Hacker News Reader

Comment by ajsnigrutin | Hacker News Reader

Better question here is, why is this not handled through the browser instead of relying on individual web apps to do it.

Block third party cookies by default, delete other cookies on the last tab or window closed and prompt user to save cookies on a form submit ("do not delete cookies for this domain when leaving" type of prompt, for pages with logins, settings, etc).

Also remove features that make easy fingerprinting possible, the site doesn't need to know every font I have installed, just have a "standard set" included with the browser, and use web fonts or whatever for other fonts.

View on HN

We had P3P spec for it 20 years ago, even implemented in IE! And Google has been sending intentionally malformed P3P header to bypass it. Their trillion dollar business relies on users having difficulty stopping tracking.

TIL. Here is the relevant summary from the spec: https://www.w3.org/TR/P3P/#goals_and_capabs

(for amusement, google P3P and see what comes up first.)

Because the most popular browser is made by an AdTech company

To be fair, I think it was Microsoft who killed the DNT header by enabling it by default.

Given a boolean flag, if 94% of users would select state X, then selecting X by default doesn't seem problematic at all.

Microsoft (for once) did nothing wrong. The problem is the DNT flag was unenforceable, and that's something governments should have pushed on.

DNT is literally the nice bit, the symmetric of the evil bit.

https://www.ietf.org/rfc/rfc3514.txt

But hey, clicking those "reject all" (when you can at all) does not guarantee a bad actor would comply with one's wishes either.

GDPR has had every bit correct _technically_ (needs zero dialog if one doesn't track), but it could only work if these actors were honest. It turns out it reveals how bad they are.

I suppose the only thing that could possibly work is legislation that would guarantee these bad actors to be sued to oblivion + burden of proof on them that they don't track.

> and that's something governments should have pushed on

They did. Our current anti-tracking laws all come from pushing on that.

The problem is that the DNT is way too simplistic. Browsers fail to inform the users abut it and keep track of sites independently, and the protocol fails to allow the site to request fine-grained authorizations and inform why they are needed.

There's a sibling talking about P3P that has neither of those problems.

Mozilla should put a red tracker count in the URL bar. That would make people aware of how they're being exploited.

Enabling it by default was objectively the right thing to do. Blaming Microsoft for its death is, in my opinion, incorrect. The ad companies were never going to allow it to be honored.

The thing that killed DNT was making honoring it optional in the first place.

Blaming Microsoft for enabling a user-focused feature by default is a really weird thing to ding them for in the first place.

Especially given all the things you can rightly blame them for.

Firefox lets you set "strict tracking protection". The settings page warns you that "some sites may break". Some sites whine about this, usually using "Admiral" to check for cookie blocking. Most of those aren't worth visiting anyway.

There's also Privacy Badger, from the EFF. This turned up that the "Who wants to be tracked" site is using "plausible.io" to track visitors.

> Also remove features that make easy fingerprinting possible

Is this (reasonably) possible? If you ever do a graphics project you'll find that it is pretty difficult to get a pixel perfect render. Hence canvas fingerprinting[0]. (same happens for text rendering)

The problem can come down to the silicon lottery as well as the browser[1]. If you render the same code on two different machines, with the same compiler and libraries, you won't get pixel perfect difference. And GPUs don't match CPUs, though can if you edit the FMA instructions. Usually the best way to ensure images are exactly the same is to compare between Macs because the hardware is very similar and similarly binned. So Macs tend to have lower fingerprints in general (to the best of my knowledge) Current canvas blockers tend to just return a value, but that can obviously be a fingerprint itself.

So my question is if this is reasonably solved? I don't see it by being just the browser unless they can specifically just block a lot of that tracking. Which may require a big actor like Google or Apple to make a stand.

(Note: not an expert, but have done a decent amount of visualization work)

[0] https://privacycheck.sec.lrz.de/active/fp_c/fp_canvas.html

[1] https://stackoverflow.com/questions/47696956/display-pixel-p...

I think it makes sense to roll your own analytics stack using first party cookies, but OP went a little bit overboard by removing all tracking cookies altogether.

The problem is that pool is getting increasingly poisoned. Websites are increasingly hosting third-party analytics and advertising tracker scripts on their own sites in order to evade people who are trying to avoid them.

This is making it much less acceptable to allow first-party cookies and scripts.

Yeah, it seems like sites that offer content without a subscription keep trying to show ads (which nobody buys untargeted because they’d be a massive waste of money). It implies that the content needs to be paid for - and that’s why they’re not all just taking a polite “no” and giving up on it.

And if you believe that Internet ads could be just as scattershot as the Bud Light, Coke, and Toyota spots on TV, consider how much of the Internet ad market is niche stuff you’d never see on TV ads because they couldn’t afford it. Consider every SaaS product: they don’t advertise on TV because their target customer is too niche. Probably 75% of ad dollars would simply not be there without targeting. People choose over and over again to get content for free, and then complain about it because everyone loves to complain. No one loves opening their wallet.

So what? Literally billions of people get tracked and profiled so that some video creator can earn a bit more money... who cares. They can do it for less, or charge money directly if they think they've got what it takes. A few individuals lose a bit, while billions gain some privacy.

>why is this not handled through the browser instead of relying on individual web apps to do it.

Websites want you to explicitly reject consent for using your data. There are many untrustworthy places on the internet, so trustworthy places want to explicitly ask because they don't want the user to reject consent to them just because they are being lumped with the other sites.

Now if you had a browser setting that gave consent by default and allowed users to deny consent that is something that would reduce the need of sites constantly asking you for consent. But any attempt to automatically reject consent is just going to result in sites asking for consent via another channel. See what happened to the do not track header when you try and lump all sites together.

> why is this not handled through the browser

Did you forgot what happened the last time 'the browser was handling it'? I would remind you: Internet Explorer, Do Not Track.

If the law has some stack overflows, can we really blame M$ for exploiting them? Dogs are never being controlled by their tales.

I've been thinking about the same thing - this feels like it deserves a native API, so we can get rid of all these dark patterns currently being employed.

It’s there. It’s “Do-Not-Track” and it sadly was never respected by the big platforms (and any developers, really). I’ve never seen a single case where setting the DNT header made a difference — which is dumb considering how infested the web is with privacy prompts…

Server owners can track you with the data they collect, client side can have little control of that. I wonder if there’s a better way possible in the current iteration of the web platform, or if a substantial overhaul is necessary for privacy respecting services.

Perhaps DNT would’ve been more effective if it was written in law? To gather user information for marketing purposes, you must respect this header. But then, how’d you enforce that… other problems: if browsers always set DNT to true by default, then the whole effort is pointless, because nobody will opt-in. This is ideal, but marketers will definitely not like that idea. Thinking out loud here.

EDIT: found an interesting HN thread from 2017 https://news.ycombinator.com/item?id=14377877

> I wonder if there’s a better way possible in the current iteration of the web platform, or if a substantial overhaul is necessary for privacy respecting services

Web browsers taking the reigns is the best option we have. Adblock + anti-fingerprinting + cookie jars/cookies being deleted by default are all necessities in the modern day. Ideally, moving people to more privacy conscious choices (i.e. not Google/Microsoft) are great steps to reducing the power of the Internet surveillance capitalism machine.

1. Your proposal is not enough for EU privacy law, so you'd still see banners. First-party tracking is still tracking and you still need a banner if you're going to store any data on the client that is not "strictly necessary" for the user's request.

2. Your proposal gives a pretty crummy experience in cases where users do expect the site to store data on the client longer. For logins you're popping up a confusing banner, and for client-side only storage (shopping carts, preferences, work in progress) you're silently discarding people's work.

No consent is required to store cookies required for the site to function. Login cookies, shopping carts etc are fine. The only reason websites display these banners is because they want to track you, and they rely upon misunderstandings like you are propagating to whitewash the request.

Sites can function just fine without storing my shopping carts locally.

They don't have to store the whole contents of your cart locally, but they need to store at least a token on your machine so they can remember that this cart is yours.

Shopping carts, sort of: if they don't check out immediately and you keep the item in their cart (which they may want but didn't explicitly request) you're in violation: https://ec.europa.eu/justice/article-29/documentation/opinio...

Other things: it has to be "strictly necessary" which is a high bar and many things don't meet it. For example, implicitly learning your preferences from your behavior doesn't.

The last thing a browser wants to do is break experience for older sites. If a site relies on 3rd party cookies for log in, it will no longer work on your browser. It makes your browser look shit. Same reason we allow unclosed tags, crossed tags, etc.

Browsers already detect login forms to offer autocompletion and password storage. Surely it wouldn’t be insurmountable to detect cookies being set after a login flow, and let users confirm that they want this login to persist.

We also had shockwave flash, blink tags, keygen tags for cert generation, etc., so yeah, we can change stuff if we need it. But since the biggest browser is owned by an ad company that earns money by tracking us, this will probably never happen.

An alternative would be to have a cookie jar per domain.

Is this really different from disabling JavaScript, which will also break the majority of sites?

Safari and Firefox block 3rd party cookies by default.

On mobile safari, private tabs isolate cookies from each other. Also, once you are in private mode, all links open in new private tabs. Close the tab, and the cookies are gone.

I never turn private mode off. I wish firefox and chrome also worked this way.

My default browser on Android is Firefox Focus. No history, no tracking, cookies removed on close.

GDPR is not about cookies, it's about tracking.

Browsers can (and do in the case of Firefox and other privacy respecting browsers) try to make it harder to track you, but it's not something they can just unilaterally turn on or off.

Consent dialogs are about what sites do with the information they get about you, not just about what information they get.

> Better question here is, why is this not handled through the browser instead of relying on individual web apps to do it.

We had Do-Not-Track header once. Id did not play out very well.

Sometimes I wish GDPR included a clause stating that presence of the Do-Not-Track header equals to the user not giving consent.

Has this been tried in any courts? It could be argued that this is the case.

Cookie-consent != tracking consent.

Cookie consent also predates GDPR.

How would that change anything?

DNT = no consent, no DNT = no consent

Lynx browser does this, for every website I choose which Set-Cookie headers I want to respect and which to ignore.

I might be wrong but I think the EU regulation that forced these cookie acceptance forms―I can't remember if it was GDPR or some earlier directive―specifically required that the consent submission may not be automated so that the browser can be configured to accept everything.

It may have had good intentions as entities such as Microsoft would just set their browsers to default to accept all cookies anyway and a marginal group of people would know how to turn it off and even they couldn't still be sure if a proprietary browser still accepts and sends cookies without just telling the user.

So as usual the good intentions have turned into a cat-and-mouse game in the technical, grassroot realm. There are browser extensions that will just kill these consent dialogs automatically and websites try (luckily, not very hard so far), to work around the kill scripts. Everybody suffers.

> I think the EU regulation that forced these cookie acceptance forms

Yep, i'm just not sure if it was general incompetence or just plain lobbying by third parties to do so.

The EU regulation enforced _asking users for permission before being tracked_ for non legitimate interests. There is new regulation in progress that mandates opting out to be as easy as opting in ("the Good").

None of this would be a problem if companies only used cookies for legitimate purposes.

> the EU regulation that forced these cookie acceptance forms

No such regulation has ever existed in the EU.

That's correct.

The regulation is about providing consent to process personal data.

Many people fail to see the difference.

> Many people fail to see the difference.

By design. The prompt wants you to think the site only needs your permission to store necessary cookies such as for authentication, when in fact it is always because they want to track you and sell the tracking data.

There was a cookie law prior to GDPR. That's when the obtrusive dialogs started showing up.

Non tracking ads pay something like 90% less than tracked ones.

If your salary was going to be cut 90% tomorrow unless you started every conversation with the exact words 'I might remember this conversation later', would you just take the paycut?

So no, they didn't require them in plain text. But they essentially did so when the only real alternative was to go out of business.

Reply on news.ycombinator.com