Hacker News Reader

Comment by volgo | Hacker News Reader

Yes it's great from a marketer's point of view. From a consumer's point of view, I don't want you to know where I came from. I don't really care if it's useful to you. It's the difference between pleasing marketers vs pleasing users. Firefox chose wisely

View on HN

You seem to be arguing back, but this user was agreeing with you, saying this behavior should be for all browsing, not just "private" browsing.

Thanks for this comment, I initially misread their comment as well. I guess that speaks to how highly I think of people in that industry :P

Honestly, I don't think path information is all that useful for marketers.

We overthink it when most of the tracking on the internet is based on simply your IP and occasionally a fingerprint of the browser(including any identification done by said browser). Since IPv4's inception that's all that was required and it was an extremely robust way to be tracked if you ask me.

If you want to not be tracked you require a random/different IP and a browser fingerprint that blends with the crowd.

Most people are on mobile nowadays so IP is becoming increasingly worthless.

If only it was true... quite the opposite is the case at least in US: https://medium.com/@philipn/want-to-see-something-crazy-open...

Oh yeah the US is a lost case.

Don’t give up so easily. Anything can be changed, provided enough people want to change it. Most undesirable practices only happen because they operate in the shadow of general ignorance and/or oblivion to their existence.

As generations that understand this tech implicitly come to power, things will change. To someone that does everything digitally the meaning of these words will be quite different than the currently accepted interpretation:

“The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.”

Just incredible this is legal.

When my traffic spikes to 5 hits in a day, it's nice to know where all those people are coming from besides just medium.com. What page exactly?

That strongly depends on the routing design of the web application. I could easily design a bad url-path that dicloses information that should be kept private...

Good marketing does please users by delivering them products tailored to them that they may have never knew even existed.

If I can go through your underpants drawer then I'll know the right kind of underpants to try and sell you. That means it's OK, right?

(Tangent, but I’ve never found this particular example compelling. All that’s in my underwear drawer is underwear... and I don’t find that particularly embarrassing? I think I’m missing some cultural context for it)

In the US, at least, the underwear drawer is a popular place to hide other things ... eg, your illegal drug stash, or the engagement ring you bought, etc. I think there's also subtextual implications of nosing about in your sex life.

It's a mild, nonspecific stand-in for whatever it is that you really don't want people knowing. Whether that's your weird fetish or your embarrassing hobby or the fact that you worked as a pianist in a brothel or whatever.

Then ask the users from which page they came from, I'm sure they'll be happy to do that so that they can know about those great products.

Nooo! Pleasee don't! It will be like these useless cookie warnings in EU all over www. I voluntary enable this path info if you spare me more popups.

I'd rather block popups...

Or just use NoScript.

Don't worry, the cookie warnings (actually third-party tracking warnings) will soon (May) become not useless at all.

From May on sites have to offer yes/no, they may only track you if you choose yes, and if you choose no they may not ask again, and may not refuse access either.

Which is what was originally intended all this time, and which all good websites offered anyway.

I'm very curious about this. How will you keep track of a user who has opted out without using a cookie? That's my understanding of the issues - websites keep asking not because they think they can browbeat you into accepting cookies, but because they can't tell the difference between a user who has opted out of cookies and a first time user.

There was never a blanket prohibition against cookies, that was a misconception (pushed purposefully by some, I suspect). Cookies which are "strictly necessary" in order to provide the service don't need to be approved. A cookie to remember that you don't want unnecessary cookies seems to fall well under that exception.

They could use local storage? As local storage isn't sent to the server, the server will not know whether the user opted out. (User opt in will be a cookie still.)

Alternatively, the legal definition of tracking cookie can differ from the technical definition of cookie. It wouldn't be the first time...!

"Cookie law" is an informal name, the Directive itself refers generally to "stor[ing] information on the equipment of a user".

The "cookie law" applies to every information that allows identifying the user which is not strictly necessary for the purposes of the service.

Cookie to say "has clicked no"? okay.

Cookie to track the user? not okay.

Local storage to track the user? not okay.

Tracking the user based on magic? not okay.

If I were drafting the regulations (fortunately I have neither the legal nor technical expertise), I'd make it legal to store without permission a cookie containing only a specific string defined by the regulation, e.g. “optout” or “0”, meaning “this user has seen the question and opted out; don't bother them again”. The regulations would have to ensure that the cookie's timestamps are suitably generic to prevent fingerprinting — perhaps you can store a date but not a time.

Would something like that work?

(Edit: Ah, apparently this sort of thing is already allowed, according to comments I didn't read before writing this. Sensible legislators.)

I won't argue about these warnings uselesness, but they definitely are a pain in the ass because they require enabling JS, at least temporarily, on sites that otherwise would work perfectly without it to be able to answer to these warnings.

How stupid is that? Privacy at the expense of security?

That's not required. The site could use a redirect to set such a cookie, or could use the DNT header to identify this.

You misunderstood me. It may not be strictly required for sites to use JS to build these warnings. But in practice, today, that's how it works on sites that display them. And it definitely requires the user to have JS enabled to pass these obnoxious pop-ups.

JS is also used for things that are doable with CSS or even HTML only. This isn't the first time.

My tin-foil hat persona suspects it's yet another way to force me to disable the various script and ad-blockers in the guise of protecting users for privacy concerns. But my more realistic side assumes this is just laziness.

Reply on news.ycombinator.com