4 ms·

This goes beyond just identification to actual data leakage, but ties into a larger point about GDPR and other regulations that we've been discussing ad nauseum

This goes beyond just identification to actual data leakage, but ties into a larger point about GDPR and other regulations that we've been discussing ad nauseum here, which is questions like: "Why don't the GDPR regs just tell me what I need to do?" The GDPR being deliberately vague is a response to issues like these, it serves neither the interests of the users or the regulation to say "Get consent before getting cookies and only cookies" only to have sites and services turn around and use methods like this, or: BrowserFingerprinting - https://panopticlick.eff.org/ https://panopticlick.eff.org/ Super/Ever Cookies - https://github.com/samyk/evercookie https://github.com/samyk/evercookie HSTS identification - https://www.owasp.org/index.php/HTTP_Strict_Transport_Security_Cheat_Sheet https://www.owasp.org/index.php/HTTP_Strict_Transport_Securi... or whatever the new sneaky identification via browser features hack happens to be.

cryptonector 8y ago
The whole "tell users we're using cookies" thing is idiotic -- every site uses cookies, and that's fine. The trouble lies not in the site's use of cookies, but in the use of cookies by third-party content providers used by the site. It's the FB, Twitter, and other "like" and "share" buttons that are the problem.
- michaelbuckbee 8y ago
  This is kind of the subtlety that I'm getting at here: what the GDPR says is you need to say how you (as a controller operating a website) are tracking people. Because the minute you throw down a technical rule it's trivial to route around it. Case in point: say you allowed only 1st party cookies (as defined by cross domain browser behavior and cookie setting). I could setup a CNAME for analytics.my-domain.com that points to FB's ad retargeting servers and they could include in the actual cookie data my id, ip or whatever else they'd need to lookup a user's information across domains. Same with IPs: every GDPR discussion devolves into someone saying: "Well every site uses IPs! We have them in our logs, etc.! It's stupid to say that they're personal data" Which is how I thought of them until getting a glimpse into some of the ad networks/bidding where they are treated as more or less a currency for targeting, demographics, etc. With GDPR it's not the data it's what done with the data.
  - cryptonector 8y ago
    I mean, there's nothing wrong with statutes and regulations being worded generally as long as they are not vague. Getting too prescriptive in this particular context would be counterproductive as the technology issues change over time. What GDPR should say: things like "do not allow third-parties to track your users" or "warn users about third-party tracking". That would be exceedingly clear and actionable. Now, "do not allow third-parties to track your users" might require some additional regarding implementation via contractual clauses. For example, if site A uses resources from site B and has a contract with B stipulating non-tracking of A's users, is that good enough? What if B is outside the EU? And so on. But aside from such side issues, "do not allow third-parties to track your users" is trivial to implement: a) only embed resources from third-parties that agree not to track your users, b) do not embed resources from any other third-parties. "Warn users about third-party tracking" is even easier to implement: if you embed resources from third parties, you must warn. > With GDPR it's not the data it's what done with the data. Good! You can use contracts to manage this with all the third-parties you deal with. Now, what about links to [non-embedded] external resources? We must not kill the web.
    - michaelbuckbee 8y ago
      Ok, so you're describing (IMO) exactly what's in the text of the GDPR. Here is a "plain english" translation of the GDPR that makes much of this more evident: https://blog.varonis.com/gdpr-requirements-list-in-plain-english/ https://blog.varonis.com/gdpr-requirements-list-in-plain-eng... If you dig into it, I think you'll find it lines up nicely with what you are suggesting.
  - eli 8y ago
    You can't make a first party cookie work the same as a third party cookie. They wouldn't follow you across sites, which is the whole point of a third party tracking cookie. Facebook wouldn't know it's you visiting a site or know the same person visited site A and site B.
    - michaelbuckbee 8y ago
- deleted 8y ago
  [deleted]
- kawsper 8y ago
  You don't have to warn the users if your cookies are first-party cookies that makes your site function.
TylerE 8y ago
This is a very very good thing. You do not want the government writing technical specifications. They WILL screw it up and we WILL be stuck with it.
- russdpale 8y ago
  Agreed. Also they have been trying to introduce insecure cryptography algorithms that are doing terrible in peer review and they won't detail the weakness of the algo or how to prevent attacks on it. I'm thinking its because they want to know the 0 days and keep it from everyone else.
- jakeogh 8y ago
  Being legally vague is advantageous, it incrementally introduces the idea that power gets to regulate what people remember.

cryptonector 8y ago

The whole "tell users we're using cookies" thing is idiotic -- every site uses cookies, and that's fine. The trouble lies not in the site's use of cookies, but in the use of cookies by third-party content providers used by the site. It's the FB, Twitter, and other "like" and "share" buttons that are the problem.

michaelbuckbee 8y ago
This is kind of the subtlety that I'm getting at here: what the GDPR says is you need to say how you (as a controller operating a website) are tracking people. Because the minute you throw down a technical rule it's trivial to route around it. Case in point: say you allowed only 1st party cookies (as defined by cross domain browser behavior and cookie setting). I could setup a CNAME for analytics.my-domain.com that points to FB's ad retargeting servers and they could include in the actual cookie data my id, ip or whatever else they'd need to lookup a user's information across domains. Same with IPs: every GDPR discussion devolves into someone saying: "Well every site uses IPs! We have them in our logs, etc.! It's stupid to say that they're personal data" Which is how I thought of them until getting a glimpse into some of the ad networks/bidding where they are treated as more or less a currency for targeting, demographics, etc. With GDPR it's not the data it's what done with the data.
- cryptonector 8y ago
  I mean, there's nothing wrong with statutes and regulations being worded generally as long as they are not vague. Getting too prescriptive in this particular context would be counterproductive as the technology issues change over time. What GDPR should say: things like "do not allow third-parties to track your users" or "warn users about third-party tracking". That would be exceedingly clear and actionable. Now, "do not allow third-parties to track your users" might require some additional regarding implementation via contractual clauses. For example, if site A uses resources from site B and has a contract with B stipulating non-tracking of A's users, is that good enough? What if B is outside the EU? And so on. But aside from such side issues, "do not allow third-parties to track your users" is trivial to implement: a) only embed resources from third-parties that agree not to track your users, b) do not embed resources from any other third-parties. "Warn users about third-party tracking" is even easier to implement: if you embed resources from third parties, you must warn. > With GDPR it's not the data it's what done with the data. Good! You can use contracts to manage this with all the third-parties you deal with. Now, what about links to [non-embedded] external resources? We must not kill the web.
  - michaelbuckbee 8y ago
    Ok, so you're describing (IMO) exactly what's in the text of the GDPR. Here is a "plain english" translation of the GDPR that makes much of this more evident: https://blog.varonis.com/gdpr-requirements-list-in-plain-english/ https://blog.varonis.com/gdpr-requirements-list-in-plain-eng... If you dig into it, I think you'll find it lines up nicely with what you are suggesting.
- eli 8y ago
  You can't make a first party cookie work the same as a third party cookie. They wouldn't follow you across sites, which is the whole point of a third party tracking cookie. Facebook wouldn't know it's you visiting a site or know the same person visited site A and site B.
  - michaelbuckbee 8y ago
deleted 8y ago
[deleted]
kawsper 8y ago
You don't have to warn the users if your cookies are first-party cookies that makes your site function.

TylerE 8y ago

This is a very very good thing. You do not want the government writing technical specifications. They WILL screw it up and we WILL be stuck with it.

russdpale 8y ago
Agreed. Also they have been trying to introduce insecure cryptography algorithms that are doing terrible in peer review and they won't detail the weakness of the algo or how to prevent attacks on it. I'm thinking its because they want to know the 0 days and keep it from everyone else.
jakeogh 8y ago
Being legally vague is advantageous, it incrementally introduces the idea that power gets to regulate what people remember.