5 ms·

> Cookies are...freaking annoying here in Europe as you cannot visit a site anymore without being warned you are about to receive yet even more cookies. Seems

by yahelc 13y ago

> Cookies are...freaking annoying here in Europe as you cannot visit a site anymore without being warned you are about to receive yet even more cookies. Seems like the blame for that lies not with cookies themselves, but with the EU's cookie law.

exceptione 13y ago
Well the law is implementend in an annoying fashion. For functional cookies there is no requirement to ask permisson. But many websites choose to block all content asking to permit them to place additional cookies for benefits, i.e. tracking cookies. Like the author said: Cookies are, as the EU commision correctly noted, fundamentally flawed, because they store potentially sensitive information on whatever computer the user happens to use, and as a result of various abuses and incompetences, EU felt compelled to legislate a "notice and announce" policy for HTTP-cookies.
Bosence 13y ago
Oh yes, the regulation was rushed in by people not really sure what to do or what was happening. Why it couldn't be a browser option, I have no idea.
- jimktrains2 13y ago
  Isn't it already a browser option?
  - rmc 13y ago
    Yes. But the default browser options are "accept all cookies, without asking", which goes against the spirit of the law, and also the letter.
drostie 13y ago
At best that's a symptom. Cookies are for session management; the central problem with cookies is that people feel that servers will treat certain sessions as ephemeral, but instead those servers track these people for a long-term creepy analysis. One connected problem is that many sites require cookies in order to show public content. Public-content sessions should be entirely ephemeral, meaning that you shouldn't need a cookie in the first place. (The New York Times offends in this regard egregiously and persistently.) You can easily comply with the EU law by either placing the notice on the login page or else not storing cookies. This means that anybody who abuses cookies in the above way needs to be loud about it; "we're not giving you an ephemeral presence like you think!" -- which actually not only fixes this problem but also creates an incentive to not abuse cookies in this way. I am not saying that we should abandon sessions entirely, but that it would be nice if the 'default' session treatment followed the rules that online banking uses: when the browser is closed, all sessions are done. If we did this then we'd want to include a 'persistent login' mechanism, which would take the form of an in-browser 'would you like to sign in?' dialogue accompanying a web site. This means that unlike current HTTP authentication, it would have to be somewhat asynchronous; you are shown the ephemeral version of the page while the browser itself requests you to confirm that you want to join your long-term session there. (I was originally going to recommend that the browser just handle a digital signature scheme, but of course that does not solve the 'logging on to Facebook from your sister's computer' problem easily. Hm.)
- emmett 13y ago
  For advertisers this is a non-starter, because it prevents you from knowing the size of your audience. All sites would immediately begin requiring some form of "login" in your scenario in order to enable tracking again. If you can't track uniques, you can't sell ads, and that's pretty much all there is to it. So there's huge incentive to undermine any scheme to prevent unique user tracking. The solution is to somehow ban advertising, but that's biting off a bit more than simple user privacy.
  - anonymfus 13y ago
    To sell ads you don't need to show exact size of audience, estimation is enough as proven by TV.
    - rlanday 13y ago
      If you’re an Internet company trying to pull advertising dollars away from TV, one of your arguments is that you can do much better tracking. When you run a TV ad, everyone watching the show gets the same ad, and people watching different shows see the same ad a non-optimal number of times.
    - emmett 13y ago
      That's a very good point. This would definitely happen to some degree. But it would still hurt internet advertising a good deal not to be able to track uniques, to show you an ad only once per day, to count how many people have been shown an ad, etc. even if you could know about how many people were on the site. The result would likely be tracking via login as I describe, rather than true anonymity.
  - kenko 13y ago
    "For advertisers this is a non-starter, because it prevents you from knowing the size of your audience. All sites would immediately begin requiring some form of "login" in your scenario in order to enable tracking again." If this is really a non-starter for advertisers, then mandating it will effectively ban advertising, non? Remember: your business model is not sacrosanct! Disruption!
andyhmltn 13y ago
Please correct me if I'm wrong, but wasn't that the UK's law? If it was, they seemed to backtrack on it and say that it's fine as long as you mention it in your site's TOS
- rmc 13y ago
  It was an EU wide law. Each country implemented EU in similar but different ways.
  - andyhmltn 13y ago
    Thanks for that!
  - reidrac 13y ago
    It is a EU Directive: https://en.wikipedia.org/wiki/Directive_(European_Union) https://en.wikipedia.org/wiki/Directive_(European_Union) AFAIK the EU dictates the result, not the means. UK's first implementation of the e-Privacy Directive was unfortunate, but I don't think it means the directive was a bad idea.
    - rmc 13y ago
      An "EU Directive" is a law, it's decided on in the same democratic manner that (say) UK laws are decided on. It's like how in the UK there are "Acts of Parliament" (i.e. laws). It's up to individual countries to implement the minimum, and likewise, each country will implement each one slightly different. The UK law and the EU Directive are basically the same, "It's illegal to do X, Y and Z unless you do W etc." There isn't really a mean/results differnce here.

by yahelc 13y ago

exceptione 13y ago

Well the law is implementend in an annoying fashion. For functional cookies there is no requirement to ask permisson. But many websites choose to block all content asking to permit them to place additional cookies for benefits, i.e. tracking cookies. Like the author said: Cookies are, as the EU commision correctly noted, fundamentally flawed, because they store potentially sensitive information on whatever computer the user happens to use, and as a result of various abuses and incompetences, EU felt compelled to legislate a "notice and announce" policy for HTTP-cookies.

Bosence 13y ago

Oh yes, the regulation was rushed in by people not really sure what to do or what was happening. Why it couldn't be a browser option, I have no idea.

jimktrains2 13y ago
Isn't it already a browser option?
- rmc 13y ago
  Yes. But the default browser options are "accept all cookies, without asking", which goes against the spirit of the law, and also the letter.

drostie 13y ago

At best that's a symptom. Cookies are for session management; the central problem with cookies is that people feel that servers will treat certain sessions as ephemeral, but instead those servers track these people for a long-term creepy analysis. One connected problem is that many sites require cookies in order to show public content. Public-content sessions should be entirely ephemeral, meaning that you shouldn't need a cookie in the first place. (The New York Times offends in this regard egregiously and persistently.) You can easily comply with the EU law by either placing the notice on the login page or else not storing cookies. This means that anybody who abuses cookies in the above way needs to be loud about it; "we're not giving you an ephemeral presence like you think!" -- which actually not only fixes this problem but also creates an incentive to not abuse cookies in this way. I am not saying that we should abandon sessions entirely, but that it would be nice if the 'default' session treatment followed the rules that online banking uses: when the browser is closed, all sessions are done. If we did this then we'd want to include a 'persistent login' mechanism, which would take the form of an in-browser 'would you like to sign in?' dialogue accompanying a web site. This means that unlike current HTTP authentication, it would have to be somewhat asynchronous; you are shown the ephemeral version of the page while the browser itself requests you to confirm that you want to join your long-term session there. (I was originally going to recommend that the browser just handle a digital signature scheme, but of course that does not solve the 'logging on to Facebook from your sister's computer' problem easily. Hm.)

emmett 13y ago
For advertisers this is a non-starter, because it prevents you from knowing the size of your audience. All sites would immediately begin requiring some form of "login" in your scenario in order to enable tracking again. If you can't track uniques, you can't sell ads, and that's pretty much all there is to it. So there's huge incentive to undermine any scheme to prevent unique user tracking. The solution is to somehow ban advertising, but that's biting off a bit more than simple user privacy.
- anonymfus 13y ago
  To sell ads you don't need to show exact size of audience, estimation is enough as proven by TV.
  - rlanday 13y ago
    If you’re an Internet company trying to pull advertising dollars away from TV, one of your arguments is that you can do much better tracking. When you run a TV ad, everyone watching the show gets the same ad, and people watching different shows see the same ad a non-optimal number of times.
  - emmett 13y ago
    That's a very good point. This would definitely happen to some degree. But it would still hurt internet advertising a good deal not to be able to track uniques, to show you an ad only once per day, to count how many people have been shown an ad, etc. even if you could know about how many people were on the site. The result would likely be tracking via login as I describe, rather than true anonymity.
- kenko 13y ago
  "For advertisers this is a non-starter, because it prevents you from knowing the size of your audience. All sites would immediately begin requiring some form of "login" in your scenario in order to enable tracking again." If this is really a non-starter for advertisers, then mandating it will effectively ban advertising, non? Remember: your business model is not sacrosanct! Disruption!

andyhmltn 13y ago

Please correct me if I'm wrong, but wasn't that the UK's law? If it was, they seemed to backtrack on it and say that it's fine as long as you mention it in your site's TOS

rmc 13y ago
It was an EU wide law. Each country implemented EU in similar but different ways.
- andyhmltn 13y ago
  Thanks for that!
- reidrac 13y ago
  It is a EU Directive: https://en.wikipedia.org/wiki/Directive_(European_Union) https://en.wikipedia.org/wiki/Directive_(European_Union) AFAIK the EU dictates the result, not the means. UK's first implementation of the e-Privacy Directive was unfortunate, but I don't think it means the directive was a bad idea.
  - rmc 13y ago
    An "EU Directive" is a law, it's decided on in the same democratic manner that (say) UK laws are decided on. It's like how in the UK there are "Acts of Parliament" (i.e. laws). It's up to individual countries to implement the minimum, and likewise, each country will implement each one slightly different. The UK law and the EU Directive are basically the same, "It's illegal to do X, Y and Z unless you do W etc." There isn't really a mean/results differnce here.