Hacker News Reader

Comment by blue_box | Hacker News Reader

I’m hoping that Apple will bring this reject all tracking cookies option to Safari so websites read that instead of asking all the time.

View on HN

We've already encountered that with "Do Not Track"—as soon as you have anything that doesn't require user intervention, websites start arguing that it doesn't reflect the users' intention, and so they have to protect us from the nasty browsers by tracking us.

To be fair, the DNT launch was botched from the beginning, starting more as hack than an industry-wide consensus [1]. While it eventually got implemented by browsers, it lacked adoption, and had risks with fingerprinting [2]. The nail in the coffin was when Internet Explorer 10 decided to enable it by default [3], completely disregarding user intent.

[1] http://paranoia.dubfire.net/2011/01/history-of-do-not-track-...

[2] https://www.macworld.com/article/232426/apple-safari-removin...

[3] https://en.wikipedia.org/wiki/Do_Not_Track#Internet_Explorer...

"Do not track me" IS the reasonable default expectation of user intent, to be fair.

And is what the GDPR is trying to establish as the legal baseline, though things are moving slowly (this article is showing they _are_ moving though)

> The nail in the coffin was when Internet Explorer 10 decided to enable it by default [3], completely disregarding user intent.

User intent? Really? Because user intent is to allow tracking by default?

Certainly not at the near 100% level that the default setting suggests. Microsoft poisoned the well with DNT and worsened privacy on the web for everyone.

I can believe that there are some people who don't care if they're tracked, but do you believe that there's anyone who wants to be tracked?

Maybe someone out there somewhere does, but surely such people, who actively want to be tracked, are in the distinctly small minority. In that case, why should the onus be on everyone else to communicate their intent, rather than on the few users affected to communicate their intent?

>why should the onus be on everyone else to communicate their intent, rather than on the few users affected to communicate their intent?

Because this effectively bans any kind of tracking cookies which, while most are kind of awful, there are legitimate reasons for their existence. Shifting the conversation from a user choice to an effective ban is a completely different conversation with pros and cons that must be considered separately.

> Because this effectively bans any kind of tracking cookies which, while most are kind of awful, there are legitimate reasons for their existence. Shifting the conversation from a user choice to an effective ban is a completely different conversation with pros and cons that must be considered separately.

It doesn't at all ban them—it just makes them only effective for users who explicitly opt in. And if that's too much of a burden to impose on those very few users, then why is it reasonable to impose the burden on the vast majority of users who don't want to be tracked?

I still don't understand how this has anything to do with "user intent". What makes you think that the default user intent is to allow tracking? Would it have been better if the browser asked the user to choose? Do you think user intent would have been respected if it was presented as an opt-in setting? (ie. 99% of user would just click ok without opting in)

The reason why this flag doesn't work has nothing to do with user intent. We wouldn't see all these GDPR banners that make it difficult to opt out if anyone actually cared about user intent.

I use a Safari extension for that: https://www.super-agent.com

I've seen them before. Do you have any idea what their game is?

They claim to be completely free and completely privacy respecting. No mention of a business model.

Do they hope to make some deal with advertisers later on?

”We make money by selling a snippet of code to websites that integrates with Super Agent. Essentially, websites can have a JS snippet unique to them so that when a user with Super Agent visits, cookie preferences are applied automatically without having to ask anything.” https://www.super-agent.com/faq

Thanks that 's the part I forgot: Why would website owners actually go for that? They need the annoying popup to get consent.

Cookies are just completely broken. The EU should never have got involved in the way that it did. No matter how positive the intentions, the web is a worse experience as a result, with marginal privacy gains.

> Cookies are just completely broken

In what way?

> The EU should never have got involved in the way that it did

Maybe, can you explain where it failed.

> the web is a worse experience as a result

That's debatable

> with marginal privacy gains

can you quantify that?

Myself, I turn off all JS and nix all cookies (with about the only temporary exceptions being for posting on HN). WFM.

> the web is a worse experience as a result, with marginal privacy gains.

The web is a worse experience because of companies like Google and IAB willingly breaking the law. But sure, blame the law.

I'm really hoping Do Not Track becomes legally binding. (Also, how is it not already treated like a piece of a contract negotiation? It is machine readable and sent on every request. Hidden website EULA's are already treated like contracts.)

DNT is deprecated and now removed from all browsers because it was ironically used for fingerprinting and tracking.

The focus on cookies was always a bit off and more a result of too much technical detail resulting in laws missing their intent. The legislative moves slowly, over time, this will be fixed. However the legislative regulating how webservices have to handle data privacy was very necessary (and the people of the USA should really consider amending their constitution by also demanding a basic human right to data privacy). The key elements are "informed choice" and "consent to data gathering/processing" which have little to do with cookies. Let's say you buy a smartphone from china and it comes with a keyboard app that sends all your inputs to a chinese company so they can make predictions and offer autocompletion. You kind of want that app to display a banner asking you if that is okay. And you kind of want a privacy policy attached that explains they will create user specific profiles and sell them to advertisers and share them with the chinese ministry of state security. I think you want that banner. Now google analytics isn't much different. It tracks you all over the web, creates profiles of your browsing habits, sells those to advertisers and shares them with the american national security agency. Sure it also shows statistics to the website owners, the same way that keyboard app has an autocomplete function, but you kind of want to be informed about those other functions and have the option to say no, don't you? That is why 'consent management' is so important for data privacy.

We.don’t.care.about.experience.

We care about privacy.

I would rather use Lynx than any more creepy JavaScript.

When I want “experience” —- a concept I loathe because it is a euphemism in all senses, and somehow arrogant and naive at the same time. —- that is the role of a desktop program. And it better ask me and inform me whenever it wants to perform a network request.

Reply on news.ycombinator.com