3 ms·

I'm not quite as technical as you but what do you think of Cloudflare's explanations for why they use cookies for security and load balancing purposes here? ht

I'm not quite as technical as you but what do you think of Cloudflare's explanations for why they use cookies for security and load balancing purposes here? https://developers.cloudflare.com/fundamentals/get-started/reference/cloudflare-cookies/ https://developers.cloudflare.com/fundamentals/get-started/r... The law says cookies that aren't "necessary" are illegal without explicit consent. Perhaps there's room for "necessary" to include cookies that are helpful technically even if not absolutely the only way things could be done.

tomp 4y ago
I'd be very nervous if I was Cloudflare. They pretty explicitly say that the cookies are not strictly necessary for using the websites. > cookies are strictly necessary to provide the services requested by our customers Cloudflare's customers are websites, not users, whereas the latter are protected by Cookie Law / GDPR. That's exactly why Microsoft was fined (according to [1]): > Microsoft argued that detecting ad fraud was "strictly necessary" for running bing.com, but the court disagreed, saying that advertising is not a service requested by the user. (point 53 in the full decision). [1] https://news.ycombinator.com/item?id=34096210 https://news.ycombinator.com/item?id=34096210
- johndhi 4y ago
  Nah, Cloudflare is on pretty solid ground. The data protection authorities' guidance is explicit that load balancing and security-related services are safely considered strictly necessary for websites.
anankaie 4y ago
Every security boundary is about increasing the difficulty of bad actors succeeding in their desired action. The problem with the cookie one is that it cannot be singularly authoritative, in that your decision of "allow" /"disallow" cannot solely depend on the value of the cookie. So to try to construct a way one could do this, the are some constrains on the possibilities: * Deleting the cookie should not improve chances of "allow" * There should not be a magic value of the cookie that is known to improve chances of allow Thus, this should be used as a transient identifier with the TTL set to less than the expected time to discover "good values" to spoof. The fact that the system needs to be able to work in the case of an adversary deleting these cookies (potentially at the cost of hitting more CAPTCHAs than otherwise) means that I cannot honestly call the cookies "essential" in the colloquial meaning of the word. Another poster explained that there are specific carveouts in the law for this situation.

tomp 4y ago

I'd be very nervous if I was Cloudflare. They pretty explicitly say that the cookies are not strictly necessary for using the websites. > cookies are strictly necessary to provide the services requested by our customers Cloudflare's customers are websites, not users, whereas the latter are protected by Cookie Law / GDPR. That's exactly why Microsoft was fined (according to [1]): > Microsoft argued that detecting ad fraud was "strictly necessary" for running bing.com, but the court disagreed, saying that advertising is not a service requested by the user. (point 53 in the full decision). [1] https://news.ycombinator.com/item?id=34096210 https://news.ycombinator.com/item?id=34096210

johndhi 4y ago
Nah, Cloudflare is on pretty solid ground. The data protection authorities' guidance is explicit that load balancing and security-related services are safely considered strictly necessary for websites.

anankaie 4y ago

Every security boundary is about increasing the difficulty of bad actors succeeding in their desired action. The problem with the cookie one is that it cannot be singularly authoritative, in that your decision of "allow" /"disallow" cannot solely depend on the value of the cookie. So to try to construct a way one could do this, the are some constrains on the possibilities: * Deleting the cookie should not improve chances of "allow" * There should not be a magic value of the cookie that is known to improve chances of allow Thus, this should be used as a transient identifier with the TTL set to less than the expected time to discover "good values" to spoof. The fact that the system needs to be able to work in the case of an adversary deleting these cookies (potentially at the cost of hitting more CAPTCHAs than otherwise) means that I cannot honestly call the cookies "essential" in the colloquial meaning of the word. Another poster explained that there are specific carveouts in the law for this situation.