2 ms·

+1 for teaching lawmakers how to achieve their goals at the protocol layer. Imagine how much better the web would be if cookie consent was a browser protocol o

+1 for teaching lawmakers how to achieve their goals at the protocol layer. Imagine how much better the web would be if cookie consent was a browser protocol on top of HTTP headers. This is the Obviously Correct solution, they just needed to work with browser vendors to make it happen. I’d rather you have websites support a generic cryptographically-secure claim schema for ages (implementable in any signed token the browser can emit) than actually check everyone’s identity.

AdamJacobMuller 4y ago
They would never do this, because, cookie consent only "works" by making it much harder to opt out than to just "accept all"
drdaeman 4y ago
> Imagine how much better the web would be if cookie consent was a browser protocol on top of HTTP headers. Imagine how much better the web would be if the browsers would have a built-in ability to accept or reject cookies on a per-site basis... oh, wait, they do. And had that since forever (or at least IE5). Almost no one used that because it was obnoxious to have a popup on every website. So browser vendors moved those settings to the farthest corners of the most obscure configuration dialogs... and then the politicians brought those prompts back (but in a crappy, non-standardized, not-even-working way).
- theptip 4y ago
  Right, but to be clear the cookie consent thing was about purpose limitation, not blocking all cookies outright. The idea was that core functionality shouldn’t break if you block unnecessary tracking, which the old cookie blockers couldn’t achieve, which was why politicians got involved in the first place. Great idea, terrible implementation.
  - drdaeman 4y ago
    P3P also existed, but no one had any respect for it beyond sending it fake policies to get their third-party cookies enabled.
freedomben 4y ago
> Imagine how much better the web would be if cookie consent was a browser protocol on top of HTTP headers. This is the Obviously Correct solution, they just needed to work with browser vendors to make it happen. This is a great idea, and it doesn't seem like we need lawmakers to do anything about it. If browsers implemented this, websites could start using it right?
- theptip 4y ago
  It’s a good point, I don’t know. My guess is the regulations require the website to ask for consent in a way that precludes browsers doing this, but that is a total guess. Also the sites have a disincentive to make it easier; most people just click through because it’s annoying. The sites want you to do that; they don’t want to make it easier.

AdamJacobMuller 4y ago

They would never do this, because, cookie consent only "works" by making it much harder to opt out than to just "accept all"

drdaeman 4y ago

> Imagine how much better the web would be if cookie consent was a browser protocol on top of HTTP headers. Imagine how much better the web would be if the browsers would have a built-in ability to accept or reject cookies on a per-site basis... oh, wait, they do. And had that since forever (or at least IE5). Almost no one used that because it was obnoxious to have a popup on every website. So browser vendors moved those settings to the farthest corners of the most obscure configuration dialogs... and then the politicians brought those prompts back (but in a crappy, non-standardized, not-even-working way).

theptip 4y ago
Right, but to be clear the cookie consent thing was about purpose limitation, not blocking all cookies outright. The idea was that core functionality shouldn’t break if you block unnecessary tracking, which the old cookie blockers couldn’t achieve, which was why politicians got involved in the first place. Great idea, terrible implementation.
- drdaeman 4y ago
  P3P also existed, but no one had any respect for it beyond sending it fake policies to get their third-party cookies enabled.

freedomben 4y ago

> Imagine how much better the web would be if cookie consent was a browser protocol on top of HTTP headers. This is the Obviously Correct solution, they just needed to work with browser vendors to make it happen. This is a great idea, and it doesn't seem like we need lawmakers to do anything about it. If browsers implemented this, websites could start using it right?

theptip 4y ago
It’s a good point, I don’t know. My guess is the regulations require the website to ask for consent in a way that precludes browsers doing this, but that is a total guess. Also the sites have a disincentive to make it easier; most people just click through because it’s annoying. The sites want you to do that; they don’t want to make it easier.