5 ms·
If there are already so many ways to fingerprint via cookies, JavaScript, Flash, etc. that it probably doesn't matter then why do cookies matter? That the EU pa
by blfr 12y ago
If there are already so many ways to fingerprint via cookies, JavaScript, Flash, etc. that it probably doesn't matter then why do cookies matter? That the EU parliament decided to pass some weird law is not much of an argument. They're not exactly known for their technological proficiency. And it did nothing for privacy. It only annoys people[1].
Sure, we could start with cookies. However, that would break a lot of the web with no immediate benefit.
On SSL everywhere (not "anywhere"), how much resources does it cost to negotiate SSL/TLS with every single smartphone in their area? Supposedly, not much[2]. I run https websites on an Atom server.
Frankly, that was rather unconvincing. Although it does seem likely than the entire process was driven by IETF trying to stay politically relevant in the face of SPDY.
[1] https://github.com/r4vi/block-the-eu-cookie-shit-list https://github.com/r4vi/block-the-eu-cookie-shit-list
[2] https://istlsfastyet.com/#cpu-latency https://istlsfastyet.com/#cpu-latency
- stingraycharles 12y agoFor what it's worth, the cookie law in the EU is far more general than cookies, and had a totally different origin. Originally, the law was to require explicit consent when installing something on an electronic device, to combat malware. However, some clever politicians later realized that setting a cookie also "installs" something on an electronic device, and thus the law further known as the cookie law was passed. If a webserver were to set some secure session identifier, the same laws still apply -- just as installing software without explicit consent is covered by the same law.
- boracay 12y agoNot if you are using the session identifier for it's intended purpose, see the exceptions at: http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm#section_2 http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm#se...
- stingraycharles 12y agoWe all know how broad "intended usage" can be defined. Google has a cookie that is required for logging in into gmail (clearly intended usage), but is reusing that exact same cookie for tracking purposes. Until there is actual legal precedence after people sueing businesses abusing these abilities, I have no idea how to interpret these laws other than "they are very broad and vague".
- boracay 12y agoI don't think the laws are vague so much as how we use cookies today. With different mechanisms for different purposes it would (could) be much more transparent to the end users how things work. It would be more like the "save password" feature in various browsers. Of course since all the major browsers vendors also make money from ads this isn't really in their interest.
- deleted 12y ago[deleted]
- debacle 12y agoCookies are a historical band-aid. The implementation is a mess, cross-domain cookies require all sorts of hacks, and there's nothing you can do with a cookie that you can't do with a session identifier. Also, SSL gets way more complicated when you are using a CDN.
- icedchai 12y agoYou could say that most of the modern web is a historical band-aid. Here we are, 20+ years later, building "apps" on top of a document delivery system.
- angersock 12y agoIt's worked pretty well though, just sayin'.
- nilved 12y agoNo, it hasn't. The web is a terrible, hacked-together mess. Things break often and catastrophically. HTTP 2.0 is layering on more hacks instead of trimming the fat.
- icedchai 12y agoIt works, yes, but with great effort. Think of all the development time spent grafting applications on top of what is fundamentally a document delivery system. It's hack upon hack, kluge upon kluge. Example: Do you think HTML/CSS/JS is the right way to develop a user interface for an application? I don't.