5 ms·

This interface should be all handled by the browser. It was a mistake not to do this. It makes no sense that blocking cookies should be done via inconststent an

This interface should be all handled by the browser. It was a mistake not to do this. It makes no sense that blocking cookies should be done via inconststent and dubious interfaces implemented by the websites themselves. Much better that the law would specify minimum standards for browser interfaces to make those choices (which btw would be trivially implemented, vs forcing the sites to spend time and money to implement a shitty js pop-up). Plus you are assured that cookies are really blocked. As for server-side fingerprinting, the browser, upon the user's choice, would send the allow/deny information to the website, which is forced by law to honor it (as it is today).

joekrill 6y ago
This is a very naive response. Rarely is anything "trivially implemented". And if it's so trivially implemented, why haven't we seen a browser vendor implement something already? Websites have been circumventing attempts to prevent fingerprinting for a long, long time. To act like this is some simple task is hugely misleading.
- gameswithgo 6y ago
  Old man programmer here. I also think it is trivially implemented. What is hard is having the world agree to and craft such a standard.
  - kergonath 6y ago
    Young person programmer here. There are a couple of privacy-oriented browsers. If it were really trivial, it’d have been implemented already. Just look at the cat and mouse game between Apple and advertisers around Safari, and the new fingerprinting techniques that show up every now and then. Not much is trivial in web browsers. There is zero need for standards, which won’t happen anyway because of the power Google has with Chrome.
    - _jal 6y ago
      I think you didn't understand the proposition. Browser authors cannot unilaterally implement a proposal that has server-side and legislative components.
      - kergonath 6y ago
        We cannot rely on server-side protections, because the people who control the servers are often acting against us. Standards won't change that; the linked article is about how website go against a law. We know what change a standard and gentleman's agreement can bring. We've seen it with Do not Track. The only protections we can have right now are client-side.
- sigwinch28 6y ago
  1) Implement the Do-Not-Track header on the client side 2) Pass a law making it illegal for a company with business in the EU to not honor a Do-Not-Track header, with a transition period of several years. Step 1 is technically very easy. Step 2 is legislative.
- andrepd 6y ago
  I think you may have misunderstood my comment. I meant that the "consent forms" should be a browser-side feature, consistent across websites and such that things like cookie blocking are guaranteed to be honoured. This is trivial. Things like server-side fingerprinting must be enforced through legislation, e.g. it's against the law to track users if they've selected not to in the consent form.
wjdp 6y ago
How can a browser differentiate between a first-party cookie needed for login and a first-party cookie for tracking? It's legal to use cookies for behaviour such as login which is necessary but you need consent for tracking. If a browser blocked all cookies until the user turned them on you'd have the choice of "no login" or "login works, but so does all the tracking". Not saying the current state of affairs is good, it's awful.
- _puk 6y ago
  If we're going down the route of regulation, and browser control, would it be a step too far to require standardised metadata in a cookie? That way, each cookie could describe itself as login, tracking, optional functionality etc. You can then penalise on cookies that purposefully violate this, and allow the user to centrally opt in or out of each type.
  - wjdp 6y ago
    Aha, place trust in the site to label their cookies correctly? I see you've covered that with penalising sites who mislabel. Who maintains this list? If it's the browser vendor remember which company owns the largest share in this market.
- saagarjha 6y ago
  The evil bit is currently little used, I suggest repurposing that: https://en.wikipedia.org/wiki/Evil_bit https://en.wikipedia.org/wiki/Evil_bit
  - qwerty456127 6y ago
    "Evil" is subjective and too broad (most of it has already been outlawed anyway and that works: e.g. a competing business is going to think twice before DDoSing you as they know they are doomed if that gets discovered and proven). Surveillance, however, is a much more specific thing. Stalking people already is illegal for people, it should also be made illegal for companies.
- tgsovlerkhgsel 6y ago
Guest0918231 6y ago
I agree with the browser implementation. Automatically blocking the cookies will likely not work because sites frequently combine tracking and required cookies. 1. When the user starts the browser for the first time, ask if they want to allow tracking cookies on all websites. 2. When the user visits a website, pass that tracking answer as true or false. Firefox and Chrome have buttons beside the URL already for 'Site Settings'. Allow users to override their global tracking setting with a per site settings there. This would be infinitely better than the mess we have now, where every website gives us a pop-up with an intentionally confusing interface. Why can't I say 'No' to tracking once? Why do I need to do it countless times a day, each time navigating a new and confusing interface?
- chriswarbo 6y ago
  > When the user starts the browser for the first time, ask if they want to allow tracking cookies on all websites. Would it be legal/ethical to allow automated pre-commitment to all terms and conditions that nefarious sites may choose to scatter around their pages, many of which won't have been written until after the user had ticked this "agree to everything" box? > every website gives us a pop-up with an intentionally confusing interface Any site doing this is breaking the law. Report them please. > Why can't I say 'No' to tracking once? Because sites which track you don't want it. After all, they're the ones who invented "cookie banners"; and they could choose to get rid of them by just, you know, not tracking people. Yet they don't.
  - Guest0918231 6y ago
    > Would it be legal/ethical to allow automated pre-commitment to all terms and conditions that nefarious sites may choose to scatter around their pages, many of which won't have been written until after the user had ticked this "agree to everything" box? Isn't everyone 'agreeing to everything' outside of the GDPR when they visit sites now, without the option of saying 'no'? Isn't everyone covered by GDPR being tricked into 'agreeing to everything' at the moment? Giving users the ability to disable the tracking aspect across all sites with one simple setting seems like a plus here. > Any site doing this is breaking the law. Report them please. Has any action been taken against a site for making their opt-out option more complicated than their opt-in option? Why try to regulate how millions of sites prompt users for consent instead of a few browsers? > Because sites which track you don't want it. After all, they're the ones who invented "cookie banners"; and they could choose to get rid of them by just, you know, not tracking people. Yet they don't. They didn't invent cookie banners, they added them because they were required by law. The same law could remove cookie banners and require the sites to respect a browser cookie.
chriswarbo 6y ago
From the technical side: We had this ( https://en.wikipedia.org/wiki/P3P https://en.wikipedia.org/wiki/P3P ). It didn't catch on. > It makes no sense that blocking cookies should be done via inconststent and dubious interfaces implemented by the websites themselves. It also makes no sense that authentication should be done via inconsistent and dubious interfaces implemented by the websites themselves. Browsers have offered login prompts for years, yet they're usually avoided. Some sites hijack scrollbars, so it's not particularly surprising. From the legal side: GDPR is not about "cookie banners". It's perfectly fine to use cookies, or any other personal/tracking data, if the user's consent is implied. For example login sessions, shopping carts, game highscores, etc. would break without cookies or something equivalent, and those are features that users want, so we can assume their implicit consent for such cookies. GDPR is perfectly unobtrusive (for end users, at least). On the other hand, users don't want to be tracked and surveilled. Hence anyone collecting personal data for those reasons cannot assume implicit consent. The choice is simple: either stop doing it, or ask for explicit consent. If you're seeing obnoxious "cookie banners", it's because the operators of those sites would rather mess up their UX with annoying crap, rather than entertain the idea of not being a creepy stalker. From a pragmatic point of view, making it easier (or even automatic!) for users to give up their rights, in a blanket way to anyone who asks them to, just so unscrupulous corporations don't have to experience negative repercussions of their user-hostile decisions, would seem to defeat the whole point of GDPR. If you don't want to see "cookie banners", ask the site operators to stop being creeps; that way, they wouldn't need to ask.
qwerty456127 6y ago
> This interface should be all handled by the browser. It was a mistake not to do this. It makes no sense that blocking cookies should be done via inconststent and dubious interfaces implemented by the websites themselves. I 1000% agree. And usability is not the only reason. I would also name the obvious responsibility delegation/abstraction principle and the original semantic concept of a web site: 1. the functionality every website is meant to have should be implemented at the browser level 2. no website (those using tracking elements included) should be required to have interactive elements (like the consent button) or off-topic texts (like the cookie notification).

joekrill 6y ago

This is a very naive response. Rarely is anything "trivially implemented". And if it's so trivially implemented, why haven't we seen a browser vendor implement something already? Websites have been circumventing attempts to prevent fingerprinting for a long, long time. To act like this is some simple task is hugely misleading.

gameswithgo 6y ago
Old man programmer here. I also think it is trivially implemented. What is hard is having the world agree to and craft such a standard.
- kergonath 6y ago
  Young person programmer here. There are a couple of privacy-oriented browsers. If it were really trivial, it’d have been implemented already. Just look at the cat and mouse game between Apple and advertisers around Safari, and the new fingerprinting techniques that show up every now and then. Not much is trivial in web browsers. There is zero need for standards, which won’t happen anyway because of the power Google has with Chrome.
  - _jal 6y ago
    I think you didn't understand the proposition. Browser authors cannot unilaterally implement a proposal that has server-side and legislative components.
    - kergonath 6y ago
      We cannot rely on server-side protections, because the people who control the servers are often acting against us. Standards won't change that; the linked article is about how website go against a law. We know what change a standard and gentleman's agreement can bring. We've seen it with Do not Track. The only protections we can have right now are client-side.
sigwinch28 6y ago
1) Implement the Do-Not-Track header on the client side 2) Pass a law making it illegal for a company with business in the EU to not honor a Do-Not-Track header, with a transition period of several years. Step 1 is technically very easy. Step 2 is legislative.
andrepd 6y ago
I think you may have misunderstood my comment. I meant that the "consent forms" should be a browser-side feature, consistent across websites and such that things like cookie blocking are guaranteed to be honoured. This is trivial. Things like server-side fingerprinting must be enforced through legislation, e.g. it's against the law to track users if they've selected not to in the consent form.

wjdp 6y ago

How can a browser differentiate between a first-party cookie needed for login and a first-party cookie for tracking? It's legal to use cookies for behaviour such as login which is necessary but you need consent for tracking. If a browser blocked all cookies until the user turned them on you'd have the choice of "no login" or "login works, but so does all the tracking". Not saying the current state of affairs is good, it's awful.

_puk 6y ago
If we're going down the route of regulation, and browser control, would it be a step too far to require standardised metadata in a cookie? That way, each cookie could describe itself as login, tracking, optional functionality etc. You can then penalise on cookies that purposefully violate this, and allow the user to centrally opt in or out of each type.
- wjdp 6y ago
  Aha, place trust in the site to label their cookies correctly? I see you've covered that with penalising sites who mislabel. Who maintains this list? If it's the browser vendor remember which company owns the largest share in this market.
saagarjha 6y ago
The evil bit is currently little used, I suggest repurposing that: https://en.wikipedia.org/wiki/Evil_bit https://en.wikipedia.org/wiki/Evil_bit
- qwerty456127 6y ago
  "Evil" is subjective and too broad (most of it has already been outlawed anyway and that works: e.g. a competing business is going to think twice before DDoSing you as they know they are doomed if that gets discovered and proven). Surveillance, however, is a much more specific thing. Stalking people already is illegal for people, it should also be made illegal for companies.
tgsovlerkhgsel 6y ago

Guest0918231 6y ago

I agree with the browser implementation. Automatically blocking the cookies will likely not work because sites frequently combine tracking and required cookies. 1. When the user starts the browser for the first time, ask if they want to allow tracking cookies on all websites. 2. When the user visits a website, pass that tracking answer as true or false. Firefox and Chrome have buttons beside the URL already for 'Site Settings'. Allow users to override their global tracking setting with a per site settings there. This would be infinitely better than the mess we have now, where every website gives us a pop-up with an intentionally confusing interface. Why can't I say 'No' to tracking once? Why do I need to do it countless times a day, each time navigating a new and confusing interface?

chriswarbo 6y ago
> When the user starts the browser for the first time, ask if they want to allow tracking cookies on all websites. Would it be legal/ethical to allow automated pre-commitment to all terms and conditions that nefarious sites may choose to scatter around their pages, many of which won't have been written until after the user had ticked this "agree to everything" box? > every website gives us a pop-up with an intentionally confusing interface Any site doing this is breaking the law. Report them please. > Why can't I say 'No' to tracking once? Because sites which track you don't want it. After all, they're the ones who invented "cookie banners"; and they could choose to get rid of them by just, you know, not tracking people. Yet they don't.
- Guest0918231 6y ago
  > Would it be legal/ethical to allow automated pre-commitment to all terms and conditions that nefarious sites may choose to scatter around their pages, many of which won't have been written until after the user had ticked this "agree to everything" box? Isn't everyone 'agreeing to everything' outside of the GDPR when they visit sites now, without the option of saying 'no'? Isn't everyone covered by GDPR being tricked into 'agreeing to everything' at the moment? Giving users the ability to disable the tracking aspect across all sites with one simple setting seems like a plus here. > Any site doing this is breaking the law. Report them please. Has any action been taken against a site for making their opt-out option more complicated than their opt-in option? Why try to regulate how millions of sites prompt users for consent instead of a few browsers? > Because sites which track you don't want it. After all, they're the ones who invented "cookie banners"; and they could choose to get rid of them by just, you know, not tracking people. Yet they don't. They didn't invent cookie banners, they added them because they were required by law. The same law could remove cookie banners and require the sites to respect a browser cookie.

chriswarbo 6y ago

From the technical side: We had this ( https://en.wikipedia.org/wiki/P3P https://en.wikipedia.org/wiki/P3P ). It didn't catch on. > It makes no sense that blocking cookies should be done via inconststent and dubious interfaces implemented by the websites themselves. It also makes no sense that authentication should be done via inconsistent and dubious interfaces implemented by the websites themselves. Browsers have offered login prompts for years, yet they're usually avoided. Some sites hijack scrollbars, so it's not particularly surprising. From the legal side: GDPR is not about "cookie banners". It's perfectly fine to use cookies, or any other personal/tracking data, if the user's consent is implied. For example login sessions, shopping carts, game highscores, etc. would break without cookies or something equivalent, and those are features that users want, so we can assume their implicit consent for such cookies. GDPR is perfectly unobtrusive (for end users, at least). On the other hand, users don't want to be tracked and surveilled. Hence anyone collecting personal data for those reasons cannot assume implicit consent. The choice is simple: either stop doing it, or ask for explicit consent. If you're seeing obnoxious "cookie banners", it's because the operators of those sites would rather mess up their UX with annoying crap, rather than entertain the idea of not being a creepy stalker. From a pragmatic point of view, making it easier (or even automatic!) for users to give up their rights, in a blanket way to anyone who asks them to, just so unscrupulous corporations don't have to experience negative repercussions of their user-hostile decisions, would seem to defeat the whole point of GDPR. If you don't want to see "cookie banners", ask the site operators to stop being creeps; that way, they wouldn't need to ask.

qwerty456127 6y ago

> This interface should be all handled by the browser. It was a mistake not to do this. It makes no sense that blocking cookies should be done via inconststent and dubious interfaces implemented by the websites themselves. I 1000% agree. And usability is not the only reason. I would also name the obvious responsibility delegation/abstraction principle and the original semantic concept of a web site: 1. the functionality every website is meant to have should be implemented at the browser level 2. no website (those using tracking elements included) should be required to have interactive elements (like the consent button) or off-topic texts (like the cookie notification).