Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Things to know about the GDPR, Mozilla and Firefox

blog.mozilla.org

Post reply on HN
Print view View original

91–100 of 103 posts

Re: Things to know about the GDPR, Mozilla and Firefox

#91

Post by [deleted] »

gkya wrote: post #76
tbranyen wrote: post #51

Earlier quoted context omitted.

This is a terrible use case for cookies. Any browser reset or change, new computer, your phone, etc, and you need to redo the whole experience every time. I'd rather login and customize once. Cookies get sent with most requests as headers so you're unnecessarily bogging down requests with data unrelated to the session.

I don't think a gzipped header with some hundreds of bytes of JSON (or BSON) for preferences is that much bigger than one with a session id string in a cookie.

[deleted]

Re: Things to know about the GDPR, Mozilla and Firefox

#92

Post by daphneokeefe »

athenot wrote: post #41
gcthomas wrote: post #24

Earlier quoted context omitted.

If the data collected is not personally identifying data, then GDPR is not interested in it. Maybe it is PII, but the quoted policies don't say that. > We may also use cookies, device information and IP addresses, along with clear GIFs, cookies and third party services to help us understand in the aggregate how users engage with our products, …

This brings up a interesting point: cookies are not just for user/session identification. Yes that's how the majority of the apps work but instead, it's totally possible to use cookies to customize a site's experience, feature by feature. A cookie for the theme, a cookie for the font prefs, etc. Yet most sites still insist on logging the user in to customize the experience, and rely on some central storage to determi…

A cookie is such a transient data source. Some people regularly purge them all. Some people use more than one device.

I wouldn't bother changing any preferences that disappear every time I clear out my cookies. For starters, I'd have to figure out where on the website the preferences are set -- and if it's in the user profile, well, just save my preferences there.

Re: Things to know about the GDPR, Mozilla and Firefox

#93

Post by ilyanep »

noisem4ker wrote: post #90
ilyanep wrote: post #86

Earlier quoted context omitted.

Wasn't there some website where you could pull a relatively small number of easily accessible prefs from the browser (OS, list of fonts, browser, etc.) and get a nearly uniquely identifying set of facts about someone?

https://panopticlick.eff.org/ ?

Yup, the fingerprinting portion of that was what I had in mind.

Re: Things to know about the GDPR, Mozilla and Firefox

#94

Post by rqs »

tbranyen wrote: post #51
athenot wrote: post #41

Earlier quoted context omitted.

This brings up a interesting point: cookies are not just for user/session identification. Yes that's how the majority of the apps work but instead, it's totally possible to use cookies to customize a site's experience, feature by feature. A cookie for the theme, a cookie for the font prefs, etc. Yet most sites still insist on logging the user in to customize the experience, and rely on some central storage to determi…

This is a terrible use case for cookies. Any browser reset or change, new computer, your phone, etc, and you need to redo the whole experience every time. I'd rather login and customize once. Cookies get sent with most requests as headers so you're unnecessarily bogging down requests with data unrelated to the session.

It can be worked around. For example, you can use those cookies just to initialize the client web browser. Once it's done, the data can be cached inside the localStorage, and the cookie itself can be deleted (Or changed to a marker that tells the server that the client has been customized).

Of course this may require some heavy changes on the client-side code, as the client now must have the ability to apply user's customization locally, but there are benefit: After you done that, then you don't have to read user's customization data from any of your infrastructure every time user reloads your page.

Re: Things to know about the GDPR, Mozilla and Firefox

#95

Post by coffeeiscold »

zerostar07 wrote: post #79
JohnTHaller wrote: post #44

Earlier quoted context omitted.

Just have the browser present the user with the choice on install. ( ) Enable third party cookies. This may allow third party websites to track you across the internet. ( ) Disable third party cookies. This may break some functionality on some websites. It's no more confusing to end users than the endless sets of checkboxes websites have to use for GDRP or the pointless click OK to accept cookies notices.

Yup thats how it should be. Technical solutions are always superior to regulations.

It seems like the regulations help to create an environment conducive to innovation. There is now a strong incentive to solve the problem "a better way". Let's hope it happens!

Re: Things to know about the GDPR, Mozilla and Firefox

#96

Post by JohnTHaller »

coffeeiscold wrote: post #95
zerostar07 wrote: post #79

Earlier quoted context omitted.

Yup thats how it should be. Technical solutions are always superior to regulations.

It seems like the regulations help to create an environment conducive to innovation. There is now a strong incentive to solve the problem "a better way". Let's hope it happens!

Except they don't. If they'd simply legislated that all web browsers have to ask that question, awesome. Instead, they legislated that every business on earth has to explain it to end users and separately ask for consent. So, even if all web browsers were updated to correctly ask for third party cookie permission, every business on earth still needs to do all the expensive hoop jumping.

Re: Things to know about the GDPR, Mozilla and Firefox

#97

Post by trumped »

gkya wrote: post #78
pixellab wrote: post #64

Earlier quoted context omitted.

100% exactly. Cookies are device and moment specific. Whereas a user account can easily save and transport the saved experience/setting anywhere the user wants to access them.

Firefox (and Chrom{e,ium} AFAIK) can sync up your cookies, among other things.

but if you go this route, you have to share them with a third party (Mozilla or Google)?

Re: Things to know about the GDPR, Mozilla and Firefox

#98

Post by gkya »

trumped wrote: post #97
gkya wrote: post #78

Earlier quoted context omitted.

Firefox (and Chrom{e,ium} AFAIK) can sync up your cookies, among other things.

but if you go this route, you have to share them with a third party (Mozilla or Google)?

Yes, but Firefox's Sync is open source [1], so you should be able to set up a private instance. IDK how easy or hard it is though.

[1] https://wiki.mozilla.org/CloudServices/Sync

Re: Things to know about the GDPR, Mozilla and Firefox

#99

Post by Anthony-G »

gkya wrote: post #98
trumped wrote: post #97

Earlier quoted context omitted.

but if you go this route, you have to share them with a third party (Mozilla or Google)?

Yes, but Firefox's Sync is open source [1], so you should be able to set up a private instance. IDK how easy or hard it is though. [1] https://wiki.mozilla.org/CloudServices/Sync

Thanks for the suggestion. That wiki page brought me to https://mozilla-services.readthedocs.io/en/latest/howtos/run... which I intend to try out. I want to migrate my a Firefox profile from Windows to Linux and synching seems to be the easiest way to transfer bookmarks and saved passwords.

Re: Things to know about the GDPR, Mozilla and Firefox

#100

Post by Sylos »

kuschku wrote: post #66
gcp wrote: post #52

Earlier quoted context omitted.

https://bugzilla.mozilla.org/show_bug.cgi?id=697436#c14 "GA also doesn't track IPs or store PII within the tool."

Still requires that they inform the user, with the Cookie Notice soft-consent (or whatever the new ePrivacy directive will replace that with soon).

If the Cookie does not track PII, then you don't need such a banner. Cookies used for logins are excluded as well. 99% of web publishers went completely over board with Cookie banners, because they did not understand the law.
Post reply on HN