Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No Cookie for You

github.blog

Post reply on HN
Print view View original

191–200 of 634 posts

Re: No Cookie for You

#191

Post by 013a »

random5634 wrote: post #103
AndrewStephens wrote: post #31

I hate the standard wording on Cookie banners. Most of them should read: "The site uses cookies. Actually it doesn't - you are not logged on and we don't need to maintain state. But our advertising partners, their partners, and their partner's partners all love to set tracking cookies. Click here to consent to three dozen cookies from around the globe."

Good lord, everyone needs banners and popups? Why not just let browsers controls who sets what cookies? I'm tired the endless cookie popups, can we come up with an "allow cookies if the browser accepts them" standard as long as that guarantees no cookie popups? Then browser vendors can ship a delete all non same origin cookies on tab close or something.

I feel that browsers should implement a permissions grant pop-up for when a site attempts to set a cookie with SameSite=none, and the cookie api can be extended to enable explanations to be given by the developer.

Re: No Cookie for You

#192

Post by zeta0134 »

OzzyB wrote: post #181
thomascgalvin wrote: post #128

Earlier quoted context omitted.

This is (mostly) based on EU law; entities that set cookies and track user data are required to get opt-in permission from users before doing so, and if the user declines, the entity cannot offer a degraded service. At least that's the idea. In practice, almost everyone just throws up a banner that says "fuck you, we're selling your data as hard and as fast as we can," with no opt-out available, but they pretend that…

> the entity cannot offer a degraded service Does this mean that sites that offer free but ad-supported content still have to offer that content? So I can watch those free Youtube movies and listen to those Spotify tracks ad-free because EU Law says fuck you . How is this fair? Edit: Okay, okay, non-targeted (and no 3rd party) ads are okay, got it xD

Those ads will just have to be served without the tracking. You know, like how it has worked for decades on television and radio.

Re: No Cookie for You

#193

Post by MarekKnapek »

Wowfunhappy wrote: post #147
geek_at wrote: post #24

Earlier quoted context omitted.

True. Also even if you do track your visitors you can use privacy friendly (and ideally selfhostable) Analytics like Plausible https://plausible.io/ so you won't need the banners either. Just don't include facebook like buttons or any of these widgets

Does anyone happen to know of a service like this that is free (not self hosted) for non-commercial, low-traffic sites? Or which costs less than ~$10 per year. I have a basic Github Pages site, and I currently don't know whether anyone is looking at it, beyond the very few who take the time to email me. I don't need (or want) to know anything about my visitors, but it would be nice to know that I'm not simply tossing…

Few years back I created some HelloWorld application on Google's AppEngine (requires Java, Python or Go) and was positively surprised about its statistics on theirs dashboard.

Re: No Cookie for You

#194

Post by ddevault »

ronjouch wrote: post #117
ddevault wrote: post #21

Nat's right: this IS a no brainer. SourceHut hasn't had any non-essential cookies since day one. If you're reading this, Nat - how about removing third-party resources entirely from your pages next?

Why, and which third-party resources are you referring to? Looking at uBlock Origin in a GitHub PR page now, I see the following domains: - github.com - githubusercontent.com, DNS pointing at github.map.fastly.net - githubapp.com - githubassets.com All these are GitHub-owned, so from a privacy / customer relationship standpoint it looks fine (except github.map.fastly.net , which is probably for CDN purposes), isn't i…

github.blog loads third-party content from Google and Wordpress. GitHub proper also has first-party analytics scripts, which disregards Do-Not-Track and shouldn't be there at all.

Re: No Cookie for You

#195

Post by munchbunny »

tgb wrote: post #130
munchbunny wrote: post #90

Earlier quoted context omitted.

That's correct. Using cookies for the user session is fine and does not require consent as long as you really are just using them for the user session. The moment you use them for analytics, you have to request consent for analytics, even if they are primarily for maintaining the user session.

But wouldn't that consent be in the EULA? So long as they only track logged-in people, they'd have agreed to that.

No, it wouldn't be in the EULA. There are two parts of GDPR that would specifically go against putting consent to tracking in the EULA:

1. GDPR requires the consent check to be somewhere obvious and in plain language. That was specifically to deal with EULA's given to you in tiny legally compliant text boxes.

2. GDPR requires that you cannot make consent for non-essential usages of data mandatory as a condition for providing your services. Tracking only logged-in people for analytics falls into the category of non-essential purposes. That requires explicit consent, even if consent is not required to use the exact same data for authentication checks.

Re: No Cookie for You

#196

Post by malinens »

sildur wrote: post #48
fluidcruft wrote: post #34

Earlier quoted context omitted.

Authentication and authorization cookies seem pretty essential for any website that has accounts. If you block those cookies the website stops working -- they're essential. If you block ad networks and analytics the site functions just fine -- they're not essential. Beyond that there's probably some sort of "need to know" test to prevent convoluted fake dependencies.

They are not really, really essential. No cookie is essential. A long, long time ago I worked with a web system that kept session info in a URL parameter, and carried it over all the links. I think it was a C# website, but I'm not sure.

In WAP times there was no such feature as cookies available. I started programming by writing WML pages instead of HTML. Good memories from those times!

Re: No Cookie for You

#197

Post by Psype »

mattmanser wrote: post #137
thomascgalvin wrote: post #128

Earlier quoted context omitted.

This is (mostly) based on EU law; entities that set cookies and track user data are required to get opt-in permission from users before doing so, and if the user declines, the entity cannot offer a degraded service. At least that's the idea. In practice, almost everyone just throws up a banner that says "fuck you, we're selling your data as hard and as fast as we can," with no opt-out available, but they pretend that…

The new one I'm seening is you opt out easily enough, but there's a subtly hidden tab called 'legitimate interest' and every ad network claims to have a legitimate interest in harvesting your data, even though you've got no business relationship with them. What should be happening is every company that's done that should be getting massive fines, but instead all the enforcement agencies are doing nothing.

Legitimate interest exists, and we use it at work. But because I work in the field of security, and for the sake of our infrastucture, we log specific informations and might drop a mandatory cookie at a time.

Everything outside that field cannot, I guess, be considered as legitimate interest.

Re: No Cookie for You

#198

Post by merb »

Macha wrote: post #179
merb wrote: post #172

Earlier quoted context omitted.

well it's legal to create a hash and save it inside a database to count unique users. if the hash is not connected to any info that would identify a user (btw. user agent is some kind of identifing stuff) it is fine. what I wanted to say is that cookies are not illegal by gdpr means and gdpr does not make a lot of stuff illegal, it's just that SAVING personal information or information that could identify somebody ne…

How do you create the hash? If it's based on something that you can derive from the user (let's say sha1(IP address + User Agent), that seems pretty clearly identifying. If you generate a random identifier but save that identifier in their cookies and send it back next time, also pretty clearly identifying.

> How do you create the hash? If it's based on something that you can derive from the user (let's say sha1(IP address + User Agent), that seems pretty clearly identifying.

of course that is forbidden. and that's exactly why it is really hard to tell if companies honor it.

Re: No Cookie for You

#199

Post by tinus_hn »

OzzyB wrote: post #181
thomascgalvin wrote: post #128

Earlier quoted context omitted.

This is (mostly) based on EU law; entities that set cookies and track user data are required to get opt-in permission from users before doing so, and if the user declines, the entity cannot offer a degraded service. At least that's the idea. In practice, almost everyone just throws up a banner that says "fuck you, we're selling your data as hard and as fast as we can," with no opt-out available, but they pretend that…

> the entity cannot offer a degraded service Does this mean that sites that offer free but ad-supported content still have to offer that content? So I can watch those free Youtube movies and listen to those Spotify tracks ad-free because EU Law says fuck you . How is this fair? Edit: Okay, okay, non-targeted (and no 3rd party) ads are okay, got it xD

You can display ads just fine without using cookies. You just can’t track people across the web.

Also Spotify can easily require a free login and associate everything with that, no tracking cookies required. They just can’t associate your playlist with your web browsing habits.

Re: No Cookie for You

#200

Post by p410n3 »

cryptonym wrote: post #17
xwdv wrote: post #4

Have they found some alternative to cookies?

Cookie is a technical solution. The law isn't about cookies but about privacy. The alternative to asking permission to do intrusive things is to avoid doing intrusive things.

Finally someone who knows this! Even (some) "SEO advice" blogs have suggested to just use local storage instead of cookies.

Just no.

Both the e-privacy directive and the GDPR are very broad in their articulation and never mention specific technique's, technologies or anything like that. A good example is gdpr article 32.

Fun fact: the e privacy directive (which defines the cookie rules) isn't actually passed yet and technically you don't need cookie banners how they are now. Purely informational banners would be enough, but the directive already _should_ have passed but was delayed, and since gdpr spooked everyone, everything and everyone is using cookie banners now anyway

Post reply on HN