Hacker News Reader

Comment by baggy_trough | Hacker News Reader

This article is written like it's a great privacy breakthrough but why is this any different from dropping a user id cookie?

View on HN

It is materially different because it does not track individual users.

It's comparable to dropping the same cookie to every visitor on a particular day; a pretty low level of privacy invasion.

Also, this allows to not use such things as visitor's IP address to collect meaningful statistics, which is a privacy win for the user, and an accuracy win for the site operator.

Exactly this. It is different from dropping a user id cookie, but equivalent to dropping a cookie hit_count=0, hit_count=1, ...

Seems like the hit_count cookie would be a lot more straightforward.

How do you get more than 86,400 unique “identifiers” when they only change every second?

who says Last-Modified has to be a current date? you've got the potential for 1669827111 users as of when I was composing this comment without giving your users future dates.

There are also many timezones and you can encode information in the timezone indicator as well. Also, you can use different days. You can stretch this number into millions. For a website that gets a certain number of unique visitors per year, this may be unique enough.

Subdomains. (Not sure why I immediately thought subdomains and not just multiple resources.)

You don't have to. A unique visitor is someone who comes in without a last-modified header. Set the header, that person is no longer unique.

A malicious site can put a different identifier on every resource loaded by the browser.

There really is no bottom, is there.

User's might block cookies, but this will likely still go through.

Because it's not called a cookie, eg. in the UK we have biscuits which are therefore not subject to the GDPR.

It's not tracking users, it's just a special user-identifying operation.

Reply on news.ycombinator.com