4 ms·

I know how to solve their problem. If they only use cookies for the reason written here (to remember preferences) they should not need to store any cookies as s

I know how to solve their problem. If they only use cookies for the reason written here (to remember preferences) they should not need to store any cookies as soon as I just visit their site and therefore they should not need to show any annoying text about cookies until I change any preferences. But for some reason they did send two cookies to me when I just visited the site without doing anything. And "because other sites do it" is not enough reason to use cookies.

0xfaded 6y ago
Or, it would just be safer to put up the cookie banner to avoid confrontation with others without such a nuianced understanding of the cookie law. I could imagine cookies being implemented by the browser in the same way that webcam permission is requested. Something along the lines of "this website is requesting to store cookie "domain;X with purposes Y". This would make setting millions of cookies a UX sin, and cookies would only be set on predictable user interactions such as logging in. Unfortunately the definitions of "purpose" will still need to be defined by regulation to be enforceable. Once you can identify a user, there's no technical limitation that can prevent tracking.
- dogma1138 6y ago
  It used to be the case I distinctly remember IE during the Windows 95 era and maybe 98 as well popping up questions asking you if you want to accept cookies. The whole cookies acceptance pop up was also in the original cookies spec somewhere down the line browsers stopped asking mostly due to the fact that sites got dependent on cookies more and more especially in the early days where there was little to no session management on the server side so you had to either use cookies to store all the state information or encode it into the URL and have your CGI script parse through it.
  - marcodave 6y ago
    I was there, and it was one of the first thing for which you clicked in the "yes and don't bother anymore" tick to make the dialog silent in the future. It was kinda pointless back then, but also there was no data protection law, and data collection and profiling was not a thing. So, what if those dialogs would come back? Maybe with a more user friendly UI to accept site's ad tracking cookies or not, and remember the choice for the future? Would user care about them? would browser vendors care about them? would sites acknowledge the choice made?
robalni 6y ago
I looked a bit closer at their cookies. The two cookies that they send are called "__cfduid" and "tdukey". Both of them look like hash values. __cfduid seems very random. It changes every time I reload the page. tdukey stays the same. Even when I remove it or use a different browser it comes back to the same value. When I connect through Tor it gets a different value. When I click "new circuit" in Tor it changes to a different value. So it looks like this cookie is a hash of the IP address you connect from.
- dogma1138 6y ago
  __cfduid is a CloudFlare cookie it’s a randomized hash of your IP address to prevent it from being blocked by other users on the same address. https://support.cloudflare.com/hc/en-us/articles/200170156-Understanding-the-Cloudflare-Cookies#12345682 https://support.cloudflare.com/hc/en-us/articles/200170156-U... TDUkey is likely the one that holds the persistent IP value hash for the randomized one to work correctly.

0xfaded 6y ago

Or, it would just be safer to put up the cookie banner to avoid confrontation with others without such a nuianced understanding of the cookie law. I could imagine cookies being implemented by the browser in the same way that webcam permission is requested. Something along the lines of "this website is requesting to store cookie "domain;X with purposes Y". This would make setting millions of cookies a UX sin, and cookies would only be set on predictable user interactions such as logging in. Unfortunately the definitions of "purpose" will still need to be defined by regulation to be enforceable. Once you can identify a user, there's no technical limitation that can prevent tracking.

dogma1138 6y ago
It used to be the case I distinctly remember IE during the Windows 95 era and maybe 98 as well popping up questions asking you if you want to accept cookies. The whole cookies acceptance pop up was also in the original cookies spec somewhere down the line browsers stopped asking mostly due to the fact that sites got dependent on cookies more and more especially in the early days where there was little to no session management on the server side so you had to either use cookies to store all the state information or encode it into the URL and have your CGI script parse through it.
- marcodave 6y ago
  I was there, and it was one of the first thing for which you clicked in the "yes and don't bother anymore" tick to make the dialog silent in the future. It was kinda pointless back then, but also there was no data protection law, and data collection and profiling was not a thing. So, what if those dialogs would come back? Maybe with a more user friendly UI to accept site's ad tracking cookies or not, and remember the choice for the future? Would user care about them? would browser vendors care about them? would sites acknowledge the choice made?

robalni 6y ago

I looked a bit closer at their cookies. The two cookies that they send are called "__cfduid" and "tdukey". Both of them look like hash values. __cfduid seems very random. It changes every time I reload the page. tdukey stays the same. Even when I remove it or use a different browser it comes back to the same value. When I connect through Tor it gets a different value. When I click "new circuit" in Tor it changes to a different value. So it looks like this cookie is a hash of the IP address you connect from.

dogma1138 6y ago
__cfduid is a CloudFlare cookie it’s a randomized hash of your IP address to prevent it from being blocked by other users on the same address. https://support.cloudflare.com/hc/en-us/articles/200170156-Understanding-the-Cloudflare-Cookies#12345682 https://support.cloudflare.com/hc/en-us/articles/200170156-U... TDUkey is likely the one that holds the persistent IP value hash for the randomized one to work correctly.