Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No Cookie for You

github.blog

Post reply on HN
Print view View original

311–320 of 634 posts

Re: No Cookie for You

#311

Post by jedberg »

wpietri wrote: post #269
jedberg wrote: post #241

Earlier quoted context omitted.

A one way hash of an IPv4 address is no more private than the address itself. If you know the has algorithm, you can build a rainbow table of all the hashes in under a second. Even with a random salt it doesn't take long to build a rainbow table with all possible salts.

Doesn't that depend on the size of the salt?

To an extent, but there are easy ways to cut the search space. For example, you could make a unique request with garbage on it from a known IP every day, and then all you have to do is build a rainbow table for that one IP to find out what the salt is for each day, and then you can fully reconstruct the logs.

Re: No Cookie for You

#312

Post by ilikepi »

It seems the huge and annoying "Why don't you join Github" banner is gone now, too. They must have eliminated the persistent cookie that clicking "Dismiss" presumably set. That banner was very frustrating for me, as I clear cookies regularly from the browser profile I use for random surfing.

Re: No Cookie for You

#313

Post by icefo »

mh- wrote: post #142
abdullahkhalids wrote: post #121

Earlier quoted context omitted.

> How can Plausible Analytics count unique visitors without cookies? > So if you don’t use cookies how do you count the number of website visitors and report on metrics such as the number of unique users? > Instead of tagging users with cookies, we count the number of unique IP addresses that accessed your website. Counting IP addresses is an old-school method that was used before the modern age of JavaScript snippet…

This would be woefully inaccurate for websites with a large amount of mobile traffic (because of CGNAT), or university traffic, or etc.

Don't universities have a huge number of IPs because they were the first to use internet ?

Mine gives one public ipv4 per device that access the internet on the network (with some exceptions). Strategies varies but if you have a lot of addresses why not use them.

Re: No Cookie for You

#314

Post by spullara »

noja wrote: post #296
dry_soup wrote: post #3

A lot of people have the misconception that the EU cookie law applies to all cookies, but as the blog post correctly points out, that just isn't the case.

what about identifiable information like ip addresses?

generally they are used to protect against DDOS and to have forensic data in the case there is malicious behavior and are allowed as essential to operating the service.

Re: No Cookie for You

#316

Post by dessant »

heroprotagonist wrote: post #141

This is fantastic. Thank you, GitHub. I hope this is a good demonstration of a hands-off approach at Microsoft in regard to company culture. I realize you likely still collect some analytics for yourself and that this change does nothing to alleviate that. EG, first party javascript. But it's great that it's divorced from 3rd parties. Presumably Microsoft has access to those metrics, though? I wonder how deeply that…

GitHub still sends the same personal data to their own analytics endpoint, and the privacy policy which lists third-party data subprocessors [1] has not been updated.

See my comment below for details: https://news.ycombinator.com/item?id=25458635

Tracking cookies have little value for GitHub when they can collect data about users that have already been authenticated, and they send the username and user ID as part of their tracking request.

Inspect the request sent to collector.githubapp.com on every page load to see the type of personal data that is being collected on the client-side.

We have no visibility into how they associate this data with analytics data collected on the server-side, and that's where an updated privacy policy would also help.

[1] https://docs.github.com/en/free-pro-team@latest/github/site-...

Re: No Cookie for You

#317

Post by jeanjogr »

type0 wrote: post #305
jeanjogr wrote: post #299

Earlier quoted context omitted.

I typed "cnil fines" (the CNIL being the French data watchdog) on google which led me to their sanction page [0] which features 100M€ fines to Google and 35M€ to Amazon _last week_. It is surely not much in the grand scheme of thing but surely this is more than a mere Potemkin village. [0] https://www.cnil.fr/fr/tag/sanctions

good that at least in one country they do something, but everywhere else it's wild wild web and the bandits are not threatened.

I typed "UK data watchdog" (for I did not know its name) and while it is true that I needed more clicks than for France, I found their enforcement page with their list of fines [0]: £18m here, £2m there...

[0] https://ico.org.uk/action-weve-taken/enforcement/?facet_type...

Re: No Cookie for You

#318

Post by [deleted] »

einpoklum wrote: post #300
buckmar wrote: post #233

Earlier quoted context omitted.

That's a good point. Microsoft has been much less heavy handed than I expected. But your point about how the data is used, I am very curious too. I wonder if they'd be willing to make the privacy policy readable?..

Microsoft would like for you to adopt an image of GitHub as an upright corporate endeavor - but remember they blocks/censor developers from world states that the US doesn't like.

[deleted]

Re: No Cookie for You

#319

Post by madjam002 »

geek_at wrote: post #24
dry_soup wrote: post #3

A lot of people have the misconception that the EU cookie law applies to all cookies, but as the blog post correctly points out, that just isn't the case.

True. Also even if you do track your visitors you can use privacy friendly (and ideally selfhostable) Analytics like Plausible https://plausible.io/ so you won't need the banners either. Just don't include facebook like buttons or any of these widgets

IANAL, but my understanding is that you might still need a consent box even if you use Plausible.

I've only skimmed over the docs, but it looks like they derive a unique identifier from the IP address and user agent which changes every day. IP addresses still count as Personally Identifiable Information under GDPR, so deriving an identifier from this for a use case such as analytics would likely require consent. This is speculation though so I'd be interested to hear what others think.

If it is critical to the operation of the website (functionality like storing saved items in a shopping cart, or security), then you wouldn't need consent.

In reality though, Plausible looks great and using it is a huge improvement over Google Analytics for privacy.

Re: No Cookie for You

#320

Post by cuu508 »

alexchamberlain wrote: post #278
Wowfunhappy wrote: post #147

Earlier quoted context omitted.

Does anyone happen to know of a service like this that is free (not self hosted) for non-commercial, low-traffic sites? Or which costs less than ~$10 per year. I have a basic Github Pages site, and I currently don't know whether anyone is looking at it, beyond the very few who take the time to email me. I don't need (or want) to know anything about my visitors, but it would be nice to know that I'm not simply tossing…

I thought that tracking cookies needed permissions regardless of whether they were first party or 3rd party?

Parent commenter says:

> I currently don't know whether anyone is looking at it

You don't need tracking cookies to track simple metrics like pageview numbers.

Post reply on HN