4 ms·

Every time I hear this cookie debate, I feel I must be missing something. If you don't want to be tracked. TURN. COOKIES. OFF. There is a reason all web brows

Every time I hear this cookie debate, I feel I must be missing something. If you don't want to be tracked. TURN. COOKIES. OFF. There is a reason all web browsers come with per-domain cookies policies. We don't need a cookie law. We need some common sense. Everyone is looking to make this someone else's responsibility. Guess what: Your digital security and privacy is your responsibility. I hate this entire debate because: 1) Cookies serve a very, very valuable purpose in website development. Client-side storage is used in basically every major website on the internet. 2) This is hardly low-hanging fruit, and we have much, much bigger problems. 3) Who is the arbiter of what "allowed use" cookies are? We're going to have someone who actually decides, for individual websites, whether cookie use is proper or not? Is it going to work like a DMCA take-down request? An individual sends a request to review a website's cookie policies, and that IT department will have to submit a technical analysis and provide reasons for their cookie usage when a user feels their rights have been violated? 4) You know where this is going? Every single website that you register on is just going to give you a EULA-type agreement when you create an account. New to Facebook? Enter your username, click this checkbox that says "I accept your terms", and that's it. Normal users will just roll with basically any terms you present to them. Making this entirely ineffective except for the small minority of people, like many here, who are hyper vigilante about digital privacy. For the people this is meant to protect, they will likely never even think about it and opt-in anyway. 5) I completely reject the notion of getting politicians to dictate requirements to the tech industry in terms of how to handle the web stack. Let the politicians get back to blaming each other for X failures and make Y promises to the public, and get out of my internet.

chimeracoder 14y ago
> If you don't want to be tracked. TURN. COOKIES. OFF. ...except that's not going to be enough to make you untrackable[1]. As far as I know, short of some extreme Tor practices (new Tor connection for every session, no simultaneous sessions), there's no way to make yourself truly untrackable. [1] https://panopticlick.eff.org/index.php https://panopticlick.eff.org/index.php
- gavinlynch 14y ago
  Of course not. Just as no system is truly secure. But let's not dive off into hypotheticals, let's talk practically. With cookies off you are practically untrackable. I just tried your link. Here are my results: "Your browser fingerprint appears to be unique among the 2,399,190 tested so far." I'm one in roughly 2.4 million. That's untraceable enough for me :p
  - andrewaylett 14y ago
    Within the group of people using Panopticlick, you're just as trackable without cookies as with cookies -- that doesn't seem very untrackable to me. Note that it's one in 2.4M at the moment, but that's the best it's going to get because the number of people trying Panopticlick is only going to go up.
  - gavinlynch 14y ago
    @andrewaylett: Until I change just one of those identifiable metrics, that is, right? As soon as I change, for instance, my screen resolution I am another unique user and am no longer identified with the previously unique fingerprint. Surely, if someone installed insidious software on every single page of the internet and tracked me everywhere, there could be a way to use some fuzzy logic to re-identify myself. But we're way into the deep end on hypothetical again, right? My main point is that, practically speaking, it isn't very.
    - jamesaguilar 14y ago
      Not really. If you change those metrics and then re-login to any account that is cooperating with the person trying to track you, you've lost your anonymity again.
  - deleted 14y ago
    [deleted]
  - thwarted 14y ago
    One in 2.4 million means you are unambiguously uniquely identified out of 2.4 million clients, which is the exact opposite of untraceable. If your browser fingerprint was similar to 2.4 million other browser fingerprints, then you would be untraceable. 1 in 2.4m is being similar to ~150 other Americans. Not good odds for hiding among the crowd once non-client browser specific identifying clues are taken into account, such as browsing habits. 1 in 2.4m is being similar to ~400 other facebook users, and facebook knows a lot more about its users than just the client browser fingerprint.
oliveremberton 14y ago
The only problem with that is it doesn't give politicians much to do except tackle real problems. WON'T SOMEBODY THINK OF THE POLITICIANS?!
EvilTerran 14y ago
I basically agree with you. If "the masses" don't like being tracked in indefinite detail on the internet, and want the government to do something about it, then the government should be teaching people how to configure their browser cookie settings... or maybe funding development in open-source browsers (or extensions to same) to make such configuration easier... something like that, anyway. Whatever the specifics, client-side's the place to do it.
ginko 14y ago
Except there are sites which simply don't work with cookies turned off. My hope would be that this legislation forces programmers to use less cookies in the first place.
- adambyrtek 14y ago
  You cannot have your... cookie and eat it (sorry for a bad pun). Many useful features simply require some persistent state.
donalm 14y ago
The problem with just turning cookies off (in the UK anyway) is that with the new cookie law every second site now has an annoying message telling you about their cookie policy and you are now going to see it on every page. Some are even modal which could render the site useless.
AJ007 14y ago
And because of #4, web sites can get blanket permission to do things that they could not legally do without permission. I expect the US's "Do Not Track" will lead to the same thing.
alayne 14y ago
Obviously some people feel that the government should help with privacy and security issues. It's a government "of the people", not "of gavinlynch".
- gavinlynch 14y ago
  I had not realized that I was not the emperor of the United States. I appreciate you cluing me in on the situation. It would have made for awkward conversation at my High School reunion when people ask what I do for a living now-a-days :p And I ask: what is your point? Do you disagree with any of the points I have made? I am talking about a specific concept of a "cookie law". I am not talking about the generalities of privacy and security, which you are. I have never stated that I think the government has zero role in the area of digital privacy and security. Do you have a specific point to make?
  - deleted 14y ago
    [deleted]
  - alayne 14y ago
    You said "Guess what: Your digital security and privacy is your responsibility." and then later you referred to "the small minority of people, like many here, who are hyper vigilante about digital privacy." Those are just your opinions and characterizations and they don't have anything to do with cookies.
    - gavinlynch 14y ago
      Yes, that is my opinion. That is my take on life: Everything is your responsibility that you can reasonably manage. In my view, you can't depend on the government or anyone else to take that mantle of responsibility from you as an individual. If they can help, great. But I'm not depending on it. If there is something practical and cost effective that the government has the responsibility to enact, I'll hear out the idea. But this is not one of those ideas--as you said--in my personal opinion.
rickmb 14y ago
I nearly stopped reading after the second sentence, and I definitely stopped after your first "argument". I don't want to be stalked, period. Not turning cookies off should not mean I immediately relinquish my rights, just like I don't relinquish my right to privacy by stepping into the street. Yes, cookies server a very valuable purpose in website development, and guest what: for those purposes the so-called cookie law (which btw covers all forms of tracking, calling it the "cookie law" is sheer propaganda in itself) doesn't affect any website in any fucking way. This underhanded tactic of spreading deliberate misinformation in order to justify the massive violation of privacy caused by commercialized stalking disgusts me. It's like the mafia bitching about how it's so unfair and stupid that politicians have made racketeering illegal.
- gavinlynch 14y ago
  Okay, thanks for stating flat out, right away, that you didn't take the time to understand my points or have an intelligent discussion. That way, I can disregard your post too. I stopped reading after you told me you stopped reading my post. Have a nice day.
- jpiasetz 14y ago
  > I don't relinquish my right to privacy by stepping into the street. Yes you do. You might not be happy about it, think it's wrong and lobby for draconian laws to try and protect it. Physics and technology don't care. Someone can walk by, take your picture with a pin hole camera, upload it via tor to a torrent network.
- deleted 14y ago
  [deleted]

chimeracoder 14y ago

> If you don't want to be tracked. TURN. COOKIES. OFF. ...except that's not going to be enough to make you untrackable[1]. As far as I know, short of some extreme Tor practices (new Tor connection for every session, no simultaneous sessions), there's no way to make yourself truly untrackable. [1] https://panopticlick.eff.org/index.php https://panopticlick.eff.org/index.php

gavinlynch 14y ago
Of course not. Just as no system is truly secure. But let's not dive off into hypotheticals, let's talk practically. With cookies off you are practically untrackable. I just tried your link. Here are my results: "Your browser fingerprint appears to be unique among the 2,399,190 tested so far." I'm one in roughly 2.4 million. That's untraceable enough for me :p
- andrewaylett 14y ago
  Within the group of people using Panopticlick, you're just as trackable without cookies as with cookies -- that doesn't seem very untrackable to me. Note that it's one in 2.4M at the moment, but that's the best it's going to get because the number of people trying Panopticlick is only going to go up.
- gavinlynch 14y ago
  @andrewaylett: Until I change just one of those identifiable metrics, that is, right? As soon as I change, for instance, my screen resolution I am another unique user and am no longer identified with the previously unique fingerprint. Surely, if someone installed insidious software on every single page of the internet and tracked me everywhere, there could be a way to use some fuzzy logic to re-identify myself. But we're way into the deep end on hypothetical again, right? My main point is that, practically speaking, it isn't very.
  - jamesaguilar 14y ago
    Not really. If you change those metrics and then re-login to any account that is cooperating with the person trying to track you, you've lost your anonymity again.
- deleted 14y ago
  [deleted]
- thwarted 14y ago
  One in 2.4 million means you are unambiguously uniquely identified out of 2.4 million clients, which is the exact opposite of untraceable. If your browser fingerprint was similar to 2.4 million other browser fingerprints, then you would be untraceable. 1 in 2.4m is being similar to ~150 other Americans. Not good odds for hiding among the crowd once non-client browser specific identifying clues are taken into account, such as browsing habits. 1 in 2.4m is being similar to ~400 other facebook users, and facebook knows a lot more about its users than just the client browser fingerprint.

oliveremberton 14y ago

The only problem with that is it doesn't give politicians much to do except tackle real problems. WON'T SOMEBODY THINK OF THE POLITICIANS?!

EvilTerran 14y ago

I basically agree with you. If "the masses" don't like being tracked in indefinite detail on the internet, and want the government to do something about it, then the government should be teaching people how to configure their browser cookie settings... or maybe funding development in open-source browsers (or extensions to same) to make such configuration easier... something like that, anyway. Whatever the specifics, client-side's the place to do it.

ginko 14y ago

Except there are sites which simply don't work with cookies turned off. My hope would be that this legislation forces programmers to use less cookies in the first place.

adambyrtek 14y ago
You cannot have your... cookie and eat it (sorry for a bad pun). Many useful features simply require some persistent state.

donalm 14y ago

The problem with just turning cookies off (in the UK anyway) is that with the new cookie law every second site now has an annoying message telling you about their cookie policy and you are now going to see it on every page. Some are even modal which could render the site useless.

AJ007 14y ago

And because of #4, web sites can get blanket permission to do things that they could not legally do without permission. I expect the US's "Do Not Track" will lead to the same thing.

alayne 14y ago

Obviously some people feel that the government should help with privacy and security issues. It's a government "of the people", not "of gavinlynch".

gavinlynch 14y ago
I had not realized that I was not the emperor of the United States. I appreciate you cluing me in on the situation. It would have made for awkward conversation at my High School reunion when people ask what I do for a living now-a-days :p And I ask: what is your point? Do you disagree with any of the points I have made? I am talking about a specific concept of a "cookie law". I am not talking about the generalities of privacy and security, which you are. I have never stated that I think the government has zero role in the area of digital privacy and security. Do you have a specific point to make?
- deleted 14y ago
  [deleted]
- alayne 14y ago
  You said "Guess what: Your digital security and privacy is your responsibility." and then later you referred to "the small minority of people, like many here, who are hyper vigilante about digital privacy." Those are just your opinions and characterizations and they don't have anything to do with cookies.
  - gavinlynch 14y ago
    Yes, that is my opinion. That is my take on life: Everything is your responsibility that you can reasonably manage. In my view, you can't depend on the government or anyone else to take that mantle of responsibility from you as an individual. If they can help, great. But I'm not depending on it. If there is something practical and cost effective that the government has the responsibility to enact, I'll hear out the idea. But this is not one of those ideas--as you said--in my personal opinion.

rickmb 14y ago

I nearly stopped reading after the second sentence, and I definitely stopped after your first "argument". I don't want to be stalked, period. Not turning cookies off should not mean I immediately relinquish my rights, just like I don't relinquish my right to privacy by stepping into the street. Yes, cookies server a very valuable purpose in website development, and guest what: for those purposes the so-called cookie law (which btw covers all forms of tracking, calling it the "cookie law" is sheer propaganda in itself) doesn't affect any website in any fucking way. This underhanded tactic of spreading deliberate misinformation in order to justify the massive violation of privacy caused by commercialized stalking disgusts me. It's like the mafia bitching about how it's so unfair and stupid that politicians have made racketeering illegal.

gavinlynch 14y ago
Okay, thanks for stating flat out, right away, that you didn't take the time to understand my points or have an intelligent discussion. That way, I can disregard your post too. I stopped reading after you told me you stopped reading my post. Have a nice day.
jpiasetz 14y ago
> I don't relinquish my right to privacy by stepping into the street. Yes you do. You might not be happy about it, think it's wrong and lobby for draconian laws to try and protect it. Physics and technology don't care. Someone can walk by, take your picture with a pin hole camera, upload it via tor to a torrent network.
deleted 14y ago
[deleted]