Things to know about the GDPR, Mozilla and Firefox • Hacker News Board

Re: Things to know about the GDPR, Mozilla and Firefox

#81

Post by Boulth » Fri, May 25, 2018, 4:55 PM UTC

athenot wrote: post #41

gcthomas wrote: post #24

Earlier quoted context omitted.

If the data collected is not personally identifying data, then GDPR is not interested in it. Maybe it is PII, but the quoted policies don't say that. > We may also use cookies, device information and IP addresses, along with clear GIFs, cookies and third party services to help us understand in the aggregate how users engage with our products, …

This brings up a interesting point: cookies are not just for user/session identification. Yes that's how the majority of the apps work but instead, it's totally possible to use cookies to customize a site's experience, feature by feature. A cookie for the theme, a cookie for the font prefs, etc. Yet most sites still insist on logging the user in to customize the experience, and rely on some central storage to determi…

An example of what you describe is duckduckgo.com, cookie contain preferences without any user identifiers.

Re: Things to know about the GDPR, Mozilla and Firefox

#82

Post by inetknght » Fri, May 25, 2018, 5:57 PM UTC

pixellab wrote: post #64

tbranyen wrote: post #51

Earlier quoted context omitted.

This is a terrible use case for cookies. Any browser reset or change, new computer, your phone, etc, and you need to redo the whole experience every time. I'd rather login and customize once. Cookies get sent with most requests as headers so you're unnecessarily bogging down requests with data unrelated to the session.

100% exactly. Cookies are device and moment specific. Whereas a user account can easily save and transport the saved experience/setting anywhere the user wants to access them.

I specifically do not want to have the same experience on multiple devices.

I do not want to have the same experience on my work computer vs my home computer.

I do not want to have the same experience on my home computer vs my personal phone.

I do not want to have the same experience on my personal phone vs my work phone.

I do not want to have the same experience on my work phone vs my work computer.

Re: Things to know about the GDPR, Mozilla and Firefox

#83

Post by inetknght » Fri, May 25, 2018, 5:59 PM UTC

tbranyen wrote: post #51

athenot wrote: post #41

Earlier quoted context omitted.

This brings up a interesting point: cookies are not just for user/session identification. Yes that's how the majority of the apps work but instead, it's totally possible to use cookies to customize a site's experience, feature by feature. A cookie for the theme, a cookie for the font prefs, etc. Yet most sites still insist on logging the user in to customize the experience, and rely on some central storage to determi…

This is a terrible use case for cookies. Any browser reset or change, new computer, your phone, etc, and you need to redo the whole experience every time. I'd rather login and customize once. Cookies get sent with most requests as headers so you're unnecessarily bogging down requests with data unrelated to the session.

I am struggling to understand how it is bogging down requests with data that are "unrelated" to the session.

Cookies are delivered with the request. If it has feature selections, great, no more work necessary on your part.

If the feature selection is hidden behind a user ID, then you need to look up the user ID in a database and then request the user's features.

Indeed, it seems to me that requiring a login in order to customize the viewing experience is what bogs down requests.

Re: Things to know about the GDPR, Mozilla and Firefox

#84

Post by icebraining » Fri, May 25, 2018, 5:59 PM UTC

kuschku wrote: post #65

icebraining wrote: post #47

Earlier quoted context omitted.

Are you accounting for the fact that Mozilla has a special contract with Google regarding the use of Analytics? https://bugzilla.mozilla.org/show_bug.cgi?id=697436#c14

Yes. That still requires at least a cookie notice in any case. But Mozilla doesn’t have that, and merely has a tiny grey-on-grey 10px tall "Privacy Policy" link in about:addons.

But a cookie notice is not part of the GDPR, right?

Re: Things to know about the GDPR, Mozilla and Firefox

#85

Post by icebraining » Fri, May 25, 2018, 6:04 PM UTC

grey_earthling wrote: post #73

paublyrne wrote: post #43

Earlier quoted context omitted.

After completing our mandatory and very boring GDPR training at work, I can tell you that it's Mozilla :)

OK. Can you tl;dr for me why that is? Is it because I've asked Mozilla to show me a web page, and the data collection happens as an automatic result of that?

Yes, you asked Mozilla for the web page, and they decided to load Google Analytics.

Mozilla is the Data Controller, and they asked a third-party (Google Analytics) to process the data of Mozilla's users (that includes simple visitors to the site), making Google a Data Processor. The Data Controllers generally have more obligations than Processors, since they control how the data is handled, and to whom it's passed.

Re: Things to know about the GDPR, Mozilla and Firefox

#86

Post by ilyanep » Fri, May 25, 2018, 6:06 PM UTC

solarkraft wrote: post #75

ReidZB wrote: post #60

Earlier quoted context omitted.

"User-interface customization" cookies are actually explicitly exempt from EU consent requirements: http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm I believe they should not be affected by GDPR either, since they're not actually identifying a person.

Yet you could use them to do that once there is a significantly high amount of customised settings ...

Wasn't there some website where you could pull a relatively small number of easily accessible prefs from the browser (OS, list of fonts, browser, etc.) and get a nearly uniquely identifying set of facts about someone?

Re: Things to know about the GDPR, Mozilla and Firefox

#87

Post by kadenshep » Fri, May 25, 2018, 6:09 PM UTC

diego_moita wrote: post #58

kadenshep wrote: post #38

GDPR is the best thing to have happened to the internet in a long while.

I downvoted because your comment doesn't add anything to the discussion and, in the context of this post, looks a bit like trolling. There are people that like and do not like the GDPR. Telling that you belong to one group is not even information.

I'm stating an affirmative position. You wrote two paragraphs explaining why you clicked a button because you don't think my post adds anything to the discussion, or is somehow trolling.

Re: Things to know about the GDPR, Mozilla and Firefox

#88

Post by Bromskloss » Fri, May 25, 2018, 6:12 PM UTC

athenot wrote: post #41

gcthomas wrote: post #24

Earlier quoted context omitted.

If the data collected is not personally identifying data, then GDPR is not interested in it. Maybe it is PII, but the quoted policies don't say that. > We may also use cookies, device information and IP addresses, along with clear GIFs, cookies and third party services to help us understand in the aggregate how users engage with our products, …

This brings up a interesting point: cookies are not just for user/session identification. Yes that's how the majority of the apps work but instead, it's totally possible to use cookies to customize a site's experience, feature by feature. A cookie for the theme, a cookie for the font prefs, etc. Yet most sites still insist on logging the user in to customize the experience, and rely on some central storage to determi…

Then, there are those who go in the opposite direction and store all session information in the URL!

Re: Things to know about the GDPR, Mozilla and Firefox

#89

Post by kuschku » Fri, May 25, 2018, 6:23 PM UTC

icebraining wrote: post #84

kuschku wrote: post #65

Earlier quoted context omitted.

Yes. That still requires at least a cookie notice in any case. But Mozilla doesn’t have that, and merely has a tiny grey-on-grey 10px tall "Privacy Policy" link in about:addons.

But a cookie notice is not part of the GDPR, right?

The notice not, the requirement is.

Re: Things to know about the GDPR, Mozilla and Firefox

#90

Post by noisem4ker » Fri, May 25, 2018, 6:25 PM UTC

ilyanep wrote: post #86

solarkraft wrote: post #75

Earlier quoted context omitted.

Yet you could use them to do that once there is a significantly high amount of customised settings ...

Wasn't there some website where you could pull a relatively small number of easily accessible prefs from the browser (OS, list of fonts, browser, etc.) and get a nearly uniquely identifying set of facts about someone?

https://panopticlick.eff.org/ ?