Friendly Captcha – GDPR-Compliant Bot Protection • Hacker News Board

Re: Friendly Captcha – GDPR-Compliant Bot Protection

#41

Post by TheRealPomax » Wed, Aug 09, 2023, 3:16 PM UTC

cccbbbaaa wrote: post #39

hot_gril wrote: post #33

Earlier quoted context omitted.

If you look through several top results, you get other unconditional yeses and some murky maybes. On this topic, Recaptcha doesn't say whether or not it's GDPR-compliant, and searches give unsure answers. You're saying a session ID isn't personal info, but https://commission.europa.eu/law/law-topic/data-protection/r... lists both "cookie IDs" and IP addresses as personal info. Which one is it? >If you're really in do…

Sessions IDs _are_ personal data, it's not even ambiguous if you read the definition in GDPR (article 4(1)). You even found it on the commission's website, it should give you a clear answer. About cookies, the relevant law is ePrivacy 2002/58/CE, article 5(3), which says you don't need to ask for consent for “strictly necessary” cookies. In practice, this means session ID cookies, user preferences, etc. This also app…

Of course the problem with "strictly necessary" is that it doesn't mean what the words mean. Almost nothing is strictly necessary to just serve content when a URL is accessed, so it has been made quite intentionally super murky. Beyond a session id, they're not even strictly necessary for serving content to logged in users, so there needs to be a place for people to agree and/or manager their cookie settings as part of their user settings, but user preferences, localStorage, etc. are still not strictly necessary to serve login-locked content on a URL.

Re: Friendly Captcha – GDPR-Compliant Bot Protection

#42

Post by cccbbbaaa » Wed, Aug 09, 2023, 3:39 PM UTC

TheRealPomax wrote: post #41

cccbbbaaa wrote: post #39

Earlier quoted context omitted.

Sessions IDs _are_ personal data, it's not even ambiguous if you read the definition in GDPR (article 4(1)). You even found it on the commission's website, it should give you a clear answer. About cookies, the relevant law is ePrivacy 2002/58/CE, article 5(3), which says you don't need to ask for consent for “strictly necessary” cookies. In practice, this means session ID cookies, user preferences, etc. This also app…

Of course the problem with "strictly necessary" is that it doesn't mean what the words mean. Almost nothing is strictly necessary to just serve content when a URL is accessed, so it has been made quite intentionally super murky. Beyond a session id, they're not even strictly necessary for serving content to logged in users, so there needs to be a place for people to agree and/or manager their cookie settings as part…

With all due respect, this is the kind of speculation I was complaining about earlier.

>Almost nothing is strictly necessary to just serve content when a URL is accessed

That's not what the law says.

> 3. Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information in accordance with Directive 95/46/EC, inter alia about the purposes of the processing, and is offered the right to refuse such processing by the data controller. This shall not prevent any technical storage or access for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user.

Emphasis mine. It's not to just serve content, but to provide a service requested by the user. This should clear up the confusion.

Full text here: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

Anyway, I provided a link from the ICO that explicitly says it's OK for user IDs, user preferences, etc.

The CNIL agrees: https://www.cnil.fr/sites/cnil/files/atoms/files/lignes_dire... See point 49.

The EDPB agrees: https://ec.europa.eu/justice/article-29/documentation/opinio...

Re: Friendly Captcha – GDPR-Compliant Bot Protection

#43

Post by hot_gril » Wed, Aug 09, 2023, 3:49 PM UTC

cccbbbaaa wrote: post #42

TheRealPomax wrote: post #41

Earlier quoted context omitted.

Of course the problem with "strictly necessary" is that it doesn't mean what the words mean. Almost nothing is strictly necessary to just serve content when a URL is accessed, so it has been made quite intentionally super murky. Beyond a session id, they're not even strictly necessary for serving content to logged in users, so there needs to be a place for people to agree and/or manager their cookie settings as part…

With all due respect, this is the kind of speculation I was complaining about earlier. >Almost nothing is strictly necessary to just serve content when a URL is accessed That's not what the law says. > 3. Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on conditi…

I knew about this part of the law too, and it sounds like captchas don't count as "strictly necessary" based on the original part and the Opinion 04/2012 on Cookie Consent Exemption you linked, but I'm not sure.

"Simply using a cookie to assist, speed up or regulate the transmission of a communication over an electronic communications network is not sufficient. The transmission of the communication must not be possible without the use of the cookie." - criterion A "A cookie is necessary to provide a specific functionality to the user (or subscriber): if cookies are disabled, the functionality will not be available." - B

For B, they say for example that a session ID to keep a user logged in is fair to use without asking, provided the user explicitly wanted to log in.

Re: Friendly Captcha – GDPR-Compliant Bot Protection

#44

Post by cccbbbaaa » Wed, Aug 09, 2023, 4:03 PM UTC

hot_gril wrote: post #43

cccbbbaaa wrote: post #42

Earlier quoted context omitted.

With all due respect, this is the kind of speculation I was complaining about earlier. >Almost nothing is strictly necessary to just serve content when a URL is accessed That's not what the law says. > 3. Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on conditi…

I knew about this part of the law too, and it sounds like captchas don't count as "strictly necessary" based on the original part and the Opinion 04/2012 on Cookie Consent Exemption you linked, but I'm not sure. "Simply using a cookie to assist, speed up or regulate the transmission of a communication over an electronic communications network is not sufficient. The transmission of the communication must not be possib…

If you use a captcha to secure your service, they can be. See article 4 of the ePrivacy directive. This is also said in section 3.3 of the EDPB guideline.

The issue of Google's reCaptcha, according to the CNIL at least, is that they use data collected through the service for their own purposes. See https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000047346903, point 86. Deepl translation below:

> If a data controller can claim exemption from the requirement to provide information and obtain consent when the only purpose of read/write operations carried out on a user's terminal is to secure an authentication mechanism for the benefit of users (see CNIL, FR, September 27, 2021, Sanction, no. SAN-2021-013, published), the situation is different when these operations also pursue other purposes that are not strictly necessary for the provision of a service. The Google reCaptcha mechanism is not intended solely to secure the authentication mechanism for the benefit of users, but also enables Google to carry out analysis operations, as Google itself specifies in its general terms of use.

Re: Friendly Captcha – GDPR-Compliant Bot Protection

#45

Post by Szpadel » Thu, Aug 10, 2023, 9:05 PM UTC

jart wrote: post #21

Szpadel wrote: post #18

Earlier quoted context omitted.

because bots use hundreds IP addresses assigned to the same system, if you have 5r/s from 10k IP addresses it adds up if you require computational power you force them to invest money in hardware and potentially make it unprofitable

The last botnet I fended off had 49131669 IPs so believe me I know: https://ipv4.games/statusz The issue is it's not their money. A lot of these botnets are compromised of ordinary people's devices that got hacked into or hijacked by some slimy mobile app, that fires off a DDOS request every ~5sec or so in the background, and they do it because hacked devices aren't easy to fingerprint. So I feel bad for what's going…

I guess this depends what kind of traffic do you get in some cases data that they try to push is confidential like their user session. I switched on some systems rate limiting from per IP to per session, because of thousands ips used the same session cookie, that's why I assume all of them use the same physical machine