet wrote: post #102

Earlier quoted context omitted.

> If you're running a complex modern site and decide to do away with cookie banners, you generally need to pair this with browser automation that crawls your site and verifies that you (and your dependencies) are in fact not setting any cookies. Correction: any cookies which are not technically required for the basic operation of the site (such as a shopping cart ID).

I'm out of the loop on the latest and greatest web technologies: if I'm a shopping cart website, how do I keep track of you as a user/session enough to identify you and pair you to the contents of your cart on my backend without a cookie? Cramming a sessionId into localStorage/sessionStorage seems kind of like the same thing? Am I missing somehting?

The post you were replying to (unless it was edited after your reply) specifically mentioned a shopping cart cookie as one that could be classed as strictly necessary. There are other options but they have issues (tracking via query string or form values doesn't work well with multiple tabs open for instance). The cart ID can be the session ID too for as long as it is needed.

Of course they don't have to be stored, in fact they shouldn't be stored. They are session level naturally so belong in session level cookies not more permanent storage.

Also, while session tokens in cookies are usually fine to be defined as strictly essential for the main site, they are generally not for 3rd party cookies.

> localStorage/sessionStorage seems kind of like the same thing? Am I missing somehting?

No, those are more often used in equivalent ways to cookies though they don't do exactly the same job, extra logic is needed if your server-side needs to access the stored information. Cookie values are sent to the web server(s) with every request (except where certain flags are set), data in session/local storage needs to be explicitly read out and sent on in GET or POST parameters when needed.

Re: We removed advertising cookies, here's what happened

#160

Post by troyvit »

junon wrote: post #2

I kept waiting for their findings but halfway through it's just a bunch of self-gratifying talk and deflecting talking about why they think it's important - I read for two solid minutes without them getting to any hard numbers or findings.

Two minutes? That's less than half a cigarette.

It took awhile but I finished the article. I don't see much self-gratification in phrases like:

> we saw around a 30% increase in our cost per click (CPCs) in Google search.

Or this:

> This took a TON of back and forth, basically building logic that an out-of-the-box attribution solution already has in SQL, but we finally got to a place where we could salvage around 50% of attribution data.

The self congratulating I saw was

* they decided to try this before it was foisted on them by externalities.

* they worked their asses off to make it work.

* they have a competent BI team.

I don't understand why they also eliminated most first party cookies though. I respect that level of respect for user privacy but it goes beyond my personal expectation for privacy.

Post reply on HN