GDPR penalty for passing on of IP address to Google by using Google Fonts • Hacker News Board

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#651

Post by mminer237 » Wed, Feb 02, 2022, 3:03 PM UTC

mro_name wrote: post #14

HatchedLake721 wrote: post #3

So an HTTP GET request to another domain (fonts.googleapis.com) "leaked" website visitor's IP address to Google. What the hell? Google Translate: https://rewis-io.translate.goog/urteile/urteil/lhm-20-01-202... > The defendant is sentenced to pay the plaintiff €100.00 > The plaintiff has a claim against the defendant to refrain from passing on the plaintiff's IP addresses to Google under Section 823 (1) in conjunction…

yes. That's a fact. A 3rd party is a 3rd party and a website leaks it's visitors to it. Just don't do it but serve your stuff from your domain.

Note that if you are an American, this still isn't a solution. This ruling prohibits any US citizen having EU IP addresses. So if you as an American host your own servers, you either have to remove all connection logging or ban all Germans.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#652

Post by CodeBytes » Thu, Feb 03, 2022, 4:33 AM UTC

hammyhavoc wrote: post #646

floatingatoll wrote: post #500

Earlier quoted context omitted.

Using a CDN service operated by a non-GDPR business such as Cloudflare, Google, Amazon, or Akamai could potentially be confirmed to be a violation of GDPR, yes, if the CDN-hosted resources are used without opt-in. I’m eagerly awaiting the first complaint on these grounds to be reviewed and judged, now that the GDPR treaty with the United States has lapsed. It doesn’t matter where the CDN’s servers are; without the US…

Is CloudFlare really non-GDPR? https://www.cloudflare.com/en-gb/trust-hub/gdpr/

There was a very recent case which, at least for some types of data, found Cloudflare is not adequate: https://edpb.europa.eu/news/national-news/2021/census-2021-p...

It looks like the court decided SCCs were not sufficient as Cloudflare is subject to US surveillance laws so they wouldn't be able to provide adequate guarantees.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#653

Post by alkonaut » Thu, Feb 03, 2022, 2:18 PM UTC

p5v wrote: post #635

What's next? Someone coming after you, because your have their IP in your server logs? I understand the privacy sentiment, but I find this the opposite of how you beat a giant. The proper way for Germany and the rest of Europe should be the creation of a thriving environment of viable, privacy-aware FAANG competitors. Not putting barriers in every which way.

> Someone coming after you, because your have their IP in your server logs?

This is literally the day job for everyone on HN: checking so you don't accidentally log IPs.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#654

Post by shukantpal » Fri, Feb 04, 2022, 3:39 AM UTC

maratc wrote: post #536

shukantpal wrote: post #517

Earlier quoted context omitted.

> Again, you're talking about an opt-out. GPDR (the law) requires an opt-in. It is opt-in. You decided to use a browser that implements the full HTML spec. Just use a basic browser.

"Your honor, the victims of my ransomware attack decided to use a modern CPU to run my code. The attack would not have succeeded have the victims used Z-80, so there's no one to blame but the victims themselves."

Yeah like when you use a browser no where did you literally cause & consent to loading and running stuff.

False analogy.

Ironic that people use this line of reasoning to defend ad blockers (I'm responsible for whatever software I run) but then use the opposite argument when they don't like what the software does.

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#655

Post by southerntofu » Sat, Feb 05, 2022, 11:28 AM UTC

dTal wrote: post #465

derekp7 wrote: post #452

Earlier quoted context omitted.

The web site did no such thing -- it served up a document that contained the reference. It is the end user that CHOSE to delegate interpretation of that document to a web browser (ad a counter example, look at how RMS browses the web). Yes this is less practical. But since the decision only deals with what is "possible", then logically it should be fully consistent. Now from a practical standpoint, I'd like to see a…

It strikes me that this is exactly the same scenario, in reverse, that we have with people being convicted of "hacking" a website by entering a URL that wasn't supposed to be exposed. Things like "consent" and "authorization" are murky when we delegate our will to computer programs like browsers and servers. If URL "hacking" is illegal, then we have decided as a society that persuading a piece of software to do somet…

I strongly disagree with this interpretation. In my view, a person maintaining infrastructure is a position of power and therefore should be held to specific standards in regards to how it treats users.

Users on the other hand are just people. Being a user on a service does not grant you power over other users (not out-of-the-box anyway). Sure you can scan for vulns and/or follow a public link to a top-secret document: in my view that's nothing wrong. Now reverse the situation: why should a remote server administrator dictate the computing performed on your machine?! Is it ethical for some website operators to start scanning your local network?

A service operator knows about threats, hopefully has counter-measures in place, and can always ban you (or specific requests) if it comes to that. A user is mostly helpless, especially when it comes to computations performed by a script you unconsciously downloaded and executed from a server. How many users are aware of what RCE even means and that a web browser with JS enabled is essentially RCE-as-a-service?

Re: GDPR penalty for passing on of IP address to Google by using Google Fonts

#656

Post by southerntofu » Sat, Feb 05, 2022, 11:33 AM UTC

baash05 wrote: post #617

southerntofu wrote: post #413

Earlier quoted context omitted.

> So everyone showing youtube videos would be affected unless users also start agreeing to IP exposure Yes, and that's a good thing! A web page should only communicate with the server i've reached, there should be zero third-party involved unless i explicitly consent. That for example tag can use an arbitrary URL is explained by the fact that back in the day storage/bandwidth was expensive. The same is true for video…

I find that hard to understand. What server have you reached? Many sites are designed to be hosted by many servers at the same time. Sites hosted on Amazon are moved around depending on load and your location. Often you'll get part of the site from server X other bits from server Y.. images and css from an asset server and api data from one of many app servers.

You are correct. I just don't think that's a reasonable state of affairs. If that was part of a p2p model (eg. torrent/IPFS) it could be considered a reasonable tradeoff to allow for more eco-friendly (shorter routes, no need for high-powered servers) retrieval scheme.

Hyperlinks are the foundation of the web. However, when we started loading resources (eg. images) from third parties due to high bandwidth/disk cost, we opened a Pandora's box which i believe does more harm than good.