Live data from Hacker News

No Cookie for You

github.blog

351–360 of 634 posts

Re: No Cookie for You

#351

Earlier quoted context omitted.

Doesn't that depend on the size of the salt?

To an extent, but there are easy ways to cut the search space. For example, you could make a unique request with garbage on it from a known IP every day, and then all you have to do is build a rainbow table for that one IP to find out what the salt is for each day, and then you can fully reconstruct the logs.

If the salt is a random 64bit number (for example) then "finding out" the salt is not trivial.

Re: No Cookie for You

#352

Shoutout to the extension "I don't care about cookies" that removes all these banners automatically. [1]: https://www.i-dont-care-about-cookies.eu/ [2]: https://addons.mozilla.org/en-US/firefox/addon/i-dont-care-a... [3]: https://chrome.google.com/webstore/detail/i-dont-care-about-...

AFAIK, it doesn't object against (tracking, add, etc.) cookie usage and some pages assume, that when you use the page that you have agreed to tracking and the like. Even though I doubt that it is legal, you might end up being tracked even though you never agreed to it.

I like the idea of the extension and used a for a few weeks, but ultimately decided to remove it again.

Re: No Cookie for You

#353
I really don't care about cookies when visiting any website, I have a residential IP address tracking me using this is pretty much equivalent to having a cookie, yet I'm forced to accept a cookie which has near zero effect on my privacy all the while not being under the jurisdiction of EU laws regardless.

This is part of the web, when creating legislation that attempts to block/censor or circumvent technology that is already widely used it's in the highest degree repressive and when there are good intentions behind those laws it's just plain dumb.

I wonder how better EU tax payer money would have been used if they were spent on advocating a change to the browser vendors/W3C instead of on law makers exerting their power way beyond their rein.

What is the best Chrome ext to auto accept cookies?

Re: No Cookie for You

#354

Earlier quoted context omitted.

https://www.cloudflare.com/web-analytics/

I have nothing directly against cloudflare but I think it would be better to try to support one of the smaller analytics companies if possible. They are the ones who made products that got big companies like cloudflare interested in the space.

An analytics service designed to add value to another product and does not need to be profitable in itself sounds like the best kind to me.

Re: No Cookie for You

#355

Shoutout to the extension "I don't care about cookies" that removes all these banners automatically. [1]: https://www.i-dont-care-about-cookies.eu/ [2]: https://addons.mozilla.org/en-US/firefox/addon/i-dont-care-a... [3]: https://chrome.google.com/webstore/detail/i-dont-care-about-...

That extension hides, and sometimes accepts cookie consent popups for tracking cookies, it's harmful for your privacy, and should only be installed if you literally don't care about cookies, nor your privacy.

Why would you trust a webpage to not add any cookies just because you told them to? If you want to protect your privacy you should control the cookies yourself, at which point the consent popup becomes pointless.

Re: No Cookie for You

#356
ePrivacy document WP224 ("Opinion 9/2014 on the application of Directive 2002/58/EC to device fingerprinting") specifically discusses the use of fingerprinting and IP addresses for first-party analytics and states:

"However, the Opinion also stated that currently there is no exemption to consent for cookies that are strictly limited to first party anonymised and aggregated statistical purposes. Therefore, first-party website analytics through device fingerprinting do not fall under the exemption defined in CRITERION A or B and consent of the user is required."

This seems quite clear that consent is required for any form of analytics where you can identify individual users.

Another commenter here mentioned that GitHub is only tracking individuals for 24 hours before the fingerprint changes. I would think that would probably qualify as being in the spirit of the ePrivacy directive, if not the letter of it.

Would be great if someone from GitHub could comment on the above? How are you handling this - do you maybe get consent as part of the terms you agree to when you signup? (which would mean not tracking anonymous users).

Re: No Cookie for You

#357
post #324

Somehow the rest of the internet was sold to the idea of "EU is forcing you to put cookie banners, these are nothing but annoyance" rhetoric. Whoever pulled that off, bravo! In reality, the idea was to make people aware that they are being tracked across the web and and give them options and somehow everyone pretended that "No tracking, no banners" is not an option. I am so glad that GitHub is coming forward and poin…

I am pretty sure that they are still tracking you - but Microsoft can easily afford to do tracking in-house...

Re: No Cookie for You

#358

Earlier quoted context omitted.

Looked for a few minutes and couldn't find the full answer. How does Plausible calculate unique users if it can't store some type of identifier on the page? I see this... "We do not generate any persistent identifiers either. We generate a random string of letters and numbers that is used to calculate unique visitors on a website and we reset this string once per day." But where is that ID stored?

Probably like we do it for pirsch.io, by calculating a hashed fingerprint and throwing away the individual page hits once per day: https://github.com/pirsch-analytics/pirsch

What's the privacy benefit over storing a tracking cookie with expiry of a day? If at all, random cookie seems better for privacy as in your case if someone really wants it, they can recover the IP if the user agent is not rare by searching for all IP(4 billion IPv4), User-Agent(100 for popular browsers), the date(1 day as date is stored separately), and a salt(known to server), easily within reach of anyone.

Re: No Cookie for You

#359
post #353

I really don't care about cookies when visiting any website, I have a residential IP address tracking me using this is pretty much equivalent to having a cookie, yet I'm forced to accept a cookie which has near zero effect on my privacy all the while not being under the jurisdiction of EU laws regardless. This is part of the web, when creating legislation that attempts to block/censor or circumvent technology that is…

No EU lawmaker has ever said GDPR will be enforced worldwide. It's Github's and other sites' own choice to enforce it worldwide. They could also build two seperate websites.

The fact that this laws' reach is almost global is something called the Brussels Effect: https://en.wikipedia.org/wiki/Brussels_effect

But there is also the other way: simply not show a website in Europe at all. I see this sometimes when I click a link: https://imgur.com/a/A5S4drS

Post reply on HN