Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No Cookie for You

github.blog

Post reply on HN
Print view View original

601–610 of 634 posts

Re: No Cookie for You

#601

Post by p_l »

BlueTemplar wrote: post #588
p_l wrote: post #561

Earlier quoted context omitted.

a cookie representing authentication session with your app isn't personal data, and doesn't need privacy policy, especially if your login is arbitrary and not an email. It doesn't matter how long it's active either, unless you use it to track users activity elsewhere

If it's used to determine identity, it's a kind of personal data. However, as you say, it might be allowed by GDPR without requesting extra approval, depending on the way that it's being used and who it is shared with? Hence my question about whether the length of time that you store this data legally matters (because since databases can be stolen, it eventually does). Compare with how ISPs must store all your connec…

a session cookie establishing your authentication session only links you with the account in the system. Now, what other data is attached to that account is another thing. For example, the typical forum of yore would only have to take care of emails at best - if it doesn't have personal data, it's irrelevant, because you can't link that identity with your IRL identity.

Length of time you store the data doesn't matter, except in the sense where you can prove that effectively you do not store it at all - for example by anonymization of logs so that you do not effectively store IP addresses, even if of course they have to exist in full in the system at some point to keep the connection open.

Re: No Cookie for You

#602

Post by tripzilch »

nobody9999 wrote: post #502
mumblemumble wrote: post #452

Earlier quoted context omitted.

It sounds like you have misunderstood the purpose of a privacy policy. It is very rare that I encounter one that is designed to protect the user's privacy. Far more often, it's there to protect the company. "I have read and agree to the privacy policy," is a coded way of saying, "I have read and agree to waive my claims to privacy, as outlined in the privacy policy."

>Far more often, it's there to protect the company. That's pretty much true. And why shouldn't a group try to limit their liability? >"I have read and agree to the privacy policy," is a coded way of saying, "I have read and agree to waive my claims to privacy, as outlined in the privacy policy." That's often, but not always true. For example, here's a [sanitized] privacy policy I wrote for a website I set up for a sp…

> And why shouldn't a group try to limit their liability?

When it's unethical to do so :)

... unrelated to your privacy policy btw, which I think is pretty good.

Re: No Cookie for You

#603

Post by tripzilch »

merijnv wrote: post #592
chopin wrote: post #578

Earlier quoted context omitted.

It's not GDPR compliant without consent. It doesn't matter whether you are using cookies or something else.

Why is it not GDPR compliant. You do not need consent under the GDPR. You need a (documented) "lawful basis for processing" personal information. Consent is just one of several lawful bases and honestly it's the most useless one, if you need consent your business model is screwed. It's perfectly possible for GitHub to process personal information without explicit consent while not violating the GDPR. Several options…

> I'm fairly confident that, depending on which and what detail of personal information, both of these justifications will be accepted by EU courts.

I believe they must also show that they don't store this data strictly longer than necessary.

Which, in the case of analytics/usability would mean aggregating (and thus depersonalising) the data almost immediately.

And if they do that, it will indeed be fine. Both with the letter, as the spirit of the law.

Re: No Cookie for You

#604

Post by [deleted] »

merijnv wrote: post #590
eitland wrote: post #517

Earlier quoted context omitted.

To add to this: from my understanding of the rules even a lot of the informed consent popups today aren't compliant. If I understand it correctly (and I think I am) the standard is that it should be equally easy to op out as to opt in, and the default should be opt out . IMO this means I should just be able to dismiss any GDPR compliant box and the result should be no tracking.

Correct. Also, you cannot with hold access upon users not consenting, so there's literally zero incentive for users to ever consent for compliant providers. Which is kinda obvious with the GDPR's overall goal of making it impossible to use privacy as currency.

[deleted]

Re: No Cookie for You

#605

Post by tripzilch »

spinningslate wrote: post #543
natfriedman wrote: post #527

Earlier quoted context omitted.

This is all detailed in our updated privacy policy: https://github.com/github/site-policy/pull/336

Thanks for responding Nat. My interpretation from the PR: You've stopped using cookies as a mechanism for marketing/tracking. But you're still doing it by other means. Rationale: 1. You are still tracking and may share the data with 3rd parties. Justification: privacy statement [0] line 147. It states that data are "aggregated, non-personally identified" which might mean it's GDPR compliant. OTOH: you're presumably h…

> OTOH: you're presumably holding the non-aggregated data for aggregation purposes in the first place. IANAL but I think that needs consent.

I believe this is actually fine if they can show they don't hold this data longer than necessary and have a process for destroying it in a timely fashion.

But IANAL either

Re: No Cookie for You

#606

Post by tripzilch »

cedilla wrote: post #598
gnud wrote: post #594

Earlier quoted context omitted.

Quite a lot of "cookie banners" are really banners to allow third parties to track you. Under GDPR, this requires a clear, unambiguous consent, freely given. How can you understand what you consent to if you blanket-accept everything? And thus the consent is invalid. And they need a new banner.

Some News sites literally ask for consent to over a thousand purposes in dozens of categories. Ist's really wild top assume that that's consent, informered or otherwise.

Oh but that behaviour is actually pretty clearly not compliant with the EU cookie law. It just hasn't been enforced (which isn't great).

They're not allowed to make it harder to withdraw consent than to give it.

I've also found, on the few times I humoured their "consent" system, found that each of these "tracking providers" (?) needed to make a request to a different domain to withdraw consent, and some of them simply wouldn't load.

Re: No Cookie for You

#607

Post by Yaggo »

yason wrote: post #570
niutech wrote: post #563

Earlier quoted context omitted.

Back in the days there was the P3P protocol ( https://en.wikipedia.org/wiki/P3P ) supported by IE and Edge, but it didn't work out and was abandoned. There is also `Do Not Track` header but it is not respected by most of websites. You can also reject all cookies in any web browser, but then majority of web pages will not work properly.

I accept but don't save any cookies except certain whitelisted ones. So I get a lot of cookie policy banners and I always click the full 'accept all' option because at best it'll just eat into their database storage and I'll arrive with no stored cookies the next time I visit the site. The browser allows me to accept all cookies or non-third-party cookies automatically but I still get these stupid cookie policy banne…

> I accept but don't save any cookies except certain whitelisted ones.

That's basically what happens in private mode (incognito), I guess. Would be nice if browsers used private mode by default, and you could "whitelist" certain sites you trust / want to remember your login.

Re: No Cookie for You

#608

Post by ljm »

nullsense wrote: post #366
ljm wrote: post #321

Earlier quoted context omitted.

To be fair, most of them probably do. It's not like the introduction of GDPR in Europe 2 years ago suddenly made all of the shit a marketing dept shoves into Google Tag Manager completely legit and above board. These third parties will take what you give them and _also_ take what they can get from your browser if you're embedding their script. Are you going to proxy those scripts as well to stop them getting the user…

It really shits me that a lot of them you can't even deny it. They just have a button like "I understand". WTF is that...

And then they wonder why we use things like uBlock, which are pretty much the only tools we can rely on to genuinely revoke consent. Or revoke as much of it as possible.

Re: No Cookie for You

#609

Post by 3pt14159 »

natfriedman wrote: post #528
3pt14159 wrote: post #15

This is great! GitHub continues to, somehow, surprise me. One question I do have, however, is whether or not the new homepage[0] which shows where people are when they open a PR actually reveals their present location. In the few samples I checked it did not seem that the presence of the person indicated matched their bio's location settings. If it is truly unmasking people's location I think it should be opt-in only…

Those locations come entirely from public profile bios, as provided by the user.

Then why do they sometimes not match?

Re: No Cookie for You

#610

Post by spinningslate »

tripzilch wrote: post #605
spinningslate wrote: post #543

Earlier quoted context omitted.

Thanks for responding Nat. My interpretation from the PR: You've stopped using cookies as a mechanism for marketing/tracking. But you're still doing it by other means. Rationale: 1. You are still tracking and may share the data with 3rd parties. Justification: privacy statement [0] line 147. It states that data are "aggregated, non-personally identified" which might mean it's GDPR compliant. OTOH: you're presumably h…

> OTOH: you're presumably holding the non-aggregated data for aggregation purposes in the first place. IANAL but I think that needs consent. I believe this is actually fine if they can show they don't hold this data longer than necessary and have a process for destroying it in a timely fashion. But IANAL either

thanks, didn't know that.
Post reply on HN