5 ms·

Browsers are really where privacy needs to come from. I know a lot of people have hopes for a legislative solutions, but I think the EU (also UK and others) "c

Browsers are really where privacy needs to come from. I know a lot of people have hopes for a legislative solutions, but I think the EU (also UK and others) "cookie law" really needs to make us consider how effective they can be. The motivation for the law was good. They put their finger in the right place. . We got nag screens and little improvment in privacy. Not every piece of privacy legislation does as little as this, but I still think we need to be wary. Browsers, OTOH, are in a great position to improve user privacy. Maybe instead of letters to parliamentarians, letters to browser makers?

Yaggo 9y ago
> We got nag screens and little improvment in privacy. We definitely got the nag screens¹, but improvement? [1] Which is totally inferior solution technically & ux-wise, because the user/client voluntarily accepts the cookie from the server, and there's already setting for that in the browser.
- lloeki 9y ago
  The nags are only mandated for tracking, cookies are only a implementation detail. The EU directive explicitly mentions that, does not even focus on cookies, and states that cookies (or whatever) pertaining to site operation (such as login/cart/whatever) do not require nagging. Thus the proper browser setting is DNT, not accepting cookies. But everyone construed that cookies <=> nag, because nobody RTFM.
  - dalbasal 9y ago
    I don’t think it’s a RTFM thing. The lawyers RTFM, and this is what they came up with. The legislation called for informed consent. Two core issues were left open to definition, in practice. [1] What requires informed consent? [2] What counts as informed consent. For question 2, a standard answer (nag screen) emerged. Question 1 is trickier. The cheapest & easiest solution is to just nag, so that’s the default. If you want to drop the nag screen you can deal with question 1, but most don’t bother. Either they want the tracking, they want the easiest option or they want legal CYA. I think the legislative intentions were good, but this was a hard area to legislate. It didn’t work, IMO.
Symbiote 9y ago
The biggest browser maker is funded by advertising revenue. I recommend watching the film "Democracy"[1], which showed how an EU data protection law went through the process to become law. The "main character" (chair of the process) was a German MEP. The thing I best remember him saying[2] was in response to some lobbyists, who wanted to know why he was pushing back against their business interests when they were all united. The MEP said he primarily represented the thousands of people in his constituency, even though they couldn't afford to send lobbyists to Brussels. With some stronger wording ("This site shares your data, including the web pages you view and where you click, with the following companies: Google, AdNetwork234, ..., These companies use it to sell advertising to you and may further share your data") the cookie law could have been stronger. The MEP was in the Green party, but most aren't -- pressure from individuals on other MEPs would encourage other, more business-friendly MEPs, to push back against the lobbyists. [1] https://www.theguardian.com/technology/2015/nov/14/democracy-film-european-data-protection-privacy-debate https://www.theguardian.com/technology/2015/nov/14/democracy... [2] I think it was in the film, but I also went to a screening with him giving a talk afterwards.
- ewjordan 9y ago
  We all just click through cookie popups, the specific text doesn't make any difference to 99% of users, if not more. The only thing legislation like that does is make companies pay people like me a little more to implement popups that annoy their users.
  - Retric 9y ago
    It also creates awareness as people who had no idea that cookies existed also receive such pop ups.
    - Cenk 9y ago
      I’d argue it doesn’t do much of that either. No-one reads error messages, and certainly no-one ready cookie notices.
    - jameshart 9y ago
hedning 9y ago
The EU GDPR[1] legislation actually looks good. It includes the right to access your data and the right to be forgotten. It remains to be seen how well it's implemented, but they've really gotten the basics right I think. 1: http://www.eugdpr.org/the-regulation.html http://www.eugdpr.org/the-regulation.html
lloeki 9y ago
> We got nag screens and little improvment in privacy. We could have skipped the nag screens with DNT.
gaius 9y ago
Browsers are really where privacy needs to come from. There's only so much a browser can do against someone who can follow your IP address around. What we really need is ISPs who randomize what the server sees from their pool of IPs and NAT it internally.
- pacala 9y ago
  Or a VPN. Then again, https://en.wikipedia.org/wiki/Device_fingerprint https://en.wikipedia.org/wiki/Device_fingerprint and it's game over again.
  - dx034 9y ago
    browsers could prevent fingerprinting. They could randomize information enough so that they still have the important bits but cannot easily be tracked.
    - tyingq 9y ago
      It is a war of escalation though. You can be tracked via 304 responses and etags, for example. Fixing those client side isn't really practical.
      - enraged_camel 9y ago
        You don't need to prevent tracking completely. You just need to make it enough of a hassle so that it becomes too impractical or too expensive to do at scale.
    - criddell 9y ago
      And then the ISP comes along and adds a super cookie to your traffic. It's ISPs that worry me the most. They see all the places you connect to. Even if you use https, they still know the endpoints.
      - pacala 9y ago

Yaggo 9y ago

> We got nag screens and little improvment in privacy. We definitely got the nag screens¹, but improvement? [1] Which is totally inferior solution technically & ux-wise, because the user/client voluntarily accepts the cookie from the server, and there's already setting for that in the browser.

lloeki 9y ago
The nags are only mandated for tracking, cookies are only a implementation detail. The EU directive explicitly mentions that, does not even focus on cookies, and states that cookies (or whatever) pertaining to site operation (such as login/cart/whatever) do not require nagging. Thus the proper browser setting is DNT, not accepting cookies. But everyone construed that cookies <=> nag, because nobody RTFM.
- dalbasal 9y ago
  I don’t think it’s a RTFM thing. The lawyers RTFM, and this is what they came up with. The legislation called for informed consent. Two core issues were left open to definition, in practice. [1] What requires informed consent? [2] What counts as informed consent. For question 2, a standard answer (nag screen) emerged. Question 1 is trickier. The cheapest & easiest solution is to just nag, so that’s the default. If you want to drop the nag screen you can deal with question 1, but most don’t bother. Either they want the tracking, they want the easiest option or they want legal CYA. I think the legislative intentions were good, but this was a hard area to legislate. It didn’t work, IMO.

Symbiote 9y ago

The biggest browser maker is funded by advertising revenue. I recommend watching the film "Democracy"[1], which showed how an EU data protection law went through the process to become law. The "main character" (chair of the process) was a German MEP. The thing I best remember him saying[2] was in response to some lobbyists, who wanted to know why he was pushing back against their business interests when they were all united. The MEP said he primarily represented the thousands of people in his constituency, even though they couldn't afford to send lobbyists to Brussels. With some stronger wording ("This site shares your data, including the web pages you view and where you click, with the following companies: Google, AdNetwork234, ..., These companies use it to sell advertising to you and may further share your data") the cookie law could have been stronger. The MEP was in the Green party, but most aren't -- pressure from individuals on other MEPs would encourage other, more business-friendly MEPs, to push back against the lobbyists. [1] https://www.theguardian.com/technology/2015/nov/14/democracy-film-european-data-protection-privacy-debate https://www.theguardian.com/technology/2015/nov/14/democracy... [2] I think it was in the film, but I also went to a screening with him giving a talk afterwards.

ewjordan 9y ago
We all just click through cookie popups, the specific text doesn't make any difference to 99% of users, if not more. The only thing legislation like that does is make companies pay people like me a little more to implement popups that annoy their users.
- Retric 9y ago
  It also creates awareness as people who had no idea that cookies existed also receive such pop ups.
  - Cenk 9y ago
    I’d argue it doesn’t do much of that either. No-one reads error messages, and certainly no-one ready cookie notices.
  - jameshart 9y ago

hedning 9y ago

The EU GDPR[1] legislation actually looks good. It includes the right to access your data and the right to be forgotten. It remains to be seen how well it's implemented, but they've really gotten the basics right I think. 1: http://www.eugdpr.org/the-regulation.html http://www.eugdpr.org/the-regulation.html

lloeki 9y ago

> We got nag screens and little improvment in privacy. We could have skipped the nag screens with DNT.

gaius 9y ago

Browsers are really where privacy needs to come from. There's only so much a browser can do against someone who can follow your IP address around. What we really need is ISPs who randomize what the server sees from their pool of IPs and NAT it internally.

pacala 9y ago
Or a VPN. Then again, https://en.wikipedia.org/wiki/Device_fingerprint https://en.wikipedia.org/wiki/Device_fingerprint and it's game over again.
- dx034 9y ago
  browsers could prevent fingerprinting. They could randomize information enough so that they still have the important bits but cannot easily be tracked.
  - tyingq 9y ago
    It is a war of escalation though. You can be tracked via 304 responses and etags, for example. Fixing those client side isn't really practical.
    - enraged_camel 9y ago
      You don't need to prevent tracking completely. You just need to make it enough of a hassle so that it becomes too impractical or too expensive to do at scale.
  - criddell 9y ago
    And then the ISP comes along and adds a super cookie to your traffic. It's ISPs that worry me the most. They see all the places you connect to. Even if you use https, they still know the endpoints.
    - pacala 9y ago