8 ms·

CookiesOK browser plugin

32 points by jaap_w 14y ago

jiggy2011 14y ago
Does anybody know if this is actually being enforced in any way? (The cookie law that is?) I'm in the UK so use a bunch of sites here. What I have noticed is that only large active sites by big companies and orgs actually have cookie notices. None of the other countless sites actually have it at all. So I'm wondering how long it will be before people just stop putting these things up at all?
- rmc 14y ago
  Does anybody know if this is actually being enforced in any way? (The cookie law that is?) I don't know. But just FYI, it would be the local data protection commissioner that would be in charge of enforcing this law AFAIK.
- ilcavero 14y ago
  no it isn't, check this out http://nocookielaw.com/ http://nocookielaw.com/
- digitalengineer 14y ago
  It's not (yet). Typical 'Big Gov' solution. Extra dumb are websites that force you to accept the cookies each and every time you visit them. Oh yeah, even the government's own sites are not all up to date.
  - robotmay 14y ago
    Not really our government's fault though; to their credit they did actually try and fight it a bit. IIRC our regulation (in the UK) has a few differences from the EU one.
    - deleted 14y ago
      [deleted]
      - Gmo 14y ago
        OK, comment has been deleted, I therefore edit mine out.
    - rmc 14y ago
      All EU countries implement all EU law slightly differently (just look the EU Working Time Directive). EU law just gives the minimum that countries have to do. From looking into it myself, it looks like UK implementation is stricter than e.g. Irish one.
  - lotsofcows 14y ago
    Errmmm, you seem to not understand what cookies are for...
- kcathode 14y ago
  I did some screen-scraping research, and it turns out that the top visited domains (as defined by Alexa) actually set a fair amount of cookies: Visualization and data is here: http://www.demo.hauthaus.net/eurobake/# http://www.demo.hauthaus.net/eurobake/#
digitalengineer 14y ago
"CookiesOK searches for the accept buttons and triggers the click event" So what happens when someone injects something other than just the cookie code? My browser will auto-accept that as well?
- r4vik 14y ago
  that's why I didn't go down this route; most sites keep serving cookies until you tell them not to so I've found that an adblock filterlist works very well: https://github.com/r4vi/block-the-eu-cookie-shit-list https://github.com/r4vi/block-the-eu-cookie-shit-list where we just hide the entire cookie cruft every time or block the cookie prompt script if it's a widely deployed plugin
watt 14y ago
Why can't sites just provide simple cookie-less browsing experience, turning off their cookie-based features? Instead of forcing this click-through just to show the article, they should just show what they can in read-only mode (without sending the cookie). This is such a misguided knee-jerk campaign from developers. Cookies are NOT OK, I don't want to see them, and just show me the article (or page I originally came to view), thanks. And after I have viewed it, and if I decide to become a user of your site - then you will have my permission to use cookies. The click through pages are the worst (like what www.games-workshop.com has). The pop-up/notification bar some news sites have (like bbc.co.uk) is somewhat acceptable, while obnoxious, as it allows you to read the content without accepting the cookies, and just go your merry way when your're done. So this plug-in is going to auto-accept the cookies on your behalf. But why would you want to do this?
- john-n 14y ago
  Those banners (in most cases) are not you turning on or off cookies. The bbc sets cookies immediately (they do allow you to unset some here http://www.bbc.co.uk/privacy/cookies/managing/cookie-settings.html http://www.bbc.co.uk/privacy/cookies/managing/cookie-setting...), but you already have a session cookie that will last 4 years once the page is loaded. Most sites will state they are assuming consent based on your continued usage of the site.
- aidos 14y ago
  That's oversimplifying things a little. Say I build a website and fill it with content you want to see. I'd run Google Analytics to track popular content etc. You're saying my default choice is to no longer have analytics on my site at all? Agreed, all these other solutions are rubbish. But your solution isn't a good solution either.
  - smokel 14y ago
    Note that (at least in The Netherlands) the cookie law does allow you to use Google Analytics for measuring anonymized user statistics, without asking a visitor to accept cookies. (In Dutch http://www.nu.nl/internet/2987889/cookiewet-versoepeld.html http://www.nu.nl/internet/2987889/cookiewet-versoepeld.html)
maqr 14y ago
Perhaps web browsers should just include an option to disable cookies. That way, websites wouldn't have to display these kind of alerts, and users wouldn't have to trust that all sites will actually display these warnings before setting a cookie. One could even imagine an advanced web browser feature which would allow users to allow or deny cookies on a per-site basis.
- deleted 14y ago
  [deleted]
- zbowling 14y ago
  I didn't realize this was sarcasm. Rare find on hacker news. Better access to the cookie controls without hunting in preference panels would be nice, but I'm sure extensions can fix that.
- gavinpc 14y ago
  Sarcasm aside, it's curious that lawmakers (even in Europe) thought it better to make a requirement of O(N^N) site owners rather than "require" that O(5) browsers implement a feature which they all do already. I always use cookies on a whitelist-only basis, and it is quite common to find web sites that require cookies for no good reason -- sometimes, I suspect, without even realizing it -- and then fail with no message when cookies are disabled. I believe that cookies should be regarded as a progressive enhancement. If your web site requires cookies to implement a paywall, then detect when they are disabled and say so. If you can add features when cookies are available, great; if they're not, let me know what I'm missing. But don't tell me that "a browser error is preventing me from logging in," as many sites do. Once again, I'm sure this is boilerplate code that the actual site owner isn't even aware of.
rmc 14y ago
This plugin has a way for web developers to make their website compatible with this plugin. This seems pointless. The law is clear that, although you the developer can rely on web browser settings, those settings must give the user consent (default web browser 'accept all cookies' do not meet this). Using this plugin would not meet the "give the user consent", so you cannot rely on this plugin and be inside the law. I think making your cookie notice work with CookiesOK is about as legal as just turning off your cookie notice.
- csears 14y ago
  I think you are missing the point. The plugin is for end users who want automate the process of giving consent, similar to how a password manager plugin might help you automate the login process. If a web developer wants to make their site compatible with CookiesOK to improve the browsing experience for the subset of their users with the plugin, what's the harm? How end users indicate their consent should be entirely up to them. Would you prefer users solve a CAPTCHA when opting-in to cookies?
  - rmc 14y ago
    The plugin is for end users who want automate the process of giving consent, similar to how a password manager plugin might help you automate the login process. The page has a section on "Making my website Compatible". The plugin explicitly looks for the "CookiesOK" CSS class. This plugin is designed and partially aimed at web developers. If a web developer wants to make their site compatible with CookiesOK to improve the browsing experience for the subset of their users with the plugin, what's the harm? Well it's against the law. The harm depends on your country. It could be a fine of thousands of euro, and potentially an injunction shutting down your website.
rmc 14y ago
This plugin has a way for web developers to make their website compatible with this plugin. This seems pointless. The law is clear that, although you the developer can rely on web browser settings, those settings must give the user consent (default web browser 'accept all cookies' do not meet this). Using this plugin would not meet the "give the user consent", so you cannot rely on this plugin and be inside the law. I think making your cookie notice work with CookiesOK is about as legal as just turning off your cookie notice.
jlkinsel 14y ago
Does CookiesOK do any type of moderation over the cookies? Checking for domain scope, cookie flags, reasonable expiration of the cookie? I understand that "free" sites need advertising revenue, and unfortunately a lot of ad networks want to track my every move - how about enforcing a compromise where cookies are allowed for X minutes after I hit the page? Security-wise, I'm more interested in enforcing that cookies sent over SSL are not readable via standard HTTP. This tool is a step in the right direction, but I think a few more features would make it pretty attractive.
- csears 14y ago
  > Does CookiesOK do any type of moderation over the cookies? Checking for domain scope, cookie flags, reasonable expiration of the cookie? Based the "how does it work" section of their site, I don't think it does any sort of moderation/validation/inspection of cookies before trying to auto-click the consent button. My impression is that it's strictly a DOM-level utility and doesn't hook in at the network level where it could observe or manipulate cookies over the wire.
doctorfoo 14y ago
This is great, thought about making something like this myself for a while. One problem I have with current cookie law, is that it pretty much forces cookies upon those who actually know how to disable them. If someone browses with cookies disabled, they get all these annoying warnings and yet no way to turn them off - because turning them off requires a cookie! Insanity. And the relevant governing body has pretty much admitted that you'll probably be ok with just a clear description of cookies used. (See the response to nocookielaw.com) Oh AND all American websites will just continue as they were before, except now with an extra competitive advantage.
thatcherclay 14y ago
There is a pretty simple economic argument that people need to consider before jumping into the cookies are bad camp. The market for display ad inventory alone in the past year was to the tune of $40b in the US. There are 250m active internet users. That $40b dollars goes into the pockets of content producers on the internet that make it the tool it is. Net, if you wanted to drop all of that and get rid of the advertisers, that is a balance of $160 per person per year (and growing) that would fall to some other solution (like increased service charges). As others have made the case, cookies are important for advertisers. If you want to fix the problem, need to consider another viable solution that either does not sweep their legs out or does but provides an alternative revenue stream to keep the internet alive.

32 points by jaap_w 14y ago

jiggy2011 14y ago

Does anybody know if this is actually being enforced in any way? (The cookie law that is?) I'm in the UK so use a bunch of sites here. What I have noticed is that only large active sites by big companies and orgs actually have cookie notices. None of the other countless sites actually have it at all. So I'm wondering how long it will be before people just stop putting these things up at all?

rmc 14y ago
Does anybody know if this is actually being enforced in any way? (The cookie law that is?) I don't know. But just FYI, it would be the local data protection commissioner that would be in charge of enforcing this law AFAIK.
ilcavero 14y ago
no it isn't, check this out http://nocookielaw.com/ http://nocookielaw.com/
digitalengineer 14y ago
It's not (yet). Typical 'Big Gov' solution. Extra dumb are websites that force you to accept the cookies each and every time you visit them. Oh yeah, even the government's own sites are not all up to date.
- robotmay 14y ago
  Not really our government's fault though; to their credit they did actually try and fight it a bit. IIRC our regulation (in the UK) has a few differences from the EU one.
  - deleted 14y ago
    [deleted]
    - Gmo 14y ago
      OK, comment has been deleted, I therefore edit mine out.
  - rmc 14y ago
    All EU countries implement all EU law slightly differently (just look the EU Working Time Directive). EU law just gives the minimum that countries have to do. From looking into it myself, it looks like UK implementation is stricter than e.g. Irish one.
- lotsofcows 14y ago
  Errmmm, you seem to not understand what cookies are for...
kcathode 14y ago
I did some screen-scraping research, and it turns out that the top visited domains (as defined by Alexa) actually set a fair amount of cookies: Visualization and data is here: http://www.demo.hauthaus.net/eurobake/# http://www.demo.hauthaus.net/eurobake/#

digitalengineer 14y ago

"CookiesOK searches for the accept buttons and triggers the click event" So what happens when someone injects something other than just the cookie code? My browser will auto-accept that as well?

r4vik 14y ago
that's why I didn't go down this route; most sites keep serving cookies until you tell them not to so I've found that an adblock filterlist works very well: https://github.com/r4vi/block-the-eu-cookie-shit-list https://github.com/r4vi/block-the-eu-cookie-shit-list where we just hide the entire cookie cruft every time or block the cookie prompt script if it's a widely deployed plugin

watt 14y ago

Why can't sites just provide simple cookie-less browsing experience, turning off their cookie-based features? Instead of forcing this click-through just to show the article, they should just show what they can in read-only mode (without sending the cookie). This is such a misguided knee-jerk campaign from developers. Cookies are NOT OK, I don't want to see them, and just show me the article (or page I originally came to view), thanks. And after I have viewed it, and if I decide to become a user of your site - then you will have my permission to use cookies. The click through pages are the worst (like what www.games-workshop.com has). The pop-up/notification bar some news sites have (like bbc.co.uk) is somewhat acceptable, while obnoxious, as it allows you to read the content without accepting the cookies, and just go your merry way when your're done. So this plug-in is going to auto-accept the cookies on your behalf. But why would you want to do this?

john-n 14y ago
Those banners (in most cases) are not you turning on or off cookies. The bbc sets cookies immediately (they do allow you to unset some here http://www.bbc.co.uk/privacy/cookies/managing/cookie-settings.html http://www.bbc.co.uk/privacy/cookies/managing/cookie-setting...), but you already have a session cookie that will last 4 years once the page is loaded. Most sites will state they are assuming consent based on your continued usage of the site.
aidos 14y ago
That's oversimplifying things a little. Say I build a website and fill it with content you want to see. I'd run Google Analytics to track popular content etc. You're saying my default choice is to no longer have analytics on my site at all? Agreed, all these other solutions are rubbish. But your solution isn't a good solution either.
- smokel 14y ago
  Note that (at least in The Netherlands) the cookie law does allow you to use Google Analytics for measuring anonymized user statistics, without asking a visitor to accept cookies. (In Dutch http://www.nu.nl/internet/2987889/cookiewet-versoepeld.html http://www.nu.nl/internet/2987889/cookiewet-versoepeld.html)

maqr 14y ago

Perhaps web browsers should just include an option to disable cookies. That way, websites wouldn't have to display these kind of alerts, and users wouldn't have to trust that all sites will actually display these warnings before setting a cookie. One could even imagine an advanced web browser feature which would allow users to allow or deny cookies on a per-site basis.

deleted 14y ago
[deleted]
zbowling 14y ago
I didn't realize this was sarcasm. Rare find on hacker news. Better access to the cookie controls without hunting in preference panels would be nice, but I'm sure extensions can fix that.
gavinpc 14y ago
Sarcasm aside, it's curious that lawmakers (even in Europe) thought it better to make a requirement of O(N^N) site owners rather than "require" that O(5) browsers implement a feature which they all do already. I always use cookies on a whitelist-only basis, and it is quite common to find web sites that require cookies for no good reason -- sometimes, I suspect, without even realizing it -- and then fail with no message when cookies are disabled. I believe that cookies should be regarded as a progressive enhancement. If your web site requires cookies to implement a paywall, then detect when they are disabled and say so. If you can add features when cookies are available, great; if they're not, let me know what I'm missing. But don't tell me that "a browser error is preventing me from logging in," as many sites do. Once again, I'm sure this is boilerplate code that the actual site owner isn't even aware of.

rmc 14y ago

This plugin has a way for web developers to make their website compatible with this plugin. This seems pointless. The law is clear that, although you the developer can rely on web browser settings, those settings must give the user consent (default web browser 'accept all cookies' do not meet this). Using this plugin would not meet the "give the user consent", so you cannot rely on this plugin and be inside the law. I think making your cookie notice work with CookiesOK is about as legal as just turning off your cookie notice.

csears 14y ago
I think you are missing the point. The plugin is for end users who want automate the process of giving consent, similar to how a password manager plugin might help you automate the login process. If a web developer wants to make their site compatible with CookiesOK to improve the browsing experience for the subset of their users with the plugin, what's the harm? How end users indicate their consent should be entirely up to them. Would you prefer users solve a CAPTCHA when opting-in to cookies?
- rmc 14y ago
  The plugin is for end users who want automate the process of giving consent, similar to how a password manager plugin might help you automate the login process. The page has a section on "Making my website Compatible". The plugin explicitly looks for the "CookiesOK" CSS class. This plugin is designed and partially aimed at web developers. If a web developer wants to make their site compatible with CookiesOK to improve the browsing experience for the subset of their users with the plugin, what's the harm? Well it's against the law. The harm depends on your country. It could be a fine of thousands of euro, and potentially an injunction shutting down your website.

rmc 14y ago

jlkinsel 14y ago

Does CookiesOK do any type of moderation over the cookies? Checking for domain scope, cookie flags, reasonable expiration of the cookie? I understand that "free" sites need advertising revenue, and unfortunately a lot of ad networks want to track my every move - how about enforcing a compromise where cookies are allowed for X minutes after I hit the page? Security-wise, I'm more interested in enforcing that cookies sent over SSL are not readable via standard HTTP. This tool is a step in the right direction, but I think a few more features would make it pretty attractive.

csears 14y ago
> Does CookiesOK do any type of moderation over the cookies? Checking for domain scope, cookie flags, reasonable expiration of the cookie? Based the "how does it work" section of their site, I don't think it does any sort of moderation/validation/inspection of cookies before trying to auto-click the consent button. My impression is that it's strictly a DOM-level utility and doesn't hook in at the network level where it could observe or manipulate cookies over the wire.

doctorfoo 14y ago

This is great, thought about making something like this myself for a while. One problem I have with current cookie law, is that it pretty much forces cookies upon those who actually know how to disable them. If someone browses with cookies disabled, they get all these annoying warnings and yet no way to turn them off - because turning them off requires a cookie! Insanity. And the relevant governing body has pretty much admitted that you'll probably be ok with just a clear description of cookies used. (See the response to nocookielaw.com) Oh AND all American websites will just continue as they were before, except now with an extra competitive advantage.

thatcherclay 14y ago

There is a pretty simple economic argument that people need to consider before jumping into the cookies are bad camp. The market for display ad inventory alone in the past year was to the tune of $40b in the US. There are 250m active internet users. That $40b dollars goes into the pockets of content producers on the internet that make it the tool it is. Net, if you wanted to drop all of that and get rid of the advertisers, that is a balance of $160 per person per year (and growing) that would fall to some other solution (like increased service charges). As others have made the case, cookies are important for advertisers. If you want to fix the problem, need to consider another viable solution that either does not sweep their legs out or does but provides an alternative revenue stream to keep the internet alive.