Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cookie Warning Shenanigans Have Got to Stop

troyhunt.com

Post reply on HN
Print view View original

231–240 of 509 posts

Re: Cookie Warning Shenanigans Have Got to Stop

#231

Post by gerardnll »

smileysteve wrote: post #157
RivieraKid wrote: post #143

This shows utter incompetence and detachment from reality by European legislators. Maybe it seemed like good idea in theory but the only practical significant impact is that browsing the web has become more annoying. Surely there are solutions that don't require a popup on every webpage you visit? For example enforcing no tracking by default for advertising purposes?

How do you remember that a customer has responded to a popup if you don't give them a cookie? Even a cookie as a session identifier.

There’s different types of cookies. Cookies are not banned but the ones not needed to offer the service are optional.

Re: Cookie Warning Shenanigans Have Got to Stop

#232

Post by l9k »

I think consent is important for tracking, but I noticed an implementation problem/annoyance:

On the same device, I consume news of the same sites from multiple sources or embeded browsers: Facebook, Google News, Chrome...

I don't want to go through the hassle of opting out of tracking from every partner of the very same site I visit. Now multiply the task by every site you visit and every device you use...

I now even suspect they intentionally remove the preference cookies so that you get tired of opting out

Re: Cookie Warning Shenanigans Have Got to Stop

#233

Post by duxup »

Jach wrote: post #215
duxup wrote: post #164

Earlier quoted context omitted.

>There was a world wide web before cookies. I like to think of that time as a great time too, but oh man so much we couldn't do.... I get what you're saying generally, but man I'd hate "before cookies" to be the standard.

The big use of cookies for re-authentication and carrying around a session id enabled clean URLs lacking your session id as a query param, but it wouldn't be that big of a deal to lose it. You'd need to be careful with copy-pasting URLs -- but given browsers standardized on cookies they could have standardized on a sessionId param name to filter out of copy-pastes or not even display it at all similar to Chrome's pro…

>I don't really see it as "what we couldn't do" but "what poor usability we have overcome". I'm glad we have cookies and other forms of local storage, especially for the latter there are many other benefits. Maybe one day we'll get Web SQL.

Yeah I think that's accurate.

It's a little weird sometimes reading all these articles about cookies, JavaScript, etc and I always think "But I use those things to ... give people things, convenience, data, help them do things." But so many times it's not treated as a tool, it's almost implied to be a negative thing.

Re: Cookie Warning Shenanigans Have Got to Stop

#234

Post by orev »

1nverseMtx wrote: post #161
DavideNL wrote: post #128

In The Netherlands the Data Protection Authority announced this month that websites are no longer allowed to block access when people click "NO" in the cookie warning; Clicking 'no' should still allow people to view the website, but without placing any tracking cookies. Source (in Dutch): https://autoriteitpersoonsgegevens.nl/nl/nieuws/websites-moe...

Which doesn’t mean they have to provide access for free, they are most likely allowed to ask a fee for that. From the same website you link [1]: “Does anyone refuse tracking cookies? Then you still need to give this person access to your website or app, for example after payment.” (google translated) [1]: https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/interne...

And how does one track if payment has been made without using a cookie?

Re: Cookie Warning Shenanigans Have Got to Stop

#235

Post by mort96 »

jrochkind1 wrote: post #219
DavideNL wrote: post #128

In The Netherlands the Data Protection Authority announced this month that websites are no longer allowed to block access when people click "NO" in the cookie warning; Clicking 'no' should still allow people to view the website, but without placing any tracking cookies. Source (in Dutch): https://autoriteitpersoonsgegevens.nl/nl/nieuws/websites-moe...

Hmm, there are features that one literally can't provide without state (cookies). I think the real problem here is that the technical feature of cookies providing browser state is a poor proxy for what EU/DPA _really_ wants to regulate, which is privacy-related tracking. There are tons of sites I've written which use cookies, but have no ads and perform no user-tracking whatsoever, not even Google Analytics. It is tr…

Most discussion about the EU cookie directive doesn't mention it, but not all cookies require consent. From https://privacypolicies.com/blog/eu-cookie-law/#some-cookies...:

"This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service."

Of course, no website will ever tell you "Hey, we're using cookies to track you"; it's in most companies' (both legal consulting companies' and website owners') best interest to keep people ignorant. Consulting companies want website owners to be scared and buy legal consulting services, and website owners want people to think that the pop-ups are a result of stupid EU legislation and not because they are actually being tracked.

Re: Cookie Warning Shenanigans Have Got to Stop

#236

Post by PopeDotNinja »

DavideNL wrote: post #128

In The Netherlands the Data Protection Authority announced this month that websites are no longer allowed to block access when people click "NO" in the cookie warning; Clicking 'no' should still allow people to view the website, but without placing any tracking cookies. Source (in Dutch): https://autoriteitpersoonsgegevens.nl/nl/nieuws/websites-moe...

Does that affect the use of the session & local storage?

Re: Cookie Warning Shenanigans Have Got to Stop

#237

Post by Jach »

scrollaway wrote: post #179
Jach wrote: post #152

Earlier quoted context omitted.

There is a safety issue in that data previously only visible internally is now also exposed to the customer/user and any unauthorized person successfully pretending to be them. The problem of "account compromised" now becomes a bigger (potentially much bigger) problem of "account compromised and juicy data is exfiltrated under a GDPR data dump request (and maybe followed by a request for deletion right after maybe ma…

That seems like a huge reach. Most of the data that affects users can be one way or another acquired if you're logged in. Furthermore GDPR requests are often handled outside the account itself, except by companies that have the resources to automate them (and those companies usually have a lot of security resources). I'll give you though that the addition of human processes in there present more security risks. I'm d…

It is kind of minor but still necessary to think about. The difference is that "sensitive data" now includes internal data that not even the account had access to or was aware of. You're right it's an extension of current risks rather than a new class, it's only one more attack vector against an existing surface. Before GDPR, the company itself would need to get compromised for that data to be exposed, and that happens often enough. After GDPR, the data for an individual can get exposed just from compromising that individual. Does that data matter? Maybe, maybe not, that's the question with all breaches too. In the good-spirited intention world, post-GDPR the company no longer gathers as much data in the first place, so they can actually reduce/eliminate the impact of that attack surface being broken in either way. I don't see this happening in practice, the desire for more and more data is strong.

Re: Cookie Warning Shenanigans Have Got to Stop

#238

Post by goto11 »

jrochkind1 wrote: post #219
DavideNL wrote: post #128

In The Netherlands the Data Protection Authority announced this month that websites are no longer allowed to block access when people click "NO" in the cookie warning; Clicking 'no' should still allow people to view the website, but without placing any tracking cookies. Source (in Dutch): https://autoriteitpersoonsgegevens.nl/nl/nieuws/websites-moe...

Hmm, there are features that one literally can't provide without state (cookies). I think the real problem here is that the technical feature of cookies providing browser state is a poor proxy for what EU/DPA _really_ wants to regulate, which is privacy-related tracking. There are tons of sites I've written which use cookies, but have no ads and perform no user-tracking whatsoever, not even Google Analytics. It is tr…

I'm not totally sure what you are arguing, but if you don't use the cookies for tracking, then you don't need to warn or inform the user. And if you use some other kind of tracking beside cookies, you still need to warn.

Re: Cookie Warning Shenanigans Have Got to Stop

#239

Post by majewsky »

volkk wrote: post #200
ben174 wrote: post #197

Earlier quoted context omitted.

Back in the early days, browsers used to prompt you for every cookie: https://i.imgur.com/FThIFHe.png

i don't think i ever saw that. which browser?

Konqueror did that when I used it in 2007-2010. I don't remember if it was the default behavior, but I had it configured by default.

These days I just block all third-party cookies, which solves most of the problem.

Re: Cookie Warning Shenanigans Have Got to Stop

#240

Post by leetcrew »

renholder wrote: post #204
laumars wrote: post #189

Earlier quoted context omitted.

In fairness it can add up pretty quickly on popular sites. I do love NPRs approach though.

> In fairness it can add up pretty quickly on popular sites. Aye, if they're only looking at it from a "cookie placement/tracking or nothing" hard-limit perspective, which is what the OC posited it as. ...but if other sites can absorb the costs, case in point: NPR, why is it such a dastardly evil thing to point out? Is there some foolhearted belief that if we cut tracking, tomorrow, the internet would cease to functi…

of course it's not expensive to serve pages. but creating content and services that are worth serving can be pretty expensive.
Post reply on HN