3 ms·

This article is written like it's a great privacy breakthrough but why is this any different from dropping a user id cookie?

jagged-chisel 4y ago
How do you get more than 86,400 unique “identifiers” when they only change every second?
- toast0 4y ago
  who says Last-Modified has to be a current date? you've got the potential for 1669827111 users as of when I was composing this comment without giving your users future dates.
- koliber 4y ago
  There are also many timezones and you can encode information in the timezone indicator as well. Also, you can use different days. You can stretch this number into millions. For a website that gets a certain number of unique visitors per year, this may be unique enough.
- tedunangst 4y ago
  Subdomains. (Not sure why I immediately thought subdomains and not just multiple resources.)
- WirelessGigabit 4y ago
  You don't have to. A unique visitor is someone who comes in without a last-modified header. Set the header, that person is no longer unique.
- marshray 4y ago
  A malicious site can put a different identifier on every resource loaded by the browser. There really is no bottom, is there.
nine_k 4y ago
It is materially different because it does not track individual users. It's comparable to dropping the same cookie to every visitor on a particular day; a pretty low level of privacy invasion. Also, this allows to not use such things as visitor's IP address to collect meaningful statistics, which is a privacy win for the user, and an accuracy win for the site operator.
- kevincox 4y ago
  Exactly this. It is different from dropping a user id cookie, but equivalent to dropping a cookie hit_count=0, hit_count=1, ...
  - baggy_trough 4y ago
    Seems like the hit_count cookie would be a lot more straightforward.
ChoHag 4y ago
Because it's not called a cookie, eg. in the UK we have biscuits which are therefore not subject to the GDPR. It's not tracking users, it's just a special user-identifying operation.
jamincan 4y ago
User's might block cookies, but this will likely still go through.

jagged-chisel 4y ago

How do you get more than 86,400 unique “identifiers” when they only change every second?

toast0 4y ago
who says Last-Modified has to be a current date? you've got the potential for 1669827111 users as of when I was composing this comment without giving your users future dates.
koliber 4y ago
There are also many timezones and you can encode information in the timezone indicator as well. Also, you can use different days. You can stretch this number into millions. For a website that gets a certain number of unique visitors per year, this may be unique enough.
tedunangst 4y ago
Subdomains. (Not sure why I immediately thought subdomains and not just multiple resources.)
WirelessGigabit 4y ago
You don't have to. A unique visitor is someone who comes in without a last-modified header. Set the header, that person is no longer unique.
marshray 4y ago
A malicious site can put a different identifier on every resource loaded by the browser. There really is no bottom, is there.

nine_k 4y ago

It is materially different because it does not track individual users. It's comparable to dropping the same cookie to every visitor on a particular day; a pretty low level of privacy invasion. Also, this allows to not use such things as visitor's IP address to collect meaningful statistics, which is a privacy win for the user, and an accuracy win for the site operator.

kevincox 4y ago
Exactly this. It is different from dropping a user id cookie, but equivalent to dropping a cookie hit_count=0, hit_count=1, ...
- baggy_trough 4y ago
  Seems like the hit_count cookie would be a lot more straightforward.

ChoHag 4y ago

Because it's not called a cookie, eg. in the UK we have biscuits which are therefore not subject to the GDPR. It's not tracking users, it's just a special user-identifying operation.

jamincan 4y ago

User's might block cookies, but this will likely still go through.