No Cookie for You • Hacker News Board

Re: No Cookie for You

#241

Post by jedberg » Thu, Dec 17, 2020, 6:45 PM UTC

abdullahkhalids wrote: post #121

tuna-piano wrote: post #54

Earlier quoted context omitted.

Looked for a few minutes and couldn't find the full answer. How does Plausible calculate unique users if it can't store some type of identifier on the page? I see this... "We do not generate any persistent identifiers either. We generate a random string of letters and numbers that is used to calculate unique visitors on a website and we reset this string once per day." But where is that ID stored?

> How can Plausible Analytics count unique visitors without cookies? > So if you don’t use cookies how do you count the number of website visitors and report on metrics such as the number of unique users? > Instead of tagging users with cookies, we count the number of unique IP addresses that accessed your website. Counting IP addresses is an old-school method that was used before the modern age of JavaScript snippet…

A one way hash of an IPv4 address is no more private than the address itself. If you know the has algorithm, you can build a rainbow table of all the hashes in under a second. Even with a random salt it doesn't take long to build a rainbow table with all possible salts.

Re: No Cookie for You

#242

Post by bbellini » Thu, Dec 17, 2020, 6:46 PM UTC

Wowfunhappy wrote: post #147

geek_at wrote: post #24

Earlier quoted context omitted.

True. Also even if you do track your visitors you can use privacy friendly (and ideally selfhostable) Analytics like Plausible https://plausible.io/ so you won't need the banners either. Just don't include facebook like buttons or any of these widgets

Does anyone happen to know of a service like this that is free (not self hosted) for non-commercial, low-traffic sites? Or which costs less than ~$10 per year. I have a basic Github Pages site, and I currently don't know whether anyone is looking at it, beyond the very few who take the time to email me. I don't need (or want) to know anything about my visitors, but it would be nice to know that I'm not simply tossing…

I would recommend GoatCounter.

https://www.goatcounter.com/

Re: No Cookie for You

#243

Post by lmkg » Thu, Dec 17, 2020, 6:46 PM UTC

random5634 wrote: post #103

AndrewStephens wrote: post #31

I hate the standard wording on Cookie banners. Most of them should read: "The site uses cookies. Actually it doesn't - you are not logged on and we don't need to maintain state. But our advertising partners, their partners, and their partner's partners all love to set tracking cookies. Click here to consent to three dozen cookies from around the globe."

Good lord, everyone needs banners and popups? Why not just let browsers controls who sets what cookies? I'm tired the endless cookie popups, can we come up with an "allow cookies if the browser accepts them" standard as long as that guarantees no cookie popups? Then browser vendors can ship a delete all non same origin cookies on tab close or something.

Two objections.

1. A law that aims to prevent stealing should be deterring thieves, not just regulating padlocks.

2. Technical measures are insufficient because cookies are regulated by purpose. A third-party cookie for fraud detection is allowed; a first-party cookie for analytics requires consent. It also prevents using necessary cookies for secondary purposes, something that literally cannot be accomplished through technical means alone.

As a minor point, the so-called "cookie law" also regulates browser fingerprinting. I have a hard time imagining that you could legislatively mandate effective anti-fingerprinting approaches.

Re: No Cookie for You

#244

Post by privacylawthrow » Thu, Dec 17, 2020, 6:47 PM UTC

p410n3 wrote: post #200

cryptonym wrote: post #17

Earlier quoted context omitted.

Cookie is a technical solution. The law isn't about cookies but about privacy. The alternative to asking permission to do intrusive things is to avoid doing intrusive things.

Finally someone who knows this! Even (some) "SEO advice" blogs have suggested to just use local storage instead of cookies. Just no. Both the e-privacy directive and the GDPR are very broad in their articulation and never mention specific technique's, technologies or anything like that. A good example is gdpr article 32. Fun fact: the e privacy directive (which defines the cookie rules) isn't actually passed yet and…

>Fun fact: the e privacy directive (which defines the cookie rules) isn't actually passed yet and technically you don't need cookie banners how they are now. Purely informational banners would be enough, but the directive already _should_ have passed but was delayed, and since gdpr spooked everyone, everything and everyone is using cookie banners now anyway

The ePrivacy Directive passed in 2002. It was amended in 2009 to include the cookie rule. The ePrivacy Regulation which would codify cookie requirements as an EU-wide regulation has not passed yet.

Re: No Cookie for You

#245

Post by GuillaumeHr » Thu, Dec 17, 2020, 6:48 PM UTC

Really good news! For others websites, I've developped the browser addon Ninja Cookie that remove cookie banners by rejecting the use of non-essential cookies. (I've introduce Hacker News community few weeks ago to this project) Free and good for your privacy :) Have a look guys :) https://ninja-cookie.com

Re: No Cookie for You

#246

Post by dorgo » Thu, Dec 17, 2020, 6:50 PM UTC

thewebcount wrote: post #226

interestica wrote: post #145

Earlier quoted context omitted.

I hate the implication that those banners are some sort of consent. They're so commonplace now that people blindly click 'okay' or close them just to be able to read the site. If the wording was something else ("you agree that we can take your first born child") would it even hold up? The worst is when the banner says: "This site uses cookies. Agree / Disagree" -- it's not even asking for consent.

I have never once in my life clicked on any of these banners. In no way have I given them my consent. I simply ignore them. If they track me, they're breaking the law.

the law requries either consent or legitimate interest ( there are even more options - but not relevant here ). So they can track you without consent and not breaking the law.

Re: No Cookie for You

#247

Post by sharken » Thu, Dec 17, 2020, 6:52 PM UTC

thomascgalvin wrote: post #128

random5634 wrote: post #103

Earlier quoted context omitted.

Good lord, everyone needs banners and popups? Why not just let browsers controls who sets what cookies? I'm tired the endless cookie popups, can we come up with an "allow cookies if the browser accepts them" standard as long as that guarantees no cookie popups? Then browser vendors can ship a delete all non same origin cookies on tab close or something.

This is (mostly) based on EU law; entities that set cookies and track user data are required to get opt-in permission from users before doing so, and if the user declines, the entity cannot offer a degraded service. At least that's the idea. In practice, almost everyone just throws up a banner that says "fuck you, we're selling your data as hard and as fast as we can," with no opt-out available, but they pretend that…

Sad but true, i wish there was some way to change the current state of affairs, but EU is a juggernaut that has lost track of its citizens wishes regarding cookies.

One of the most precious things we have is time and the constant cookie interruptions are a nuisance that should be kept from sight.

Re: No Cookie for You

#248

Post by Mojah » Thu, Dec 17, 2020, 6:53 PM UTC

Damnit, they found my loop-hole! https://ma.ttias.be/loophole-cookie-notices/

Re: No Cookie for You

#249

Post by Layke1123 » Thu, Dec 17, 2020, 6:55 PM UTC

Why are there so many people on this website willing to bend over backwards for their employers shoving cookies down our throats? Is it because they pay so much money that you don't care what happens to others as long as you get yours?

Re: No Cookie for You

#250

Post by IMTDb » Thu, Dec 17, 2020, 6:56 PM UTC

Nextgrid wrote: post #156

baxtr wrote: post #72

Earlier quoted context omitted.

I really wonder genuinely if the regulation has improved anything at all. I just click through the banners without even thinking. It has become so annoying. The value I get is below zero. I wonder if the majority is like me.

The regulation explicitly forbids annoying banners, the problem is that there’s currently zero enforcement of it so websites continue breaching it and lying to themselves (and others) by thinking their consent banners are compliant.

>The regulation explicitly forbids annoying banners

You have to love how the regulator did not even try to define what they mean by "annoying". Thus making the whole law completely useless.

In my book, any single pixel of my limited screen real estate that gets dedicated to this useless regulation is annoying. If the EU wants to enforce this, they need to provide a way for me to basically say "Yes, I agree with all tracking cookies for all sites forever", and never see a banner again.