Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR penalty for passing on of IP address to Google by using Google Fonts

rewis.io

Post reply on HN
Print view View original

321–330 of 656 posts

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#321

Post by parksy »

tyilo wrote: post #268
leobg wrote: post #187

Earlier quoted context omitted.

I can put “rm -r /user” in my HTML as long as I want. It’s the user’s browser that decides what gets executed. This is a fundamental principle in the architecture of the internet. You cannot make another computer do anything. You can only send messages, and the receiver decides how to act on those.

Going further with this argument would all hacking also be ok?

No because hacking generally circumvents the intended system design. The architecture of the World Wide Web explicitly allows for user discretion in fetching and executing linked content. There's no slippery slope from using a system within design parameters and executing malicious instructions on other people's systems without their permission and/or knowledge.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#322

Post by janoc »

Mikeb85 wrote: post #276
leobg wrote: post #109

The ruling says the website owner illegally shared the user’s IP address with Google. AFAIK, this is an incorrect interpret of events. The website merely tells the user’s browser that the content is intended to be displayed using a font that, if not installed on the user’s computer, can be downloaded from Google’s server. It is the the user’s browser that initiates a request to Google’s server. A request by the websi…

So does this mean assets hosted by CDNs are illegal now? Since it doesn't ask the user's permission to direct the browser to another site to download said assets? And what if they're already cached in the browser. Distinction? Seems like laws don't understand how tech works...

>Seems like laws don't understand how tech works...

That's pretty much the definition of a law. Laws are written for people, by people. Not for computers.

This is sadly an unintended consequence of a very broad interpretation of GDPR, where an IP address is deemed as personally identifiable information.

If someone wanted to take this to absurd levels, similar argument, as has been made by this court, could be used to make the entire Internet illegal under GDPR - sending a packet exposes personal information of the sender to various third parties (routers of various ISPs) that the sender didn't consent to. And given that the recipient (service provider, website, whatever) could have arranged for having the data transferred on a floppy disk or by a pigeon instead ...

It is not only GDPR that suffers from this - e.g. in Austria it is illegal to drive with a dashcam because their court has ruled that a dashcam amounts to recording someone without their consent - and if you do so, it exposes you to a 20k€ fine!

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#323

Post by rpadovani »

leobg wrote: post #187
isbvhodnvemrwvn wrote: post #122

Earlier quoted context omitted.

Using this logic I can send full fingerprinting data as long as I do it from the front-end? I mean courts are not that dumb, it's still the website owner which decides what is done.

I can put “rm -r /user” in my HTML as long as I want. It’s the user’s browser that decides what gets executed. This is a fundamental principle in the architecture of the internet. You cannot make another computer do anything. You can only send messages, and the receiver decides how to act on those.

Except you cannot. If you are aware of a vulnerability that triggers the destruction of user's data from the browser just visiting a website, abusing it would be illegal.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#324

Post by Acinyx »

iqonq wrote: post #206
tomp wrote: post #153

Earlier quoted context omitted.

A CDN that sells your data (or doesn’t otherwise protect it) is more accurately termed “spying network”

Shouldn't be the onus on the regulator's part to prove that Google is selling or not protecting the user's IP address?

Google is an advertising network, they don't need to sell the IP to make money.

It's on the original website to prove that they only use your data for what you asked them to, if you want to do anything else, you need to request informed consent. Using hosted Google fonts is not needed to run the website (as you can also easily embed them without having the user touch Google). And Google will not say they won't do anything with that data, as they would be lying since that's the whole reason google fonts and other free webdev resources by Google exists: to gather as much data about the user it can.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#325

Post by nightgarden »

elygre wrote: post #231
nightgarden wrote: post #150

Earlier quoted context omitted.

So, soon on top of all the cookie notices that are already there, we are also going to have to consent initially before anything loads to downloading the javascript from 3rd party to manage all the consents? Lol.... Just what the internet needs...

There is also the option of not messing around with personal data. It would get rid of all the cookie notices that are there, as well as not adding new ones.

The point is that if you go by the logic of this court decision, you need a consent also for js libraries, images, etc. and their primary purpose isn't to gather data. So, to get rid of all notices, you would have to host absolutely everything yourself.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#326

Post by arka2147483647 »

marcus_cemes wrote: post #256
arendtio wrote: post #209

Earlier quoted context omitted.

While you somewhat correct, in that the browser sends the request, but it is not a 'can be downloaded' but rather an imperative saying 'get that font from that server'. In the end, the w3c standards define, that browsers execute the commands they receive from the server and in this case, the server tells the browser to download the font. So the site-owner configures his website in a way, that this site instructs brow…

> the w3c standards define, that browsers execute the commands they receive from the server I'm no expert in the matter, but this seems a little convoluted to me? To me, the server does not issue instructions, per se, it returns a declarative text/binary response that describes the sturcture of the website, it is then up to the browser, that the user installed and chooses to use and may configure (and possibly config…

I think you confuse user, the Human, and user, the Programming Idiom.

User, the Human, is not going to be asked weather or not the browser should open every one of the possibly hundreds of references in a web page!!

Now, user, the Programming Idiom, might be configured, programed, etc.. to behave differently, but the reality is that is that's not how the modern web works. If the browser is not configured to behave the way it comes from the box by Google, Microsoft or Apple, most pages will not work correctly.

So I think your configuration/technical argument is purely theoretical. The court cannot expect the average user to understand do any of that.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#327

Post by bondarchuk »

maratc wrote: post #281
bondarchuk wrote: post #251

Earlier quoted context omitted.

So it is the responsibility of the website owner, to make sure that the user is informed about how his own browser works. Couldn't you make a case for shifting this responsibility to e.g. the browser vendor or the regulating bodies who decide on web standards?

No. The responsibility of the website owner is not to send users' personal data to third parties, OR to receive their users' informed consent to such sending BEFORE that sending occurs. That's the law. It's enforced by courts. Web standards aren't law. They aren't enforced. You can't sue anyone in W3C court for using non-standard CSS or forgetting to close a ` ` with a ` `.

>not to send users' personal data to third parties

>receive their users' informed consent to such sending BEFORE that sending occurs.

Neither of these are what's actually happening in this case. According to this court's decision, the responsibility of the website owner is not to send instructions to the user's machine that might expose their personal data to third parties after the user's machine follows these instructions, OR receive informed consent before such instructions are sent. I'm not saying the GDPR doesn't apply here, but at least it's clearly a different situation.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#328

Post by ratww »

marcus_cemes wrote: post #256
arendtio wrote: post #209

Earlier quoted context omitted.

While you somewhat correct, in that the browser sends the request, but it is not a 'can be downloaded' but rather an imperative saying 'get that font from that server'. In the end, the w3c standards define, that browsers execute the commands they receive from the server and in this case, the server tells the browser to download the font. So the site-owner configures his website in a way, that this site instructs brow…

> the w3c standards define, that browsers execute the commands they receive from the server I'm no expert in the matter, but this seems a little convoluted to me? To me, the server does not issue instructions, per se, it returns a declarative text/binary response that describes the sturcture of the website, it is then up to the browser, that the user installed and chooses to use and may configure (and possibly config…

Your post basically amounts to blaming victims of malware and spyware.

"Sure your honor, the victim died by carbon monoxide asphyxiation, but it was his choice to inhale the gas, even though it smells the same as normal air"

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#329

Post by marcus_cemes »

ryandrake wrote: post #308
marcus_cemes wrote: post #256

Earlier quoted context omitted.

> the w3c standards define, that browsers execute the commands they receive from the server I'm no expert in the matter, but this seems a little convoluted to me? To me, the server does not issue instructions, per se, it returns a declarative text/binary response that describes the sturcture of the website, it is then up to the browser, that the user installed and chooses to use and may configure (and possibly config…

Try making this argument with compiled code instead of HTML: "The company included the code to do $BAD_THING in the binary executable, but it was the user's choice to run it, and he could have easily modified the binary to ignore $BAD_THING, but didn't. Therefore, it was the user doing $BAD_THING, not the company." A lot of people in this discussion are splitting hairs here, trying to blame the user or the browser. T…

Yeah, I guess this stands. But HTML is not executable. It has to be parsed, like words in a book, not chemicals in a tube. Who is liable, the person who creates the poison, or the book (encyclopedia) which describes the process (and therefore the person who wrote it/distributes it)?

Again, I'm not saying what is right and wrong, but I think this issue is fundamentally much, much more complex than the court may have thought, and more importantly, may have repercussions on almost every website out there.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#330

Post by kevincox »

ryandrake wrote: post #308
marcus_cemes wrote: post #256

Earlier quoted context omitted.

> the w3c standards define, that browsers execute the commands they receive from the server I'm no expert in the matter, but this seems a little convoluted to me? To me, the server does not issue instructions, per se, it returns a declarative text/binary response that describes the sturcture of the website, it is then up to the browser, that the user installed and chooses to use and may configure (and possibly config…

Try making this argument with compiled code instead of HTML: "The company included the code to do $BAD_THING in the binary executable, but it was the user's choice to run it, and he could have easily modified the binary to ignore $BAD_THING, but didn't. Therefore, it was the user doing $BAD_THING, not the company." A lot of people in this discussion are splitting hairs here, trying to blame the user or the browser. T…

To follow down the difference here I think that the browser is much more aware of what it is doing than compiled code. It know what this is a stylesheet or a font, it knows it is coming from a different origin and more. Technically the browser is very capable of blocking all third party resources (if you assume that party == domain).

With compiled code stopping it from executing one particular instruction or feature is much harder.

Basically I think the declarative is a significant difference.

Of course I don't think the law thinks that. Otherwise we would have implemented technical measures for limiting cookies such a permissions (with legal backing) rather than these legal-only ones which are abused more often than implemented as they are supposed to be.

Post reply on HN