4 ms·

DDoS prevention does not need cookies, though they can certainly be useful to attempt to track honest users. Dishonest ones will prevent cookies from being set

DDoS prevention does not need cookies, though they can certainly be useful to attempt to track honest users. Dishonest ones will prevent cookies from being set in the first place, or, if you only use cookies to mark 'good' sessions, will learn to spoof your cookie. Never rely on your security adversary not doing something to break your security for its efficacy. It is the same thing with KM AntiCheat (which is best handled by the OS, and even then virtualization breaks it) - unlike an antivirus the target user is adversarial to the application. For shopping carts, you can have a season token as a query parameter, like jsessionid used to be for ages. Does not help across browser sessions, but a session cookie would not help there either, much. Not sure why the chat bot would need the cookie. To track across sessions? If so, I would posit that this is no longer anonymous access. The identity of the user is defined as the cookie you use to track her. Edit: Typos. Typos everywhere!

johndhi 4y ago
I'm not quite as technical as you but what do you think of Cloudflare's explanations for why they use cookies for security and load balancing purposes here? https://developers.cloudflare.com/fundamentals/get-started/reference/cloudflare-cookies/ https://developers.cloudflare.com/fundamentals/get-started/r... The law says cookies that aren't "necessary" are illegal without explicit consent. Perhaps there's room for "necessary" to include cookies that are helpful technically even if not absolutely the only way things could be done.
- tomp 4y ago
  I'd be very nervous if I was Cloudflare. They pretty explicitly say that the cookies are not strictly necessary for using the websites. > cookies are strictly necessary to provide the services requested by our customers Cloudflare's customers are websites, not users, whereas the latter are protected by Cookie Law / GDPR. That's exactly why Microsoft was fined (according to [1]): > Microsoft argued that detecting ad fraud was "strictly necessary" for running bing.com, but the court disagreed, saying that advertising is not a service requested by the user. (point 53 in the full decision). [1] https://news.ycombinator.com/item?id=34096210 https://news.ycombinator.com/item?id=34096210
  - johndhi 4y ago
    Nah, Cloudflare is on pretty solid ground. The data protection authorities' guidance is explicit that load balancing and security-related services are safely considered strictly necessary for websites.
- anankaie 4y ago
  Every security boundary is about increasing the difficulty of bad actors succeeding in their desired action. The problem with the cookie one is that it cannot be singularly authoritative, in that your decision of "allow" /"disallow" cannot solely depend on the value of the cookie. So to try to construct a way one could do this, the are some constrains on the possibilities: * Deleting the cookie should not improve chances of "allow" * There should not be a magic value of the cookie that is known to improve chances of allow Thus, this should be used as a transient identifier with the TTL set to less than the expected time to discover "good values" to spoof. The fact that the system needs to be able to work in the case of an adversary deleting these cookies (potentially at the cost of hitting more CAPTCHAs than otherwise) means that I cannot honestly call the cookies "essential" in the colloquial meaning of the word. Another poster explained that there are specific carveouts in the law for this situation.
tomp 4y ago
Technically, a `session_id` in query parameters is just like a cookie (can be used to track you), except that it doesn't persist. I'd consider it a basic feature that if I reload a website, or open it in a new tab, I'm still logged in, the shopping cart is still full, and I see past messages in the chat window. While technically all of the above can be implemented without cookies (in a very user-unfriendly way), it's so below the expected user experience that I'd argue that cookies are strictly necessary for these purposes.
- jakear 4y ago
  IndexedDB/LocalStorage can do all that without relying on the server. The real shame is that Apple has decided IndexedDB is too powerful to allow outside of their walled garden and will auto-delete it after a week or so. Worse still, Service Worker caches are cleared so offline-available websites break after a week. https://stackoverflow.com/questions/50795409/is-indexeddb-on-safari-guaranteed-to-be-persistent#:~:text=According%20to%20this%20blog%20post%20from%20the%20WebKit,of%20Safari%20usage%20without%20interaction%20with%20the%20site%3A https://stackoverflow.com/questions/50795409/is-indexeddb-on...
  - jefftk 4y ago
    The EU cookie law (ePrivacy Directive) isn't specific to cookies. Using local storage does not exempt you from its requirements, and you still need to get consent from users before any use of client side storage that is not strictly necessary to provide a service explicitly requested by the user.
    - jakear 4y ago
      Adding an item to a cart and it persisting is quite directly a service explicitly requested by the user. And if some EU kangaroo court forces me to click through a “clicking add to cart will save this item in your cart, do you agree to performing the action you explicitly just requested” on every website… I cannot.
      - 4y ago

johndhi 4y ago

I'm not quite as technical as you but what do you think of Cloudflare's explanations for why they use cookies for security and load balancing purposes here? https://developers.cloudflare.com/fundamentals/get-started/reference/cloudflare-cookies/ https://developers.cloudflare.com/fundamentals/get-started/r... The law says cookies that aren't "necessary" are illegal without explicit consent. Perhaps there's room for "necessary" to include cookies that are helpful technically even if not absolutely the only way things could be done.

tomp 4y ago
I'd be very nervous if I was Cloudflare. They pretty explicitly say that the cookies are not strictly necessary for using the websites. > cookies are strictly necessary to provide the services requested by our customers Cloudflare's customers are websites, not users, whereas the latter are protected by Cookie Law / GDPR. That's exactly why Microsoft was fined (according to [1]): > Microsoft argued that detecting ad fraud was "strictly necessary" for running bing.com, but the court disagreed, saying that advertising is not a service requested by the user. (point 53 in the full decision). [1] https://news.ycombinator.com/item?id=34096210 https://news.ycombinator.com/item?id=34096210
- johndhi 4y ago
  Nah, Cloudflare is on pretty solid ground. The data protection authorities' guidance is explicit that load balancing and security-related services are safely considered strictly necessary for websites.
anankaie 4y ago
Every security boundary is about increasing the difficulty of bad actors succeeding in their desired action. The problem with the cookie one is that it cannot be singularly authoritative, in that your decision of "allow" /"disallow" cannot solely depend on the value of the cookie. So to try to construct a way one could do this, the are some constrains on the possibilities: * Deleting the cookie should not improve chances of "allow" * There should not be a magic value of the cookie that is known to improve chances of allow Thus, this should be used as a transient identifier with the TTL set to less than the expected time to discover "good values" to spoof. The fact that the system needs to be able to work in the case of an adversary deleting these cookies (potentially at the cost of hitting more CAPTCHAs than otherwise) means that I cannot honestly call the cookies "essential" in the colloquial meaning of the word. Another poster explained that there are specific carveouts in the law for this situation.

tomp 4y ago

Technically, a `session_id` in query parameters is just like a cookie (can be used to track you), except that it doesn't persist. I'd consider it a basic feature that if I reload a website, or open it in a new tab, I'm still logged in, the shopping cart is still full, and I see past messages in the chat window. While technically all of the above can be implemented without cookies (in a very user-unfriendly way), it's so below the expected user experience that I'd argue that cookies are strictly necessary for these purposes.

jakear 4y ago
IndexedDB/LocalStorage can do all that without relying on the server. The real shame is that Apple has decided IndexedDB is too powerful to allow outside of their walled garden and will auto-delete it after a week or so. Worse still, Service Worker caches are cleared so offline-available websites break after a week. https://stackoverflow.com/questions/50795409/is-indexeddb-on-safari-guaranteed-to-be-persistent#:~:text=According%20to%20this%20blog%20post%20from%20the%20WebKit,of%20Safari%20usage%20without%20interaction%20with%20the%20site%3A https://stackoverflow.com/questions/50795409/is-indexeddb-on...
- jefftk 4y ago
  The EU cookie law (ePrivacy Directive) isn't specific to cookies. Using local storage does not exempt you from its requirements, and you still need to get consent from users before any use of client side storage that is not strictly necessary to provide a service explicitly requested by the user.
  - jakear 4y ago
    Adding an item to a cart and it persisting is quite directly a service explicitly requested by the user. And if some EU kangaroo court forces me to click through a “clicking add to cart will save this item in your cart, do you agree to performing the action you explicitly just requested” on every website… I cannot.
    - 4y ago