Live data from Hacker News

Cookie Warning Shenanigans Have Got to Stop

troyhunt.com

241–250 of 509 posts

Re: Cookie Warning Shenanigans Have Got to Stop

#242
post #218
post #154

Earlier quoted context omitted.

No, they're supposed to serve generic, non-tracking ads. Non-targeted, or whatever the terminology is. It's hilarious how everyone has just forgotten that used to be a thing. The people on this website are literally the problem, you can't even conceive of a website that doesn't track every click you make across the whole internet, and you guys are the people building the new web.

It’s not possible to do a lot of normal web stuff without session cookies.

[deleted]

Re: Cookie Warning Shenanigans Have Got to Stop

#243
post #218

Earlier quoted context omitted.

It’s not possible to do a lot of normal web stuff without session cookies.

Define "a lot of normal web stuff". How did we ever do normal web stuff before session cookies?

I think they would start another fire, and get another blanket

Re: Cookie Warning Shenanigans Have Got to Stop

#244

I am not a fan of the cookie banners at all. If anything I feel like browsers should implement it as it already does with other security settings (access to location, camera, etc…) and then people can decide to allow all websites. Blacklist, whitelist whatever. Why are we making every site implement a completely unique interface with different verbiage?

Cookie warnings don't show up for any old cookie usage. HN has no cookie warnings, despite having accounts and logins. Cookie warnings are shown when the "evil bit" or the "color" of the cookie is set; that is, there is no way for the browser to know when a cookie should require a warning and when it shouldn't.

Re: Cookie Warning Shenanigans Have Got to Stop

#245

In The Netherlands the Data Protection Authority announced this month that websites are no longer allowed to block access when people click "NO" in the cookie warning; Clicking 'no' should still allow people to view the website, but without placing any tracking cookies. Source (in Dutch): https://autoriteitpersoonsgegevens.nl/nl/nieuws/websites-moe...

Hmm, there are features that one literally can't provide without state (cookies). I think the real problem here is that the technical feature of cookies providing browser state is a poor proxy for what EU/DPA _really_ wants to regulate, which is privacy-related tracking. There are tons of sites I've written which use cookies, but have no ads and perform no user-tracking whatsoever, not even Google Analytics. It is tr…

Close to 100% of the cookies I see in the wild are not to provide state.

There’s only a handful that need them for logging in.

Most sites I visit I don’t want to interact with, I just want to read.

Re: Cookie Warning Shenanigans Have Got to Stop

#246

In The Netherlands the Data Protection Authority announced this month that websites are no longer allowed to block access when people click "NO" in the cookie warning; Clicking 'no' should still allow people to view the website, but without placing any tracking cookies. Source (in Dutch): https://autoriteitpersoonsgegevens.nl/nl/nieuws/websites-moe...

Hmm, there are features that one literally can't provide without state (cookies). I think the real problem here is that the technical feature of cookies providing browser state is a poor proxy for what EU/DPA _really_ wants to regulate, which is privacy-related tracking. There are tons of sites I've written which use cookies, but have no ads and perform no user-tracking whatsoever, not even Google Analytics. It is tr…

"Hmm, there are features that one literally can't provide without state (cookies)."

Silent cookies aren't completely banned by the GDPR/cookie laws, only cookies that aren't necessary to provide the service requested by the user. That's sort of vague, but I think mostly obvious what is intended there. It's pretty easy to operate within the spirit and letter of the law: Shopping baskets, load balancer cookies and login tokens are fine (provided you only use them for those purposes!), third party advertising tracking cookies are absolutely not (without consent). More info here: https://ico.org.uk/for-organisations/guide-to-pecr/cookies-a...

Lawyers have told me that you do not even need consent for Google Analytics, unless you enable the data collection for advertising features.

It appears to me that there's intentional bad faith misunderstanding from some, regarding both the cookie law and GDPR, in order to try and paint it as unworkable.

Re: Cookie Warning Shenanigans Have Got to Stop

#247
post #228

Earlier quoted context omitted.

How do you remember that a customer has responded to a popup if you don't give them a cookie? Even a cookie as a session identifier.

There should be a header that browsers can send to indicate wether the user does or does not consent to tracking.

There is. https://en.m.wikipedia.org/wiki/Do_Not_Track

Re: Cookie Warning Shenanigans Have Got to Stop

#248
post #213
post #192

Earlier quoted context omitted.

Thanks, this helps clear up some of my understanding. I still think its ridiculous that websites can't refuse to serve who they want.

Why? It's relatively common for governments to prohibit businesses and services from discriminating against certain types of users, why do you think it's ridiculous in this specific case?

The only examples I can think of for the US where this happens have to do with historically discriminated classes of identities; e.g., gender, racial minority, etc.

Are there other examples?

Re: Cookie Warning Shenanigans Have Got to Stop

#249

In The Netherlands the Data Protection Authority announced this month that websites are no longer allowed to block access when people click "NO" in the cookie warning; Clicking 'no' should still allow people to view the website, but without placing any tracking cookies. Source (in Dutch): https://autoriteitpersoonsgegevens.nl/nl/nieuws/websites-moe...

DPA can track you for at least 31 days before their log files rotate and get aggregated. It is not via a tracking cookie, but unique enough in my opinion to track you, and that happens without consent.

For a privacy advocating party it would suit them to not log anything and be very clear about that.

Source: https://autoriteitpersoonsgegevens.nl/nl/over-deze-site/cook...

Re: Cookie Warning Shenanigans Have Got to Stop

#250

That post reminded me about the https://amiunique.org/ site for seeing how trackable you are with browser fingerprints. I had remembered that I had installed a "Random User-Agent" plugin in Chrome, with privacy concerns in mind. Sometimes it sends a user-agent that causes a site to send me a page that can't actually be rendered by my browser, so I have to turn it off on some sites. But I was curious to see what amiun…

I think it's having problems right now. I don't use anything and it's slow, blank page, 500 errors, etc.
Post reply on HN