Sweden Crunches Cookies

dillkvast writes "According to this article (swedish) at ComputerSweden swedish websites must now have the user's consent to use cookies. The law also states that the user is to be informed of what the information stored in the cookie is, and its intended use. This leaves swedish website with two options: No cookies at all, or a special page where the user is informed of the cookie use and can choose to either accept or reject the cookies. This represents a huge problem for swedish sites which use .asp and .php session variables, the article states, which will have to rewrite their sites to present the user with a chance to confirm that cookie use is ok. The law comes into force today."

Comments

mostly not a problem:

[Neophytus]

mostly not a problem:

do you want to remember my password (uses cookies) (x) yes ( )no

Most forum software has the option to use/not use cookies (and as such sessions are passed through urls) so that shouldn't be a problem either for non-lazy coders.

Actually, scratch that, most websites will just ignore the law and get on with life.

Re:mostly not a problem:

[tmark]

Most forum software has the option to use/not use cookies (and as such sessions are passed through urls) so that shouldn't be a problem either for non-lazy coders.

Well, Slashdot "works" when you disable cookies until you try to post a message. Then it seems that you always post as an AC even if you entered your name and login first, and even when the preview page acknowledges your logging in.

I'm not sure if this is a bug or an intended design "feature", but it seems that despite all the hand-wringing here about cookies, my experience is that Slashdot itself requires its users to enable cookies if they want to post as anything but an AC.

(And if this goes out as an AC it's because of that same cookie problem).

Re:mostly not a problem:

[tirenours]

Will the choice of the user be remembered using a cookie?

Re:mostly not a problem:

[fiiz]

I beg to disagree--a few posts below also re-iterate your point.

In PHP, URL-rewrite slows things down and bloats your script. It also makes your URLs look ugly: sometimes you may want them to stick in the user's mind.
While for a forum this may be OK, for a fairly big user-centric website it is simply ridiculous to have to do away with cookies--they are a convenient way to deal with things "behind the curtain"; they also have the added security of not being immediatly visible to the user (he has to want to see them, by looking at his filesystem or other.)

Privacy -wise, all decent modern browsers have some form of modern cookie filtering--the user can choose to block, etc.

The only solution I see is, as suggested below, have a front page which tells the user and gives him the choice to leave.

All in all, I find this law a little silly, although of course I understand the privacy concern.

Re:mostly not a problem:

[bongoras]

"Most forum software has the option to use/not use cookies (and as such sessions are passed through urls) so that shouldn't be a problem either for non-lazy coders." Right, because there's no applications for the world wide web other then forum software. What else would losers do for a life?

Re:mostly not a problem:

[maharg]

Will the choice of the user be remembered using a cookie?

..only if they chose "ja", otherwise it's illegal ,-}

Re:mostly not a problem:

[JRSiebz]

You're wrong.

When you have user log-in to a particular part of the site, you need to store username, password information, and some other session variables in a cookie, so that on subpages within the part that needs to be logged into can check to see is the user is properly logged in. I like to check to see if the user is the actual user I think they are.

I guess you've never used php before.
Especically a for site you need to log into.
Hope this law never passes in the US, if you dont want cookies from a site, don't go there.

Does this low allow you to deny service to a user who doesn't accept the use of cookies?

Re:mostly not a problem:

[R0b5D1gs]

But it says that it was posted by tmark?

Re:mostly not a problem:

[swordboy]

mostly not a problem:

do you want to remember my password (uses cookies) (x) yes ( )no

Hardly... Have you *ever* tried to disable cookies altogether? It is difficult to get things done. Most websites will simply refuse navigation without cookies. Microsoft's idea of a "session cookie" that disappears after you leave the site was a good idea but their implentation does not work (it is the same as turning cookies off).

While this isn't a problem for advanced users, I do build and deploy a number of PCs for friends and family. IE is a requirement because many sites are not up to speed on Mozilla yet.

Argh...

Re:mostly not a problem:

[Neophytus]

what i was trying to do was show that if a user is paranoid about cookies then it is to their disadvantage. logging in on every second page is not a desirable option for anything.

Re:mostly not a problem:

[JRSiebz]

And just so you know, the session stuff was encrypted then put into the cookie. I saw some other people comments in the forum.

Re:mostly not a problem:

[EuropeUnited]

At the end of the paragraph, it says that it is ok to store a cookie for:

"[...] sådan lagring eller åtkomst som behövs för att utföra eller underlätta att överföra ett elektroniskt meddelande via ett elektroniskt kommunikationsnät eller som är nödvändig för att tillhandahålla en tjänst som användaren eller abonnenten uttryckligen har begärt."

Wich in english translates into something like "to ease the transmission of a electronic message or supply a service the user explicitly asked for"

When typing in an URL I'd say that one is really rather explicit about asking for that website. And there for a site can store cookies related to it self.

My interpretation of the law is that it forbidds datamining using innocent peoples cookies.

Re:mostly not a problem:

[SmallFurryCreature]

The reason is that if a problem is left unsolved for to long, the extremer the rememedy must become. It has been tried time and time again to get websites to obey the same privacy rules as the normal world. (remember this story is in sweden, not america)

Cookies are often over used anyway. Check youre own cookie cache and check the number that are used to track you vs the number for youre convenience. (like slashdot remembering youre login). For me at least the first category by far outweighs the latter.

Re:mostly not a problem:

[orkysoft]

Seems like this law is all about outlawing cookies that often come with banner ads.

Re:mostly not a problem:

[Joseph Vigneau]

You're wrong.

When you have user log-in to a particular part of the site, you need to store username, password information, and some other session variables in a cookie, so that on subpages within the part that needs to be logged into can check to see is the user is properly logged in.

No, you're wrong. Why should you store all that information in a cookie on the browser? All you really need is a token or key to the data that resides on the server. This is how J2EE web apps (ie, JSPs and Servlets) work. I think ASP works the same way. I'm not sure about PHP, though.

Re:mostly not a problem:

[Anonymous Coward]

I have cookies turned off fo almost all sites. The only cookies I accept are those from my work and my bank. (both are "create account ... sign in" type sites where the solution in sweeden would be to have a checkbox tha "Yes I'll eat your cookies" in the account creation process.

I miss very little in the rest of the internet w/o cookies. Occasionally (very rarely) I hit a site that I am casually browsing that refuses to work w/o cookies. The solution is simple. I leave. (Just as I leave the sites that refuse to work w/o flash or some other brain dead plugin. I just don't care about their content enough to be bothered to accept their cookie. If I did care enough, I'd accept their cookie (and the Sweedish law allows for this)

The internet can be divided into 2 categories. Sites that I care about/have an account with (that I assume would ask if they could create cookies) and sites that I browse casually.

All that this law is saying is that those sites that you pass through casually can't pepper you with cookies to track you. Sites with account logins will ask for your permission and will still use cookies.

Here's a test. Tell Mozilla to prompt before accepting a cookie and then visit a big portal like cnn.com (or even slashdot) You will be amazed by the variety of sites that want to set a cookie on you when ally you did was open a news portal. These are the cookies that Sweeden is outlawing.

Re:mostly not a problem:

[Fweeky]

PHP sessions only store a session key too. The same may not necessarily be said about all PHP developers, of course, but PHP itself isn't *that* retarded (usually) :)

Re:mostly not a problem:

[__past__]

When you have user log-in to a particular part of the site, you need to store username, password information, and some other session variables in a cookie, so that on subpages within the part that needs to be logged into can check to see is the user is properly logged in. I like to check to see if the user is the actual user I think they are.

Why wouldn't you use HTTP authentication to authenticate users of your HTTP app?

I guess you've never used php before.

When your tool makes it hard to use the web architecture properly, maybe you should use a better one. Working against the fundamentals of the environment you are in (like statelessness) will cause you a lot of headache in the long run, like this example shows.

Re:mostly not a problem:

[Ciggy]

Hmmm, just tried the Swedish site and it was my broswer that asked my permission to allow a cookie or not!

Anyway, the Swedish law says that Swedish sites have to offer the option not to allow cookies, but what about non-Swedish sites that a Swedish user may visit? Do the British, American, etc sites have to check for Swedish user and also offer the non-use of cookies?

Re:mostly not a problem:

[Anonymous Coward]

How about:

- unless the user is running a browser which gives you control over how cookies are handled?

- unless the cookie is only for the current session, which is harmless

Re:mostly not a problem:

[CryBaby]

PHP's builtin URL rewriting function does slow things down. That's one (but not the only) reason you should do it in the app itself. It's easy if you think about this *before* you start coding.

Here's a simple version of a function I use to write every URL in a site. This one would normally create fully qualified URL's but you don't have to. $m is for "module" (what many people might call "page" - e.g. "home", "signup", "cart") and this function is intended for use in a centralized-script architecture.

function makeUrl($m, $qryString='', $anchor='', $addSID=1)
{ // Create navigation URL.
$url = URL_ROOT . "index.php?m=$m";
if ($qryString) {
$url .= '&' . $qryString;
}
if ($addSID) {
if (defined("SID") && ($_COOKIE[session_name()] != session_id())) {
$url .= '&' . SID;
}
}
if ($anchor) {
$url .= '#' . $anchor;
}
return($url);
}

The advantage to writing every single URL through your own function is that you can easily extend them later. For instance, the above function spits out regular dynamic URLS but can be trivially modified to support fake static URL's to be used in combination with Apache mod_rewrite.

Re:mostly not a problem:

[Plyschmannen]

Ofcourse not! This law only applies to servers that are situated in Sweden (like any other law in Sweden, it only applies to swedish stuff). So a swedish web server in England would not be illegal.

Re:mostly not a problem:

[Bert64]

In which case, the acceptance of cookies can be part of the signup process.
Cookies have their uses, but in MANY cases they are abused.. a lot of sites store cookies on your machine for tracking how many times youve visited their site, which banner you saw last etc.. this is both intrusive and annoying.
Even so, in the case you`ve described, cookies arent _REQUIRED_... there are ways to get round it

Re:mostly not a problem:

[danny]

I disable cookies by default, enabling them for shopping baskets and forums such as Slashdot, and have rarely had any problems. I estimate that 80% or more of sites using cookies are not doing anything with them that *I* care about.

Re:mostly not a problem:

[Hellkitten]

Will the choice of the user be remembered using a cookie?

It can be done, the first time you visit the site you can get three alternatives:

• Allow all cookies
• Allow the one specific cookie that tells the system you don't want the others
• Allow no cookies

If you choose the last alternative you'll have to answer the question again everytime you visit the site. Unless using a bookmarked url will give the information to the server (eg you are redirected to nocookies.example.com when using the third link)

Re:mostly not a problem:

[Ciggy]

Precisely

Re:mostly not a problem:

[JRSiebz]

I guess I need to look into that stuff. Interesting. Actually I think the cookie i am using is just a session id which corresponds to the session data on the server. When you're throwing together things quickly, sometimes youre just happy that its working, and don't care why. :-) The only point I really wanted to make is that cookies are more than unchekcing a box that says "always keep me logged in".

Re:mostly not a problem:

[JRSiebz]

but the session key, is stored client side as a cookie, and if they dont accept that...boom. You still need something on the client side, even if what it is is minimized. I just don't like that law. I'm not pro-cookie are anything, just like to have the option to use then if i want to. Mmm, me eat cookies.

Re:mostly not a problem:

[JRSiebz]

i just meant session cookies..that are temporary, and so only exist while you're at the site, not for 'evil' use. :-)

Re:mostly not a problem:

[cbiffle]

Wow, what sites have you written? Please send me a list, because I'd love to break into them.

If you're really storing all that information -- username, password, etc. -- in a cookie, you do realize that you're handing it to the user and saying "I trust you not to modify this."?

A more elegant mechanism in PHP is to hand the user a large session identifer and use either PHP's session mechanism or a database table to store the real information. This doesn't even require cookies -- though, as other posters have noted, avoiding cookies requires URL-rewriting, which can be a performance hit.

However, the availability of URL-rewriting demonstrates that cookies are primarily a convenience item for both the user and the programmer. If we get away from PHP for a moment (and please do), there are really nice facilities for this sort of thing in Servlets and J2EE.

Re:mostly not a problem:

[JRSiebz]

Actually I think the cookie i am using is just a session id which corresponds to the session data on the server. When you're throwing together things quickly, sometimes youre just happy that its working, and don't care why. :-) The only point I really wanted to make is that cookies are more than unchekcing a box that says "always keep me logged in". but the session key, is stored client side as a cookie, and if they dont accept that...boom. You still need something on the client side, even if what it is is minimized. I just don't like that law. I'm not pro-cookie are anything, just like to have the option to use then if i want to. Mmm, me eat cookies.

Seems a bit harsh

[Mwongozi]

IIS for Windows assigns all clients an ASP session cookie by default. I'm not even sure how you turn that off. I'm sure other web servers on other OSs must do similar things too.

It annoys me when legal types with an insufficient grasp of technology create laws without realising the consequences. Laws should have to pass through some kind of expert panel first.

Re:Seems a bit harsh

[Anonymous Coward]

How do you know it's based on an insufficient grasp of the technology?

Maybe some expert knew damn well that this would be a kick in the teeth for IIS?

Re:Seems a bit harsh

[thesolo]

IIS for Windows assigns all clients an ASP session cookie by default. I'm not even sure how you turn that off.

If you're using ASP scripts, put in

@EnableSessionState = False

at the top of your page. That will disable the default session cookies.

Re:Seems a bit harsh

[91degrees]

But how are you supposed to know that IIS defaults to always using cookies in the first place? You can't get the answers if you don't know there's a question.

Re:Seems a bit harsh

[Anonymous Coward]

Good ! RIP IIS !

Re:Seems a bit harsh

[ShieldW0lf]

IIS for Windows assigns all clients an ASP session cookie by default. I'm not even sure how you turn that off. I'm sure other web servers on other OSs must do similar things too.

Start -> Programs -> Administrative Tools -> Internet Services Manager

Right Click Website -> Properties -> Home Directory -> Configuration -> App Options

Uncheck "Enable Session State" and hit OK.

Wow, you're legit!

Re:Seems a bit harsh

[Malc]

What annoys me even more is the fact that ASP doesn't have the features of PHP! There's no alternative to cookies. It certainly won't rewrite all the URLs in a page to include the session ID, which seems to be one of the more practical ways of working without cookies.

Re:Seems a bit harsh

[Realistic_Dragon]

It annoys me when legal types with an insufficient grasp of technology create laws without realising the consequences. Laws should have to pass through some kind of expert panel first.

And if you don't know enough about ASP to disable cookies, perhaps your work should have been passed through some kind of expert panel before they let you lose on the internet?

It's always irritating to get a site trying to set a cookie without saying why, and I _always_ block them if they do that. Places like slashdot, who give a reasonable reason for having a cookie set, get unblocked... otherwise they can suck hind tit.

Re:Seems a bit harsh

[Anonymous Coward]

By reading about IIS in a book or on a website? There is extensive documentation for all this stuff.

Re:Seems a bit harsh

[Drathos]

IIS for Windows...

As opposed to, say, IIS for Linux? ;)

Re:Seems a bit harsh

[Anonymous Coward]

Oh that is scary. If you don't know how something works you probably shouldn't be using it. This is not exactly some secret cryptic setting in IIS. Most books and classes cover sessions very early on and explain to you how to disable session cookies.

Re:Seems a bit harsh

[Homology]

It annoys me when legal types with an insufficient grasp of technology create laws without realising the consequences. Laws should have to pass through some kind of expert panel first.

The new Swedish law does not mention cookies as such. The new law is, simply said, a response to the new technologies for collecting/storing/tracking information about private citizens, and the abuse these technologies may be used for. It attempts to give the private citizen some control of what type of information is collected, and what may be done with that information.

In general, it appears the privacy/integrity is more respected/protected in Europe than in USA. While US funds the Total Information Awareness Agency, the German State funds Anonymity is not a crime

Re:Seems a bit harsh

[Anonymous Coward]

I don't remember with ASP but ASP.NET does all you wish and more. You can switch back and forth without changing more than a setting in a config file.

Re:Seems a bit harsh

[Anonymous Coward]

>> It annoys me when legal types with an insufficient grasp of technology create laws without realising the consequences. Laws should have to pass through some kind of expert panel first.

It annoys me when technical people create privacy-intruding applications that track end-users without realizing the extent of the violations they are performing. Software should have to pass through some kind of privacy panel first.

Re:Seems a bit harsh

[91degrees]

Why would I bother reading about it? I have it running. I can view my website. So can other people. Why should I expect it to be in breach of the law with a default setting?

Re:Seems a bit harsh

[91degrees]

Most of the software I use, I use without reading the manual. I have taken formal lessons for none of the software I use.

Re:Seems a bit harsh

[Skye16]

Pshh, whatever. Maybe we just want to setup a dev site on our home computer before we put it up live? Why should we even NEED to go through every goddam setting that IIS may or may not have? Why buy a book? Just install it, php and mysql and you're set. In a situation like this, why in hell would you spend the better part of a week reading a book for something so non-productive? Are you really going to get anything out of a book on IIS whenever you don't plan on ever using it extensively? If it works for your purposes, why buy the book? Why waste the time reading it?

Sometimes you don't need to know how something works to use it. Do you know how a fridge works? Air conditioner? Car? Hair gel? Toothpaste? Toilet? Are you honestly saying that you know every single nuance about everything you've ever - in your entire life - used?

Re:Seems a bit harsh

[ReelOddeeo]

While US funds the Total Information Awareness Agency, the German State funds Anonymity is not a crime

That is because we have not had our Police State experience yet. After the Untied Police States of America comes into being, and then eventually is overthrown, we will value things like anonymity. If we never have this experience, then we might instead just continue to have a gradual erosion of many rights. Of course, I suppose that eventually this would have to lead to the Unites Police States. The pendulum will probably have to swing fully one direction and then back.

Re:Seems a bit harsh

[MeNeXT]

It annoys me when legal types with an insufficient grasp of technology create laws without realising the consequences. Laws should have to pass through some kind of expert panel first.

It annoys me that tech types with insufficent grasp of the law create products or services without realising the consequences.

Most laws in democratic societies do pass through an "expert panel", the problem is who defines "expert". Unfortunately the same cannot be said about products and services, no expert panel required.

Re:Seems a bit harsh

[boomer_rehfield]

ZING! What I'd give for a mod point right now! ;)

Re:Seems a bit harsh

[Anonymous Coward]

It annoys me when someone beats me to the punch and posts almost my exact thought.

I was going to say "It annoys me when tech types, with no social life, create products or services without considering the social consequences".

Re:Seems a bit harsh

[Chexum]

IIS for Windows assigns all clients an ASP session cookie by default. I'm not even sure how you turn that off. ...

Laws should have to pass through some kind of expert panel first.

Excuse me, don't you have it backwards? If you don't know how to turn that off, you are certainly not the right man to require all of us to accept all the cookies fattening our cookies.txt/registry/whathaveyou.

I feel it's equally undesirable for all those sites to require cookies for apparently no reason... No, checking the price of something should not require me storing what color I'm seeing in the background. There are cases when cookies are useful, but just keeping "session" information itself is not a valid one, IMHO. Even if you don't consider that former article about public terminals, it's not obvious that storing cookie in a browser has anything to do about what the browser's owner/current user want to keep, so in a way, this law, while technically dumb, is good in the sense that it forces some to think over what for are they "needing" those cookies.

I digress, but the cookie name is also very unfortunate... It's incredibly hard to translate correctly outside the American culture (does it come from the Cookie Monster?), and in some cases, not translating is much worse... If you say it aloud, Hungarians will think you are talking about a small dick.. (esp. one of a small boy).

Re:Seems a bit harsh

[the endless]

If you're using ASP scripts, put in

@EnableSessionState = False

at the top of your page. That will disable the default session cookies.

Not as simple as that. That disables sessions entirely, not just the cookie.

This basically means you can't use ASP sessions AT ALL. You could have a session-disabled ASP page at the start of your site to present a "do you want to use cookies?" option - but then you've got to code your site without sessions at all.

Even then, on the session-enabled ASP pages, you have to have a check that they've picked the "go ahead and use cookies" option - if they haven't, redirect back to the (session-disabled) option page. I'm not even sure that a session cookie wouldn't be set in the process.

Re:Seems a bit harsh

[SmallFurryCreature]

1. it is not IIS webserver that does this, it is the ASP extension.

2. No other webservers don't do it either. Webserver serve pages, nothing else. They are by far to dumb to know or care about cookies.

So yes PHP when you enable sessions, off by default, also uses cookies (can also work with other methods).

Oh and you can turn it off in ASP. Don't remember the command since I only work with it when the ASP developer is on holiday.

Law should be written to make developers lifes easy? Oh yeah nice thought. Why not rewrite the law to make life easy for companies to make huge profits?

Re:Seems a bit harsh

[CausticWindow]

And Sweden has had a Police State experience?

I think you need to check your facts.

(And no, Sweden were never occupied by Nazi Germany since they were neutral.

Re:Seems a bit harsh

[Pieroxy]

Usually, in a legal matter, ignorance of the law is not an excuse. You're just supposed to know what you're doing.

Re:Seems a bit harsh

[91degrees]

Who's talking about ignorance of the law? The argument is that a laws that implicitely makes it illegal to use IIS in its default configuration is an unfair law. Are you seriously suggesting that I should check all configuration setting in any software I buy, to make sure it is legally compliant?

Re:Seems a bit harsh

[Anonymous Coward]

This basically means you can't use ASP sessions AT ALL. You could have a session-disabled ASP page at the start of your site to present a "do you want to use cookies?" option - but then you've got to code your site without sessions at all.


Right!

Take a deep breath and repeat after me: "Gratuitous session state is a bad thing."

Oh, I'm not saying a login session (for sites where logging in is apropriate) with a few variables is bad, but session state for sites where folks are essentially "browsing through" is evil. Yes, I understand that it is harder to do it right, but the resulting improvement in performance and scalability you get w/o session state is well worth the effort.

If you can do your site w/o session state, you absolutely should do your site w/o session state.

Re:Seems a bit harsh

[Joe U]

"IIS for Windows assigns all clients an ASP session cookie by default."

Only if you are using ASP, and you can turn that off in the ASP code. IIS, by default does not assign a session cookie.

Re:Seems a bit harsh

[Pieroxy]

Yes, I am strongly suggesting that. For example, downloading (and using) Mozilla with the default 128bit encryption is Illegal in France. Though you don't risk too much...

The point is: It is your job and duty to make sure that you are complying with the local law.

The argument is that a laws that implicitely makes it illegal to use IIS in its default configuration is an unfair law

Following your argument, no law should be passed if a software already exists that violates it ? That can't be it right? Software don't make the laws, legislators does.

Re:Seems a bit harsh

[Anonymous Coward]

Exactly. If you don't know and understand how the server you use works, you probably shouldn't be deploying it in the first place. Of course, this is the problem with most of today's admins: They have absolutly no idea how their software works... it's MAGIC!

Re:Seems a bit harsh

[GlassUser]

Eh? ASP can encapsulate PHP and many other scripting languages.

Re:Seems a bit harsh

[91degrees]

Not quite.

The law should take into account the current behaviour of the citizens, and in general should ensure that if most people continue acting in the same way as they always have done, they should not become criminals.

If you download Mozilla in France, without any intention of using the 128 bit encryption, and it doesn't clearly indicate that it uses 128 bit encryption, then I don't think you should be punished. Intent to commit a crime should be a factor in determining guilt.

Re:Seems a bit harsh

[Eudial]

Who would seriously use both IIS and ASP anyway? That's like stupidity^2.

Re:Seems a bit harsh

[poot_rootbeer]

It annoys me when legal types with an insufficient grasp of technology create laws without realising the consequences.

That annoys me too, but what does it have to do with this?

Your line of reasoning seems to be "some vendors' products do x by default, therefore a law that limits the situations where x may be used is unjust because those vendors could be in violation if they don't modify their products to be in compliance."

Re:Seems a bit harsh

[Stary]

They'd like you to think so, yes. Except, it was more of a "Let's call ourself neutral in order to not get our ass kicked" kind of situation, which progressed into a "sure, your nazi soliders can take the train straight across our country but call us neutral" kind of situation.

Alot of people here in Sweden are starting to call for dropping the neutrality clause since it was never actually followed anyway.

And as far as police states are concerned, we've had our touch of recording of "dangerous" people (like communists) by police.

Re:Seems a bit harsh

[thogard]

The US had its police state when it was run by England. Its the reason for most of the items in the Bill of Rights. Check it out some time, its got some interesting concepts.

Re:Seems a bit harsh

[Pieroxy]

New laws are designed to make something that works fine illegal: That's the point of it.

As far as I know, the process goes:
1. People are doing something (ex: setting cookies).
2. The legislator is seeing that as a bad thing.
3. A new law is passed to make the practice illegal.

So if my model is right, ALL NEW LAWS will render an otherwise perfectly legal activity illegal.

Re:Seems a bit harsh

[MntlChaos]

fridge: radiates heat to back of unit from inside using a liquid that carries heat well (freon, for instance), A/C: same idea just with a fan. hair gel: gel hardens and sticks to hair to hold it in place. toothpaste: emulsifies water and sticks to dirt, removing from teeth. toilet: water held in tank, when flushed rushes through, causing water to move through the trap, carrying away any wastes in the toilet and filling with "clean" water OH those were rhetorical questions. oops :-)

Re:Seems a bit harsh

[Anonymous Coward]

Well, the US has over 35,000 law enforcement bodies. The only reason there isn't a police state is becuse they don't cooperate with each other fully.

Besides, how do you define "police state"? The usual definitions seem to include holding people without trial and on unspecified charges without legal counsel, unwarranted seizure of assets, treating everyone as guilty until proven innocent, spying on citizens...remind you of anywhere?

Re:Seems a bit harsh

[Skye16]

;)

And like I said, what about everything else you've ever used? [the general you is used in this instance].

Re:Seems a bit harsh

[91degrees]

They shouldn't make what the majority think is acceptable illegal. Setting cookies that are nver used is perfectly acceptable to just about anyone.

This is why the law allows personal taping of music. People are going to do it even if the law says they shouldn't. They were doing so before current copyright laws were written, and so the law was written to take this behaviour into account. People are going to leave IIS in its default configuration. Saying they shouldn't isn't good enough. The law should take this into account rather than make criminals of people who are not intentionally breaking the law.

Re:Seems a bit harsh

[Omestes]

Wasn't McCarthyism a police state? J. Edgar Hoover collect information on all sorts of "unamerican" activities? America HAS had a police state, and we're getting another one.

Re:Seems a bit harsh

[EJB]

Yes, but if you really had no chance to know, you can sue Microsoft for selling you contrabande software in the first place.

Re:Seems a bit harsh

[boomer_rehfield]

that's great...I thought it was funny and I used my moderation points 15 minutes before so I'm overrated? good job idiot

Re:Seems a bit harsh

[onenil]

All of you with a Windows 2000 / XP machine, with IIS installed (come on admit it, you do!) go into the IIS config console, select your default website (don't tell me you've deleted it), select properties, go to the "Home Directory" tab, "Configuration" button, "Options" tab, de-select "Enabled Session State".

There you go - it's not even up to the developer to disable it then...

Re:Seems a bit harsh

[Anonymous Coward]

I cant see how allowing nazi military transports across Swedish territory as such would violate neutrality as long as the allied forces would not have been denied the same rights.

Being neutral means not taking sides, be it by active measures (fighting everyone) or passive (bending over to everyone).

Clicking on the link...

[Art_Vandelai]

results in 62 cookies being blocked by my browser. Seems these guys have a lot of work to do to comply with the new law :)

Re:Clicking on the link...

[llauren]

If cookies worry you, try the link from one of the advertisements. In includes your hostname or ip address. Even if i know this information gets logged with each web transaction, i still got a hiccup.

• ~llaurén

Happy SysAdmin Day!

Re:Clicking on the link...

[The J Kid]

Well then you must have answerd "yeeh" to the following:

Du yuoo eccept zee fullooeeng egreement, in vheech yuoo let svedeeshcheff.cum lueds toons und toons ooff cuukeees streeet frum oooor brund noo oofee durectly tu yuoor veb soorffer fur nu epperent coose-a et ell?

Didn't you realise?

Re:Clicking on the link...

[AVee]

Yes, but not a single asp or php session id. I didn't even see a single session cookie, only 'make this guy tracable' id's that where valid for years.

This illustrates nicely why i don't understand this kind of laws. I'm allready in the position to decide to accept or refuse cookies from a website. It is and should be up to the client to decide to accept cookies or not, it should not be moved to the server and there isn't any need for a law about it. Even in sweden there can't be much browsers that don't at least provide the option to enable or disable cookies...

Re:Clicking on the link...

[Alkonaut]

Actually the headline of the article reads something like

"New law on electronic communication hard to follow".

Re:Clicking on the link...

[tkittel]

> Du yuoo eccept zee fullooeeng egreement, in vheech yuoo let svedeeshcheff.cum
>lueds toons und toons ooff cuukeees streeet frum oooor brund noo oofee durectly tu
> yuoor veb soorffer fur nu epperent coose-a et ell?

lol :-)

but to be pedantic that looks like dutch and not like swedish at all to me (for some reasons americans always portray swedish as dutch?)

anyway, maybe it is simply because i speak a language similar to swedish (danish*).

* no, not something you eat!

Re:Clicking on the link...

[aed]

Well, being Dutch myself, I can say for sure this does *not* look like dutch :)

Re:Clicking on the link...

[The J Kid]

And with even myself the 'grandparent' poster here, actually being bi-lingual in dutch & english.

I too can say that it does not, in any way, at all, look anything like dutch.

Sorry.

Re:Clicking on the link...

[tkittel]

hmmm... maybe it was just a combination of the many double wovels and my internal narration (or something...)

Re:Clicking on the link...

[The J Kid]

Hey, don't even think of talking yourself out of this one...

You were wrong. Admit it. ;)

Re:Clicking on the link...

[tkittel]

Hey, don't kick a man when he's down, OK? :-)

Great! microsoft.com..piracy.. howtotell..

[jkrise]

Will now compel Microsoft to tell users exactly what information it is extracting.. Great!

We Know Where You Went Today
-

Christ, what next

[joshv]

How is this any different than session IDs stored in URLs - i.e. URL re-writing. Sure, the person can see the info in the URL, but do they understand it any more than they would the contents of a cookie?

-josh

Re:Christ, what next

[truffle]

Cookies can be persistant, enabling you to identify the same user when they leave and later return to your site.

This does not change the fact that the Swedes are dumbasses.

Re:Christ, what next

[kaisa_sosey]

A session ID can be used to track a user within a single session only. Cookies can be used to track users over multiple sessions. From multiple sessions one can build a profile. I think that's the difference.

Re:Christ, what next

[Anonymous Coward]

Ah yes, but URL's are explicitly linked to a browser session and store session-based information.

Close the browser and you're a different user next time you visit the site. Cookies on the other hand can be used to flag you as a returning visitor and link you to databased information more effectively.

Personally, I think this is a little bit too draconian. User can already choose to turn cookies on or off so maybe effort should be made to educate them. Conversely, I can see that cookies may in some remote way be tied in with a country's Data Privacy/Protection Laws, so this kind of action has come about because of that.

Re:Christ, what next

[bigman2003]

But- a lot of 'middleware' (such as ASP and Cold Fusion- dunno about PHP) saves these session variables as cookies on the client machine. So, setting a session variable actually does create a cookie.

Re:Christ, what next

[Anonymous Coward]

And? What's the big fuss about profiling?
As far as I can tell, the only people who have anything to worry about are people who visit kiddyporn sites and then visit a legit site which uses the same cookie scheme. As I suspected, most privacy advocates are just deviants trying to hide their illegal habits.

Re:Christ, what next

[1010011010]

Perhaps the Swedes should make an exception for session-length cookies.

Re:Christ, what next

[Stackster]

I once saw a simple proof-of-concept in which the server could identify the client based on the browser cache.
A (dynamic) HTML page contained a bunch (about 100 or so) of img tags (and recorded which client got which set of img tags, they all had an ID in the URL). The next time the same client loaded the page, it got a different set of ID numbers, some of which were the same, and since those were cached, they weren't fetched from the server. So based on merely what information the client requested (or rather, _didn't_ request), it could be identified anyway.
Sure, some browsers cache things differently (or not at all), and some don't even load images (lynx). But at least it worked with the default settings of the two major browsers at the time (MSIE and Netscape, both 4.something).
IIRC, those 100 img tags was enough to keep track of several thousand clients.

Re:Christ, what next

[Manic Ken]

This does not change the fact that the Swedes are dumbasses.
I really dont like when people generalize. Saying that (in general) swedes are dumbasses is kind of ..dunno..... You can say swedes are (in general, ie the majority) rasist, cowardly (viking rioting small villages, ww2 etc) or something more specific, thats ok. Thats your viewpoint, but calling them dumbasses doesnt give us any information as to what you mean. Dumbasses is such a broad term. Is it only in this context? i.e they wont allow cookies, therefore they are dumbasses! ??

Re:Christ, what next

[Skye16]

It has nothing to do with whether you're doing anything wrong. It's your privacy at stake. Lets say you're in the bathroom taking a shower. A group of people walks in to watch. You're not doing anything wrong - why should it matter to you?

Because it's your private life and you are entitled to your own privacy.

Re:Christ, what next

[Melchior_of_wg]

So what you are saying is that it's only okay to generalize if you are specific? Sweden didn't even exist back in the 800~'s, btw.

PHP and cookies ..

[MadX]

Well at least PHP will offer the option of allowing you to use the session ID as a variable in the request/post string .. ie : page.php?PHPSESSID=xxxxxxxxxx
So you can effectively track the user on the server side like this ..

Re:PHP and cookies ..

[SmallFurryCreature]

yup, track him during a session, not between sessions. BIG difference. Youre method can be used to keep me logged in while browsing. Cookie can keep me logged in between browsing sessions.

So the difference for the consumer? Either login every time, or make a bookmark with the session id included. But I suppose this gives the user a clear choice.

Re:PHP and cookies ..

[onenil]

ASP.NET also allows the developer to choose whether they use the querystring to track the session or cookies. Of course, the overhead in adding the sessionid to all href tags is something you'd want to consider (no matter which platform you're developing on)

What?

[Anonymous Coward]

Do these people not know you can reject cookies with your browser?

Re:What?

[Eric Ass Raymond]

Do you use IE like most people do? You can only block all cookies (and lose the use of your netbank, for instance) or allow all cookies.

Your point is almost the same as the "Do these people not know that you can just delete all that spam you get?"-line that spammers resort to.

Maybe we don't like cookies because we don't like to be pushed, filed, stamped, briefed, debriefed, or numbered? Maybe we don't like having to block cookies we never asked for in the first place.

Re:What?

[ceejayoz]

Do you use IE like most people do? You can only block all cookies (and lose the use of your netbank, for instance) or allow all cookies.

Uh, false?

You can accept, deny, or have IE prompt you for cookies. You can also diferentiate between third-party cookies and cookies from the originating site.

Not only that, but you can override the cookie handling for individual sites - just put your netbank on "Always Allow" and you're set.

People who haven't used IE for years shouldn't go talking about it's features or lack thereof. :-p That said, everyone should use Moz Firebird.

Re:What?

[Mostly a lurker]

Do you use IE like most people do? You can only block all cookies (and lose the use of your netbank, for instance) or allow all cookies.

I rarely use IE and hate Microsoft as much as most people here, but I must correct factual errors. IE allows you to except specific domains from cookie controls.

I am prepared to be convinced otherwise, but this Swedish law seems misguided to me.

Re:What?

[arkanes]

If cookies did any of those things, then maybe it'd be interesing. There's potential privacy issues from cookies (although minor, and tenuous ones), and the law is ridiculously overbroad and overpoweful for addressing them.

Re:What?

[Anonymous Coward]

Excellent reason for making it illegal. You don't see the difference between this and spam? My point is not that all browsers can block cookies, but that there are such techniques. Why not push MS to add that feature to IE instead of making it illegal in one country? It's a completely useless law, as it is.

Re:What?

[LarsG]

Do these people not know you can reject cookies with your browser?

Yes, they do. But they also know that it is often hard for the user to know for which purposes the cookies are used.

This is not an anti-cookie law. This is a law that requires the website to tell the user what the cookies are used for.

Re:What?

[donutz]

That said, everyone should use Moz Firebird.

Everyone should eventually use Mozilla Firebird, but I still come across sites that are either 1) coded specifically to work in IE, or 2) Just plain crash the browser.

I love it, I use it daily, but there's a couple sites where I need to fall back either on Mozilla, or IE. It's not without it's rough edges, at least v 0.6 that I'm using (a latest nightly may be better, who knows).

Re:What?

[ceejayoz]

Everyone should eventually use Mozilla Firebird, but I still come across sites that are either 1) coded specifically to work in IE, or 2) Just plain crash the browser.

Certainly... but it's getting better. I've only encountered two or three sites that were completely unusable in Firebird... woohoo!

Isn't it ironic...

[Ruprecht the Monkeyb]

that the site containing the article tried to cookie me a half-dozen times before loading the first page?

Implied Consent

[Gothmolly]

If you configure your browser to accept no cookies, some cookies, or all cookies, isn't that consent for websites to SET the cookies? Seems to me that this is an attempt to legislate a human problem - people want 'privacy' but are too bothered to keep clicking the button to acknowledge the "this site wants to set another cookie - you already have 12345 cookies from this site. Continue?" button. So the State 'makes' things 'secure' and 'private' by passing a law that says that only 'bad' people will use hidden cookies.
Wake up folks, know how to operate your browser. You can work an answering machine, a VCR, and an automobile, why not a web browser?

Re:Implied Consent

[jkrise]

If you configure your browser to accept no cookies, some cookies, or all cookies, isn't that consent for websites to SET the cookies?

What if your browser came pre-configured?
What if you open Hotmail, and it says you need to enale Cookies to use it?
What if sites used Cookies for purposes other than for the intended browsing experience?

Wake up folks, know how to operate your browser.

More than 60% Slashdotters use IE, use the default settings of Slashdot - /. can simply make the default threshold as -1 and ask users to change it ... why should I learn to use my browser to avoid crooks?

-

Re:Implied Consent

[aziraphale]

> why should I learn to use my browser to avoid crooks?

The car had a lock on it? Well, blow me down - I wondered what that little keyhole under the door handle was. Well, I never. Still, you can't expect me to learn how to lock the car just to avoid crooks, can you?

Oh, you can?

Oh.

Re:Implied Consent

[garcia]

Most people don't know what a this type of cookie is, could care what this type of cookie is, and don't want to know how to disable this type of cookie.

What disturbs me the most is that you people are supporting cookies when you are all privacy freaks.

Not everyone has Konq or whatever other browser lets you block the cookies that you don't want and accept others. Not eveyone wants to download a third party application to do that either.

They want to surf the web, safely, without people storing information about them forever. Granted, most people would prefer that a website remembers them on their next visit, but I think for the general public, if they understood what a cookie does they might be more wary of it. Hell, I deal with 50+ people a day that don't want to fax their CC number to me, you think that they want their person information stored on a webserver tha is easily hacked?

Just my worthless .02

Re:Implied Consent

[Eric Ass Raymond]

So the State 'makes' things 'secure' and 'private' by passing a law that says that only 'bad' people will use hidden cookies.

Why the fuck do you have to write web sites that use cookies in the first place? If I just want to visit a site and it demands that I turn on cookies (or Java, JavaScript or Flash to name a few of my pet net peevees) there is no way that I'll comply. I regularly tell all my friends, coworkers and clients to do so as well.

Re:Implied Consent

[jkrise]

you can't expect me to learn how to lock the car just to avoid crooks, can you?

The fact is cookies are seldom essential, to improve the browsing experience. Car locks serve only to secure the car, no other useful purpose I can think of.
Would you like if you had to use 6 keys to secure your car, and just 1 to open it? Would you like it if you had to change locks and keys every week to ensure no one 'sampled' your key when you were watching a movie?
Can your car key be compromised, except without an identical key, or any other way without your knowledge?

Think before you compare cookies to car locks..
What next, Windows to Linux comparison?

-

Re:Implied Consent

[arkanes]

There's not a damn thing a cookie can "store" that the server can't do better. A cookie can't store anything you don't give it. A website can store whatever the hell it wants that you give it, including things like your CC number, without ever giving you a cookie. Cookies are a smokescreen that people use to bitch about when they don't have anything better to do.

I suspect that you don't know what cookies do or how they work, either. If you did, they wouldn't bother you.

Re:Implied Consent

[alienw]

Does the law require websites to work without cookies? Simply ask for permission and if the user declines, say "fuck off, go surf some other website". Kinda like those click-through EULAs work on software.

Re:Implied Consent

[aziraphale]

you said you wanted to avoid crooks, but didn't see why you ahould have to learn anything to do so. I was merely suggesting that ignorance in any field is a great way to become the victim of someone's malicious intent.

I can invade the privacy of web clients without using cookies. I can do it with cookies. I can also build legitimate applications using cookies. So, why make using cookies harder? Why not legislate for privacy?

The best way for legislation to protect you from crooks is not to ban their tools, which have legitimate uses, but to ban the activities they're engaged in. That way, a crook with a cookie is just a crook.

Re:Implied Consent

[Anonymous Coward]

why should I learn to use my browser to avoid crooks?

Yeah! What he said!
Why should I be aware of my surroundings to avoid being mugged?
Why should I look both ways before crossing the street to avoid being run over?
Why should I breathe to avoid dying from lack of oxygen?

Re:Implied Consent

[mhlandrydotnet]

Wake up folks, know how to operate your browser. You can work an answering machine, a VCR, and an automobile, why not a web browser?

Do you realize how much of The General Public you have eliminated here? I can think of plenty people who would have trouble with answering machines and vcrs, let alone doing something as simple as changing your own oil (!?!?!). Human beings tend to strive towards efficiency. Everyone knowing how to build a car is inefficient. We contract the work out to People Who Know What They Are Doing so we can do other things with our valuable time. The technology sector doesn't seem to be that different.

Re:Implied Consent

[Glonoinha]

-The fact is cookies are seldom essential, to improve the browsing experience.

Actually with the exception of embedding user state information in the url (which pretty much fscks up the url so the user can't add it to favorites or pass it around) it is the only way for the server to maintain state in multi page surf sessions to the same site. You know, like how Hotmail, Slashdot, etc... remember who you are once you put in your username and password (within the same session, not talking about coming back tomorrow - I mean from page to page.)

So yea, it sorta is essential for anything besides a static site showing pictures of someone's dog (ie, interactive sites.)

Re:Implied Consent

[DrEldarion]

Not everyone has Konq or whatever other browser lets you block the cookies that you don't want and accept others. Not eveyone wants to download a third party application to do that either.

Errr, nearly everyone has IE, which lets you do that exact same thing. You can set it to block cookies, then when they're blocked, a little icon appears in the lower right. Double clicking on the icon will let you set which blocked cookies you want to allow.

-- Dr. Eldarion --

Re:Implied Consent

[bigman2003]

Okay- honest question...

Why do you fear cookies?

A few years ago, the public was against cookies. I had users calling me up all the time, because their web browser "didn't work". Frequently, the problem was that they had turned off cookies, and couldn't access a lot of sites.

When I asked them "why did you turn cookies off?" the answer was always the same - "I don't want them to know my credit card number."

I had to tell them again and again, cookies can only store information that you supply. And the site can only access information that it set. (With the exception of things like Doubleclick- but you can turn 3rd party cookies off) Any site you WANT to give important information to, will not be allowing 3rd party cookies with sensitive information.

After a few months of these users having to re-enter their password each time they visited a site, they started to get tired of it, and slowly turned their cookies back on. Eventually, it got down to where only one person still had cookies turned off- I found out he was the 'ringleader' the person who started the whole trend.

This person has always been the least productive member of the group- more concerned about everything else in the world, than getting his job done. I don't think he will ever change, because he is paranoid, but I do enjoy watching him log in to sites all the time, and always give his speech about not wanting them to get his credit card number.

Cookies are generally very safe. For most users, they make using the web far easier, and more enjoyable. This is an area where "what they don't know, won't hurt them" that I fully support.

Re:Implied Consent

[Anonymous Coward]

So yea, it sorta is essential for anything besides a static site showing pictures of someone's dog (ie, interactive sites.)

I've seen sites showing pictures of someone's dog, and it looked pretty "interactive" to me. ;)

Re:Implied Consent

[Anonymous Coward]

He said WORK not build, not maintain, not work on an automobile. I guess it's inefficient for everyone to learn how to read too. =P

Re:Implied Consent

[sultanoslack]

The point is that it's still illegal to steal the car even if you don't lock it. Note that I don't actually agree with the law, but your anology is poor. The govenment is making it illegal to steal the car; you should know that you're supposed to lock it.

Re:Implied Consent

[mattrix2k]

You could use some kinda javascript or hidden form mess to send the session ID as a PUT field without using cookies. :)

Re:Implied Consent

[mhlandrydotnet]

Okay, I'll have an analogy spat with you.

Working a car is quite simple. Unlock the door, put the key in the ignition, make sure you put it in reverse when you want to back up, et cetera.

Working a browser is quite simple. Click on the nice little icon on your desktop, type a url in the address bar, and hit that nifty back button if you want to get to the webpage you were just at.

Working on a car is a little more difficult. Can you take care of all the maintanence of you car? Change the oil? Go for some duel exhaust? How about change the brakes?

Working on a browser is a little more difficult. Do you know how to change your default homepage? Can you delete cookies (much less configure which ones you want and which you don't)? And what the hell is with that Advanced Tab?

Sure, the parent to my orignal post did not specifically mention the word *on*. But I felt that it was implied in the context of his point. All I was trying to say is that people have different areas of knowledge. Just because *he* can easily do whatever he wants with is browser, doesn't mean everyone can. *Just* like not everyone builds a custom hot rod.

Re:Implied Consent

[Xugumad]

I write web applications for a living. The main application I'm working on requires a login. That's fine, but we then have to keep track of who has logged in, and to which account. We could do this by IP, but its insecure (IP spoofing) and would cause problems with multiple log-ins from the same IP (NAT, etc). We could have the user send their username and password as part of each and every URL they request, but that has various problems ranging from passwords showing up in usage stats, to likelihood of being intercepted (most of our users don't use SSL, for reasons not worth explaining here).

Instead, we give them a unique session ID. These are generated to be difficult to guess, making it difficult (if not virtually impossible) for one user to hijack another's session. We then try to give the user this session ID as a cookie. We do attempt a form of fail-over, whereby if the cookie is rejected we write the session ID into all auto-generated URLs, but it isn't perfect. When the browser closes, this cookie is deleted automatically.

So, in this case, what's your objection?

Re:Implied Consent

[AVee]

More than 60% Slashdotters use IE, use the default settings of Slashdot

And the default setting of IE 6 is to refuse all cookies...

Re:Implied Consent

[bentcd]

If cookies are used just as session ids, the problem is miniscule if present at all. When it's used for broad personality profiling, however, they worry me. If you let doubleclick store a cookie on your computer, they will be able to track the sites you visit (those that have doubleclick ads), when, what links you follow on the sites, etc. This is highly undesirable.

Re:Implied Consent

[Xugumad]

Well put, thank you. So what we really want, is a simple way of avoiding profiling cookies. Mozilla gets close, if you block all third party cookies. Alternatively, use Mozilla to block all cookies and then selectively allow sites. Konqueror may be best for the latter - it pops up a requestor when a cookie is received, and allows you to block/allow all cookies from that domain (along with other options.

Re:Implied Consent

[AVee]

Do you realize how much of The General Public you have eliminated here? I can think of plenty people who would have trouble with answering machines and vcrs, let alone doing something as simple as changing your own oil (!?!?!). Human beings tend to strive towards efficiency. Everyone knowing how to build a car is inefficient. We contract the work out to People Who Know What They Are Doing so we can do other things with our valuable time. The technology sector doesn't seem to be that different.

Correct, but that doesn't change the argument. Go to your local car dealer to change oil, go to your local computer shop to disable cookies, fine with me. Or should there be a law that requires all cars to ask wether or not you want to change oil each time you start it? That what will happen to websites unless they use cookies to remember wether or not you want to use cookies...

Re:Implied Consent

[Anonymous Coward]

If you are only using them for sessions, embedding things in urls is a viable option. Bookmarking one of the urls is no different with session cookies than it is with a session in the url. If the session has expired, it creates a new one and moves on.

I know I designed and ran a site used by 10s of thousands of unique users (unique by username and password) that used sessions all over the place yet automatically detected if you enabled cookies and embedded a SID into the url if you had them disabled. And, it only did this when it actually needed to. I.e. the user tried to access features requiring sessions.

Don't claim it to be impossible because you don't want to do it. It is certainly possible and not very difficult if you consider it during the design phase of the site.

Re:Implied Consent

[Big Nothing]

Yeah, let's see what i should do to secure my car - should I allow or disallow the following "keys":

* Signed Active X Keys?
* Unsigned Active X Keys?
* Active X Keys not marked as "safe"?
* Active X Keys not marked as "safe"?
* Java Keys?
* JavaScript Keys?
* Data source accross domains Keys?
* Active Scripting Keys?
* Cookie Keys?
* Cookie Keys from a third-party domain?
* Etc, etc, etc.

Computers are infinately more complex to use than cars - do not make the nerd/geek mistake to assume that just because YOU think something is interresting/simple/rudimentary everyone else will as well.

Re:Implied Consent

[Anonymous Coward]

I think "work" in this particular case is somewhat relative.

With a browser, if one is not concerned with security, then working a browser is simply knowing how to open it and navigate from site to site. On the other hand, if one is highly concerned/paranoid about security then I think working the browser encompasses the ability to disable and enable cookies. If a person is actually worried enough about cookies to want to disable them, then I think it's asking very little of them to learn to "work" their browser to the point of disabling this perceived threat.

Much like, a lot of people can "work" a VCR to the extent that they are concerned with it which is to view tapes, while others can "work" their VCRs to another means which is taping programs or copying tapes. I wouldn't say the first doesn't know how to work their VCR, but I would certainly say that both fall under the realm of working one.

Re:Implied Consent

[connsmythe96]

I have been waiting impatiently to see someone make this point. Thank you for finally saying it.

Cookies are not magic. The only info they can store is tht which the browser sends to the server. They can't download your addressbook or your credit card info or bank account #, etc.

It's true that using an ID allows servers to track where you've been, but only on that server! The default settings in most browsers only allow cookies to be read by the same server that set them. So why is it a privacy concern for amazon.com to know which books you looked at so that they can suggest other books next time you visit?

I don't get it...How is this a concern?

Re:Implied Consent

[Reziac]

I use cookies primarily to avoid nuisance logins (like to Slashdot or the NYTimes) -- in fact, I get annoyed and complain to the webmaster on those rare occasions when my 6 year old NYT cookie fails to work. :)

OTOH, I've seen sites that stored username AND password in PLAIN TEXT, in the cookie. I did wonder if there was such a thing as a "reads ALL your cookies" hook that naughty web pages might do, which might snag such exposed passwords.

Re:Implied Consent

[__past__]

All your problems with changing IP addresses and stuff are already solved:

A user agent that wishes to authenticate itself with a server -- usually, but not necessarily, after receiving a 401 response--does so by including an Authorization request-header field with the request.
RFC 2616, HTTP 1.1

Why the f**k is it so hard to understand how HTTP works? Why do people reinvent it, badly?

It is really simple: When a user wants to see something, he issues a GET. This is idempotent and doesn't carry any kind of state except what the client explicitly provides, like the URI, the preferred format and language, and his credentials. If he wants to perfom some destructive operation, he uses POST, PUT or DELETE. Again, all that's neccessary for the server to know is in the headers and the payload, where applicable.

Listen, web developers: Using HTTP the way it was meant to actually works. You don't need kludges like cookies or GET with lots of parameters where what you do has nothing to do with GETting a resource. It even makes lots of nasty problems go away, like the back-button breaking your app. Try reading and understanding the actual specs, or the diss of the guy who wrote (some of) them.

Re:Implied Consent

[neves]

This isn't implied consent. This is one of the worst interfaces ever done. You just have to refuse each cookie when the companies that make the browser are more interested in content providers profits than in the user privacity. Look at all these opensource browsers where you can, with just one click, refuse all cookies from a domain.

Re:Implied Consent

[Anonymous Coward]

Konqueror may be best for the latter - it pops up a requestor when a cookie is received, and allows you to block/allow all cookies from that domain (along with other options.

In what way is that different form Mozilla?

Re:Implied Consent

[amcguinn]

This law is beyond insane. Being sent a few bytes of gibberish, called a "cookie", does absolutely no harm to anybody. The only reason it has any effect on anyone is because they are choosing to run a piece of software (called a "web browser"), which is designed to send that cookie back to the host who originated it with any other requests.

If you don't want that to happen, choose not to run a piece of software designed to do exactly that.

If some loony thinks that that is such a dangerous situation that citizens ought not to be exposed to it by the mere act of running the browser that came with their PC, then its still not the fault of the web site, it must surely be the fault of the browser manufacturer -- he is the one who has made the poor user vulnerable to this terror.

I thought the anti-deep-linking morons were bad, but this is about three times worse.

Re:Implied Consent

[Xugumad]

Two problems. Firstly, that involves sending username and password with every request. The more modern "Digest" authentication may solve this problem, but wasn't actually supported by anything, last time I checked (admittadely that was a while ago).

Secondly, and more significantly, we allow users to authenticate themselves in several different ways (against university wide ITS' LDAP server, the department's LDAP server, or against an application-specific authentication server), and there is no way that I'm aware of including that selection in the authentication request. The idea of making user credentials of the form <username> "@" <auth type> did occur, but I suspect the user's wouldn't appreciate it.

Seperately, in most cases authentication is managed by the web server - because we use servlets, we can have it managed by the web application, but I believe that its quite tricky to do under, for example, Apache. Anyone want to tell me I'm wrong?

Poor Swedish website designers

[Eric Ass Raymond]

Awww... poor Swedish website designers.

I don't really think this matters that much. Especially, if you use something like Mozilla that can selectively block cookies. I let in cookies only from my netbank and Slashdot. If some other site won't let me in without cookies, they won't get a hit from me then.

Re:Poor Swedish website designers

[scalis]

So do I and I rarely have any problem visiting any site. That must mean that most of the cookies out there has no real meaning.
Also the law text has some loop holes such as (my translation):
....this must not prevent any storage for technical reasons that is necessary to carry out or help a communication or something that is absolutely necessary to deliver a service that the user has explicitly requested.

All this means is that you can never set a cookie for tracking purposes or to generate banner ads for example unless the user has given his consent. also the text says that: ...lesser violators will not be held responsible.

Misspelling?

[upside]

"The law comes into force today"

Shouldn't that be "comes into farce"

?

Dont need to use cookies

[indiancowboy]

How about just URL re-writing? That would be equivalent to session cookies.
Rest of the data required by the sites should anyway be stored in their database and used only when the user 'logs-on' to the site or indicates to the site in some way who he/she is.

Finally

[Anonymous Coward]

Finally someone is doing something for the extremely stupid idea of the cookies !

dumb but not a big deal

[truffle]

There's no need to rewrite your site, just direct any visitor to this splash page. If they don't choose to use the cookies, they don't get to use your site.

Sounds a bit harsh, but speaking as a Web developer, if you're working with a non static site it's simply too much of a pain to produce a good site. It's not impossible, it's just a huge pain. Almost all users will accept the restriction of cookies.

A few years ago I wouldn't have said this, but browsers today who refuse to use cookies are just cutting themselves off from a large part of the Internet. Let them cut themselves off. When they're ready to join the rest of us, they're welcome to.

As for privacy concerns, Mozilla has a nice warn-me-before-storing-a-cookie mode. Here's a clue for the Swedes, it should be the browser manufacturers providing consumers with options to protect their privacy.

Re:dumb but not a big deal

[traindrv_]

The only problem is then with deep links - if someone links to foo.asp, then the server must check if they have a cookie from the site, if not redirect them to a cookie permission check page and then back once they have a cookie (I guess like the NYTimes login).

Re:dumb but not a big deal

[Anonymous Coward]

I feel very sorry for your clients/company, if you truly are a web developer as you offer NO rational reasons for denying users and potential customers access to a site.

As others have mentioned, it is perfectly simple to configure your web server to rewrite URLs instead of using cookies to store session information - at least for PHP and JSP.

You'll miss out on all those nice extra cookies from banner/add servers, but I think that is a fair price to pay...

Also, I make it a point NOT to buy stuff from sites that force me to accept cookies, so I guess you're SOL when it comes to my business

Re:dumb but not a big deal

[arkanes]

That would only be a problem if it were hard. Since it's trivial, there's no problem.

Re:dumb but not a big deal

[hswerdfe]

ok lets say I am using Mozilla and I get this warning that some website, wants to store a cookie on my machine.

how do I know if I should let it?
I don't know what its tracking or what it will be used for.

there needs to be more information than just its a cookie.

Re:dumb but not a big deal

[Glonoinha]

Actually it is even easier than that.

Just host your site elsewhere. Given the hourly rate for rework, and that the entire damn site is going to be rewritten to come up with a hack that simulates session state cookies ... be easier, faster, and less prone to errors simply to have it hosted in some other country. No brainer. // Assert(girl && geek && bi && cute && humble)

boolean Assert (boolean lotsOfThings)
{
Assert = false; // if you gonna dream, dream big.
}

Re:dumb but not a big deal

[Swamp]

Agreed. Life is too short to spend time adding URL re-writing to sites for the 0.01% of people who object to cookies on moral principles.

Besides, you *can* track users from their IP address. It's not very accurate (corporate firewalls, DHCP dialups etc), but you can still do it. Indeed, IP address + User Agent is the *standard* way that unique users are measured in the UK web advertising industry for instance. So you are sill being tracked even if you don't have cookies.

Re:dumb but not a big deal

[m00nun1t]

Try ASP.NET. It has a non-cookie mode where it inserts a guid into the URL automatically. You can switch from using cookies to not using cookies (but still preserving state) in seconds - literally - no recoding required at all.

I believe it looks at the referring URL, gets the GUID, and then insert the guid into the response in the format:
http://domain.com/yourfolder//page.aspx

Re:dumb but not a big deal

[bigman2003]

I'm really glad that you make it a point not to buy things from places that require cookies.

Personally- if a site doesn't offer the option to 'remember' who I am, and I need to sign in each time- I stop going there because it is a pain in the butt.

So we are supporting different sites- isn't that great?

Twenty to one says I (and people who do accept cookies) spend a lot more money on the web than you do. So as long as we keep supporting our respective sites, natual selection will work this whole mess out.

I've got thousands of cookies on my machine, from places like Amazon, Ameritrade, Ebay, EBGames, Wellsfargo, Netflix, Network Solutions, Round Table Pizza, Slashdot, Target, Tower Records, Trekbikes, Cingular...

Each is a place where I have spent money on-line in just the past two months or so. Oh, and I've got some porn sites too, but I didn't spend money there.

Sure- don't visit sites that use cookies, you're probably a pain in the ass customer anyway.

Re:dumb but not a big deal

[burbilog]

There's no need to rewrite your site, just direct any visitor to this splash page. If they don't choose to use the cookies, they don't get to use your site.

Sounds a bit harsh, but speaking as a Web developer, if you're working with a non static site it's simply too much of a pain to produce a good site. It's not impossible, it's just a huge pain. Almost all users will accept the restriction of cookies.

You are simply wrong. Non-static pages without cookies are very easy to implement, just look at Zope's cookieless session manager. Similar programming style can be adapted to any tool, not only Zope.

Now only if some webmasters cared about catching whole audience at all...

Re:dumb but not a big deal

[thepler]

...but browsers today who refuse to use cookies are just cutting themselves off from a large part of the Internet.

This does not agree with my experiences. I refuse all cookies (via the mozilla pop-ups). If a site breaks or tells me they need cookies, I turn them on for that site. So far I've only had to do so for a handful of sites.

Re:dumb but not a big deal

[Anonymous Coward]

Allow me to reply as I wrote the parent post even though that's difficult to verify (anon@work) :-). Probably a troll though...

Anyway, I didn't know that having thousands of cookies stored on your system was something to brag about - even be proud of as your post implies.

Hmm, I recognize a few sites on your list that I also happen to frequent for buying stuff. I guess I must be special because they work fine for me even though I, gasp, block cookies.

I'm almost tempted to take your odds, but I'm not in the habit of betting people who post juvenile I-am-better/holier/whatever-than-you nonsense on /. And we all know there are a lot of them here, right?

Stereotyping me without any prior knowledge of my actions past and present makes you and your post look so much smarter, no? I CAN be a pain in the ass customer though, if subjected to lousy service.

Keep trolling - your nick certainly accommodates such endeavours.

Re:dumb but not a big deal

[Anonymous Coward]

A few years ago I wouldn't have said this, but browsers today who refuse to use cookies are just cutting themselves off from a large part of the Internet. Let them cut themselves off. When they're ready to join the rest of us, they're welcome to.

If you use "proxomitron" one of the options is to return a false cookie, which fools most sites without affecting your browsing.

Re:dumb but not a big deal

[truffle]

As previously discussed, this does not allow you to maintain state if the user leaves and subsequently returns to your site.

It also disallows web caches like SQUID which are used to improve performance. Your cookieless session manager dies the second anyone follows a static link that does not include the session ID encoded into the URL. This is not an issue for small sites, but for large sites it is.

I prefer to let my customers surf the way they want to, without the inconvenience of restarting their session from scratch.

I prefer to not buy more web servers because I can't use a web cache, or provide my surfers with a slower web surfing experience.

I'll keep using cookies.

Re:dumb but not a big deal

[Anonymous Coward]

That's been my experience as well. A relatively small number of sites (I'd say something less than five percent) don't work correctly if cookies are disabled. Most work fine.

What's most interesting is visiting several sites which present similar content, say classified advertizing. The observation that most do fine without cookies suggests that the ones which don't suffer from flawed design. The site has so cleverly decoupled the network service from the database that they are no longer able to model the concept of a session.

The Web developer who started this thread seems to find it a "huge pain" to track sessions on the server, which is the only place they are needed, and therefore where they belong. It seems to me that he's working from a false premise. My client does not exist to make his server easier to code.

Re:dumb but not a big deal

[Anonymous Coward]

"...it should be the browser manufacturers providing consumers with options to protect their privacy."

Which is impossible to legislate and enforce since, AFAIK, there aren't any browsers written in Sweeden. The Sweedish government can put restrictions on the behaviour of web publishers in their country, however. The aim of this legislation is to provide a framework to protect privacy in a manner which is enforcable by law.

The other point is that the vast majority of computer users don't know (or even care) what a cookie is, why they can be a privacy risk, which cookies to trust, or why they have such a dumb name. Its a question of whether its easier to try to educate the masses or moderate the behavior of the few.

"...speaking as a Web developer, if you're working with a non static site it's simply too much of a pain to produce a good site. It's not impossible, it's just a huge pain."

Well, its a huge pain for me to go out and earn the money to buy a car, so perhaps I should steal yours. Bad analogy, perhaps, but just becuse something is a pain doesn't mean the alternative should be open to abuse, juts as a law making your work harder doesn't give you justification for breaking that law. Unless you work in Sweeden this won't affect you anyway.

"...browsers today who refuse to use cookies are just cutting themselves off from a large part of the Internet. Let them cut themselves off. "

Which contradicts what you say about having browsers provide security. The whole point is that Sweedish users don't have to turn off or filter cookies, because websites will warn them what informaton is being collected. You can't have it both ways.

Re:dumb but not a big deal

[lemonjelo]

A few years ago I wouldn't have said this, but browsers today who refuse to use cookies are just cutting themselves off from a large part of the Internet. Let them cut themselves off. When they're ready to join the rest of us, they're welcome to.

Most the sites I've come across that really have the information I want, rather than a sales pitch, work with no or one (login) cookie. I typically block cookies from a domain until I find that I want to be known to the site and it proves useful to me personally. So if I get a splash page saying I need to allow a dozen cookies from a site, and have no evidence the content is worth going through my browser's settings to change policy on that domain, I would choose not to visit the site.

Does this mean I'm cutting myself off from the majority of the internet? *shrug* Does this mean your site gets less visitors? Yes.

A special web page

[A55M0NKEY]

A special web page where the user can choose whether or not to recieve cookies. What a good idea! All a web site needs to do is save the 'don't give me cookies' preference in a cookie and... wait.... Um.....

Re:A special web page

[Anonymous Coward]

All the website has to do is throw the user to that page if cookies are not enabled. If they persist in trying to get on the site, they keep getting thrown to that page.

It doesn't have to be more stateful than that.

English version...

[jmo_jon]

Post och Telestyrelsen (the authority enforcing the law) has an english version of the "info text" needed for using cookies

Figures

[lrandall]

Isn't the cookie monster also from Sweden?

I do..

[tka]

..not believe this. *If* such law exists I think that swedish will not obey it or do they simply deny put Cookies: yes/no dialog at the start page. If you choose no then you will redirected to slashdot.org.

Legislating around IETF standards

[aziraphale]

I've said it before and I'll say it again - the terminology employed in internet law as it relates to internet standards is seriously screwed up.

What they're legislating here is that before a server transmits an HTTP response featuring a Set-Cookie header, they must send a prior (human readable) HTTP response to the client saying that they'll be sending a response with a Set-Cookie header along next if the client doesn't mind.

This is ridiculous - there's no law saying a client must obey set-cookie headers, there's no reason for Set-Cookie headers to have any more legal status than Cache-Control headers. Set-Cookie is just a suggestion from the server to the user agent that it would help the server if the user agent remembered the attached cookie data, and sent it back in a cookie header with any subsequent requests.

Set-Cookie is a request, not an order. If the client chooses to accept the cookie, that's the client's business. If the client chooses to ignore the cookie, so be it.

Legislation doesn't belong in this field. The protocol provides for the situation where the client has privacy concerns about the server. legislating to effectively override IETF standards is a dangerous direction to go in.

Re:Legislating around IETF standards

[Planesdragon]

Set-Cookie is a request, not an order. If the client chooses to accept the cookie, that's the client's business. If the client chooses to ignore the cookie, so be it.

There are neither requests nor orders between computers; only commands.

Unless a computer is told to specifically not do something, it will do what it is told.

Re:Legislating around IETF standards

[aziraphale]

Read the RFCs. A Set-Cookie header is just a header. The behavior of the client is then covered by the RFC. It MAY choose to accept the cookie. It MAY choose to ask the user of the client whether to accept the header. It SHOULD have a facility to allow the user to reject all cookies. The RFC nowhere says MUST. In other words, the way the standard is framed, a Set-Cookie header is a request, not a demand.

Re:Legislating around IETF standards

[GammaTau]

What they're legislating here is that before a server transmits an HTTP response featuring a Set-Cookie header, they must send a prior (human readable) HTTP response to the client saying that they'll be sending a response with a Set-Cookie header along next if the client doesn't mind.

So, what's the essential difference to SMTP and opt-in legislation? Opt-in requires the consent of the recipient before any advertising can be sent. It is possible to configure SMTP server to reject messages just like it's possible to configure a HTTP client to reject cookies. Following your logic, it would be dangerous to regulate any SMTP traffic (whether opt-in, opt-out or whatever) because people can choose whether to receive messages or not.

This legislation is about what people use technology for. You can't know what cookies will be used for just by looking what browser tells you about a cookie in a warning dialog. It's not about modifying protocol through legislation. It's about what people do with technology.

That said, I'm not sure if this legislation is such a good thing.

Re:Legislating around IETF standards

[aziraphale]

This is where laws like the UK Data Protection Act come in. Legislation dealing with specifics, like 'consent for cookies', miss the bigger picture, and make using cookies for little, non-privacy-infringing tasks harder. The goal of the legislation should be to prevent privacy infringements - not cookies.

Re:Legislating around IETF standards

[Anonymous Coward]

Absolutely correct. Indeed most browsers allow you to configure this behavior.

What the Swedish government could have done that would have made more sense is to require browser makers to have this option visible and off by default.

What would have made even more sense is to let individuals (gasp) decide for themselves.

Vote anti-government, kids.

Re:Legislating around IETF standards

[aziraphale]

> Following your logic, it would be dangerous to regulate any SMTP traffic (whether opt-in, opt-out or whatever) because people can choose whether to receive messages or not.

Slightly different; when I make an HTTP request, I'm expecting an HTTP response. No web server sends out unsolicited HTTP responses to clients on the offchance they'll pick them up and set a cookie :)

HTTP responses are always solicited, including a Set-cookie header in there is not a huge burden on the client. SMTP servers are servers, obviously, so take a somewhat different role.

By having an open port 25, just like having an open port 80, you are inviting people to submit packets to you. So SMTP servers, just like web servers, should expect to receive requests. They may choose to reject those requests, or process them, in accordance with the various RFCs that exist, but they certainly can't expect to have any control over what requests they receive in the first place.

Legislation should only be about what people do with technology, not about technology itself. Legislating that web sites must obtain permission before using cookies is different to legislating that web sites must get permission before storing permanent records of a person's name and address. Similarly, legislating that you must have someone's explicit permission before sending them an email advert is fine; legislating that you must have their explicit permission before opening a connection to port 25 of their server is not.

I hope that clears up where I stand..

Re:Legislating around IETF standards

[Homology]

Legislation dealing with specifics, like 'consent for cookies', miss the bigger picture,

The law does not deal with specifics at that level. What will happen is that there is a Goverment agency interpreting the law and give regulations/rules when new technologies appear.

Re:Legislating around IETF standards

[Matt2k]

Engineers often fall into this trap, you're narrow-focusing on the problem to the point that you're missing the big picture.

This doesn't have anything to do with the legislation of a standard internet protocol, it's about presenting the end user with an informed decision to accept or reject a cookie. I don't believe that the law is saying sweedish web browsers have to handle the implementation any differently, no? Just because an RFC defines a set-cookie as a request to the client, doesn't mean that the 'client' is in a position to make an informed decision whether to accept. All this worry about trying to legistlate a protocol is missing the point, you're getting too tangled up. Step away from the computer for a while and get the big picture.

Spam is kind of the same thing. We're trying to create a metaprotocol on top of SMTP-- Hey, you can't send me that mail unless I've personally signed up for your commercial mailing list! You don't have a similar problem with anti-SPAM movements, do you? (Feel free to draw a comparison between spam and unwanted cookies)

I'm not saying the law isn't unneccesary or drafted by people who don't understand web technologies, but let's argue it in the context of personal responsibility and education rather than meaningless protocol mumbo-jumbo.

It seems a fair trade off would be to force sites that set a cookie to provide a link to explain which cookies are set. This link would have to be viewable from any page, probably stashed in the footer somewhere.

Re:Legislating around IETF standards

[Nucleon500]

Computers function as they are designed. Hardware is (usually) designed to obey the software it runs, because it's more flexible that way. Software is not designed to obey communications from random servers on the internet, because that would be completely and utterly braindead. When software does obey these random computers, it's called a remote root exploit.

You wouldn't happen to be a Swedish legislator, would you? It would explain a lot.

Re:Legislating around IETF standards

[Planesdragon]

When software does obey these random computers, it's called a remote root exploit.

Yes, it is. And it's still a command given to a computer that executes it without any thought or choice.

Actually, it's not a "remote root exploit" unless you're runing a system that actually has "root." It's just an exploit. ;)

A compromise solution

[mikech@rbsgi]

A compromise solution would have been to disallow cookies that live longer that the user's session. Session cookies are very useful for JSP, PHP, etc. Long-lived (persistent) cookies are the real concern of the privacy folk. I'm surprised that no one presented this.

Re:A compromise solution

[Anonymous Coward]

Just a short tip: you can do this with Netscape/Mozilla by "locking" (a Mac term; on Windows making the file read only) your cookies file. You can open it back up if there is persistant cookie you want to accept (for example, I wanted to store my Yahoo groups login in a cookie) and then lock it again. If you accept all cookies and yet keep the file locked Mozilla will pretend to accept the cookies but really the file isn't updated. I have been doing this for years (since Netscape 3 I think) and have found this to be the best method of operation. I'm surprised more people don't do this.

Re:A compromise solution

[NFNNMIDATA]

I feel like I should mention that session cookies don't even get written to disk, so does this law affect them?

Re:A compromise solution

[Anonymous Coward]

Um. How about just checking/unchecking the box that enables cookies "for the current session only" (Mozilla Firebird 0.6)

Just use Java Web Applications ;-)

[javatips]

This represents a huge problem for swedish sites which use .asp and .php session variables.

Just use Java Web Application with JSPs. They automatically handle the generation of sessionId with cookie or URL rewritting without any modification to the source code. :-)

Re:Just use Java Web Applications ;-)

[Marcus Green]

I'd be interested to know how you can use JSP to automatically do URL rewriting without modifying code. Last time I looked you appeared to need to write code to ensure URL re-writing occured.

Re:Just use Java Web Applications ;-)

[Anonymous Coward]

Use taglibs to handle URLs?

Re:Just use Java Web Applications ;-)

[javatips]

Just use taglibs (as suggested by the AC poster. Anyway, if you follow the spec when coding you JSP and/or servlets, then you should use encodeURL() to encode all URLs.

Here is a snippet from the Servlet API HttpServleResponse.encodeURL(String) :

For robust session tracking, all URLs emitted by a servlet should be run through this method. Otherwise, URL rewriting cannot be used with browsers which do not support cookies.

Re:Just use Java Web Applications ;-)

[Marcus Green]

So its not a case of "just use Java Web Applications", it is a case of writing your code in such a way that the URL's are re-written. Also exactly which version of taglibs supports this and how widely implemented is it on commercial ISP's at the moment.

What about your trusty DB?

[neflyte]

Why not simply store session information in some backend database and pass the session ID along on the URL? Problem solved :) Besides...cookies can get messy. Y'know, with all those crumbs laying around (i.e. spyware, ad trackers, etc).

Re:What about your trusty DB?

[arkanes]

URL session tokens are quite a bit less secure than cookie based ones. I know of at least a couple online webstores that allow session hijacking through thier JSP URL tokens. (You're shopping. You see X item. You cut & paste the link to your friend so they can look at it... now you're both shopping in the same session...)

Re:What about your trusty DB?

[neflyte]

You could always store the Session info along with something a bit pre personal...like the source IP, or maybe have all users authenticate with some login & password?

It does seem, however, that the more one tries to move away from cookies, the more complex the code has to get in order to keep security and whatnot.

Re:What about your trusty DB?

[XMunkki]

I think that it's actually more insecure to pass the session ID in the URL rather than to store it in a cookie. This is because many people like to send links to a site to friends and such. If there's a session ID attached in the URL, many people will not understand this. And someone with fast reflexes may abuse the current session.

Legistrations such as this one simple promote wrong technological solutions to wrong problems (the problem is not with cookies as a technology, because it's a voluntary action on behalf of the CLIENT).

Re:What about your trusty DB?

[Anonymous Coward]

Great - you've just prevented people from adding pages in your site to their favourites, so they won't be able to come back to your site once they want to buy something and they'll go elsewhere. Nicely done!

Re:What about your trusty DB?

[arkanes]

That is, after all, why they were invented in the first place.

Oh, and while storing the source IP is a partial solution, it's not 100% (think people behind a common proxy), and the whole point of the session id is that you DON'T re-enter your user/pw at every page. Cookies are the best, cleanest way to maintain state over a session. They're even better if you want to maintain state over multiple sessions (on the other hand, this can be dangerous and I'm not sure that it's usefull enough to outweight the security and privacy concerns).

Bigger security risk

[mgkimsal2]

There's a greater chance that your session would be hijacked accidentally if you fwd a URL that has your session ID in it to someone else.

Re:Bigger security risk

[Tarpan]

Only if you use a brain damaged session ID system, where the secret part is the id. A far better way is to tie the id to a specific ip.

Re:Bigger security risk

[maharg]

A far better way is to tie the id to a specific ip.

Wouldn't this present a problem where the user is behind a proxy ?

Re:Bigger security risk

[Anonymous Coward]

What if the IP is a proxy server for several computers?

Re:Bigger security risk

[Tarpan]

Yes, but it is still better than let everyone access it as long as they know the ID string.

Re:Bigger security risk

[maharg]

ah - I see - compare the ip address on subsequent hits to the ip address of the originating hit.

OK - wouldn't that be a problem where the user is behind *multiple* proxies, so the ip address that the website sees could change from hit to hit ?
(I'm behind such a set of proxies right now..)

Re:Bigger security risk

[Isofarro]

[tieing a session id to an IP address]

Wouldn't this present a problem where the user is behind a proxy ?

Indeed it does. AOL for example uses a number of caching servers, and one user uses a number of different caching servers during his visit. So by tieing a session id to an IP address effectively prevents users of AOL and other large ISPs from using a website.

Re:Bigger security risk

[Tarpan]

Hmm... Yes that would be a problem, the sollution would either be to annoy the user by throwing them out as soon as they change proxy (which is not a good thing) or maybe have a checkbox or similar that makes the session not tied to an ip. And inform the user that this is not a good thing.

There is always a way around problems, in this case it would just have been a lot easier to just set a cookie. (Yes, cookies can be forged, but if you post the link somewhere they wont get the cookie or see the ID and hence it is a lot harder to forge it)

Re:Bigger security risk

[tomhudson]

Poster wrote:

There's a greater chance that your session would be hijacked accidentally if you fwd a URL that has your session ID in it to someone else.

Not really. First, the session id is only good for that session. Once you (a) log out, or (b) time out, the session ID is no more good.

Second, there's no real reason to forward a url from pages that require cookies (since you, presumably, want personalizations for those pages). More likely, you'll be forwarding urls from pages that don't require cookies. If you really want to forward a page w. a url, you can always edit the url before hitting the "send" button.

Third, you can always improve your site's security by doing the following: when the person requests a page, get the old session id. It's valid? restore the session. Now, remove the session, and create a new session (now have a new session id). They can forward pages with session ids to their hearts' content, since each id is only valid for requesting the next page. The only drawback (and it's actually a benefit for web-based apps) is that the user can't hit the back button - the previous pages' id is no longer valid. This will actually keep your apps' state consistent :-)

Re:Bigger security risk

[Punk Walrus]

So by tieing a session id to an IP address effectively prevents users of AOL and other large ISPs from using a website.

Most cacheing systems (expecially AOL's) are a little smarter than that. They store only static sites, not any site that has a php, asp, or anything with a cgi, or at the very least, anything with a "?" in the URL. Otherwise, all web boards, search engines, and other dynamic sites would be rendered useless. You would go the weather.com and only see the weather 24 hours ago (or whenever the last fetch was made), for example.

For example, having worked with cacheing systems, I know that nothing on CNN was cached locally, which is why CNN (and most news sites) slowed to a crawl during 9/11, but other non-9/11-related sites were fine. Almost all news sites have dynamic pages, and will not be cached.

Re:Bigger security risk

[Isofarro]

Most cacheing systems (expecially AOL's) are a little smarter than that.

I didn't make myself too clear there! One visit from an AOL user produces a range of requests from more than one IP address - probably as a result of load-balancing on a collection of proxy servers. Whether AOL decides to cache the page or not matters not. Since each request may come from a different IP address than the original request, then tieing a session id to an ip address is going to declare the session invalid for that particular user.

A better solution would be to tie the session ID to an ip range big enough to include all the AOL proxies a particular user could come through.

Re:Bigger security risk

[Anonymous Coward]

An easier way is to not tie to an IP address, since that can be problematic, but rather tie to a browser string. This is slightly less secure, of course, especially in a corporate setting where they are all expected to have the same browser version. However in a corporate setting their IP might appear the same to the outside world, so the point is moot. Also make sure those sessions time out. Most likely if I do accidently send someone and email with a session id in it, by the time they read it, the session will have timed out.

Re:Bigger security risk

[BrokenHalo]

There's a simpler way round all this from the end-user's perspective. I have no requirement for cookies to exist beyond the current browsing session, so I just symlink my cookies file to /dev/null. On a winbloze box you can simulate this with Mozilla/Netscape by creating an empty directory called cookies.txt in the appropriate place. I've no idea what to do with IE, though, since I don't use it.

Obviously, you have to either close the browser or use a cookie manager to get rid of the cookies in memory, but still...

Re:Bigger security risk

[dagnabit]

by tieing a session id to an IP address effectively prevents users of AOL and other large ISPs from using a website.

At least for the AOL part of that, is that such a bad thing? :)

Re:Bigger security risk

[Anonymous Cowdog]

You are asking, is it such a bad thing that AOL users are prevented from using a site?

In a word, yes.

The Internet reaches its highest potential when all users, even those that others might consider somehow lower caste, are able freely to read and contribute.

In some places, only AOL provides reasonable access to the net. And some people have to live with that. And some of those people, someday, maybe even today, will have great contributions. But perhaps even greater is the gestalt of full participation, and the value that provides to the entire Internet.

Re:Bigger security risk

[Anonymous Cowdog]

By the way, in my previous reply to your post, yes I did see the humor, but there is also an underlying issue for which I wanted to give a serious reply.

Re:Bigger security risk

[CryBaby]

Not if your site is designed properly. Take a typical ecommerce site for instance. First of all, use query string session id's only in non-critical areas of the site so that the most information a hijacker would see is the legitimate visitor's personalized content (e.g. your name, as in "Hello CryBaby, welcome back to BangkokLadyBoysForSale.com") and maybe the contents of their shopping cart. Second, force visitors to re-enter their password when entering critical areas of the site (like account maintenance and checkout) and pass the session id forward through form fields via POST (over SSL of course), not URL's. Third, remember to never pass any actual user information, like user id, pass etc., in URL's or form fields. Tie in user info based solely on the session id. Fourth, you can pass a message authentication digest along with the session id to prevent random hijacking. I only find this useful in critical or sensitive areas of a site, but you could do it everywhere. I design every site to use cookies when available but to support cookieless sessions otherwise. If done properly, there is ZERO reduced security but severely reduced customer service BS and increased sales/traffic. See amazon.com for an example of the above methods (Yeah, like any web programmer worth their salt, I basically copy Amazon). Requiring cookies for proper functionality is no different than requiring JavaScript - sure sign of an amatuer coder. (OK, there are always exceptions, but I'm talking generally about "industrial-strength" public sites)

Re:Bigger security risk

[Cranx]

Indeed it does. AOL for example uses a number of caching servers, and one user uses a number of different caching servers during his visit. So by tieing a session id to an IP address effectively prevents users of AOL and other large ISPs from using a website.

No, not really. Only the session ID needs to be unique, the IP address only needs to match. Each user behind a given NAT/Firewall will have their own unique session ID, so it doesn't matter that they share the same IP address, just so long as each time they pass their session ID to the web site, they do so from the same IP address when the session was created. IP addresses don't need to be unique.

However, while this protects you from other people on the internet from hijacking your session, anyone inside your NAT/Firewall could hijack it, if they knew the session ID.

Re:Bigger security risk

[Anonymous Coward]

Proxy farms don't guarantee that any client's traffic will all be relayed through one particular proxy. Since HTTP is stateless, they can do that, and any origin server that can't cope with it is fundamentally broken.

Re:Bigger security risk

[Cranx]

HTTP is stateless, but that is a description of how HTTP usually works, not a guarantee or a parameter.

Sessions are non-stateless, and so there is an inherent conflict between what is expected of HTTP (stateless and discrete) and what is actually happening during a session (non-stateless).

If someone designs a network holding HTTP's stateless nature as a hard and fast rule, and thus assigns differing external IPs with each HTTP request from a client inside the network, then I would say that network was designed without taking the possibility of non-stateless HTTP situations, and I wouldn't do too much to account for that, as a web developer.

You really don't --need--- cookies

[tjstork]

if you store state in an encrypted hash on an input hidden tag.

Re:You really don't --need--- cookies

[Anonymous Coward]

Don't agree. You can POST something that's hidden, but combined with the GET method (user input strings become parameters in URL), it gets messy. I would like the url field to stay totally unchanged with both methods. Just think of the mess that comes if people try bookmarking your page with status info in the url.

Re:You really don't --need--- cookies

[nam37]

Well.. that will work fine on form pages. But doing this on standard HREFs will complicate everything WAY too mush..

Re:You really don't --need--- cookies

[Big Nothing]

Sure, your hidden FORM field is OK on your personal homepage or a simple single-task website, but once on a complex site, this method is crap.

I used to be the guy in charge of maintaining an internet bank website that used this very technology - storing user variables and passing the information between pages by means of JavaScript (one that had to work with IE, Netcrap, PC, Mac, Linux) - and it is pure and simple HELL!

I guess a large portion of the problem was that the web server had no scripting language, so everything had to be done either client-side (JavaScript) or in the low-level business tier (COBOL) or database tier (PL/1). *puke* I'm actually glad im unemployed now instead of being back in that job...

This is a real problem with web based interfaces.

[ahfoo]

The assumption that you can and should be able to provide all kinds of programming through a web interface ignores the fact that many applications involve personal data and the web is fundamentally public even if you add SSL or whatever gizmos to try and avoid the fact. There are many services that should not be provided through a browser. That doesn't mean applications can't be network enabled, but perhaps they shouldn't operate within a browser.
Although the web is where a lot of great open souce development takes place, this fact shouldn't be interpreted as being anti-open source by any means. The web is great, but not everything has to be crammed into a browser. In fact, it seems like it's the closed source interests that are most intnet on pushing "web services."
This only becomes more of an issue with standards like XML. Sure, it's potentially possible to provide all kinds of interactivity through a browser with XML, but the question remains, should you?

Web Site Law

[Anonymous Coward]

As a developer, I wish there was a compiled list of web site laws such as this. Id like to visit 1 web page where I could see all international and local government laws that are relevant to creating a internet based website.

Do you this US export restriction laws apply to servering static content too?

Stupidest idea ever.

[Kjeks]

Why can't just the paranoid people block cookies?
I can't exactly see the big problem with cookies (other than that it's a unreliable solution for remembering user-data).

As already mentioned, if PHP is using sessions, it will first try to set a cookie with the session-ID. If that fails, it will pass the session-ID along with the url or automagicaly add a hidden-field to forms.
Good luck rewriting ALL php-sites that uses sessions.

As I see this, cookies do more good then harm, and it's no problem disabling them, so what's all the fuzz about?

Re:Stupidest idea ever.

[hermeshome.se]

Well, I think this is a Good Thing.

" Why can't just the paranoid people block cookies?"

That about all non-geek/paranoid people out there with no real knowledge about cookies etc? Maybe this will raise the awareness of Joe User about all things happening without them ever notice or know about it, when they are sufing the web.

I might not be needed to be enforced in a law. But it might be a step towards enlightning "normal" users.

Re:Stupidest idea ever.

[a_n_d_e_r_s]

Well the human readable page must tell the visitors how the cookies are used.

This information can be critical for knowing if one wants to block the cookie or not.

Cookies not needed

[gr8_phk]

Just assign a session ID to each visitor who doesn't have one. When a page is served, take the session ID out of the URL and insert it into the link URLs of the pages served.

I once wrote an othello game that played this way. You could take back moves because it was stateless on the server end. The pointer also changed over the legal move squares because they had URLs under them. I may still have C source somewhere.

BTW, first one to patent this please send me a check as thanks.

Re:Cookies not needed

[radish]

Wow, genius.

All a cookie is is a session ID, the actual data in the session is kept on the server. It's just neater not to have to rewrite every URL, and it's nice to have the option of persistance. For everyone who is pointing out ways of living without cookies, you're missing the point. Cookies don't allow you to do (much) you can't do otherwise, they just let you do it more neatly and more reliably.

Re:Cookies not needed

[fishmonkey]

All a cookie is is a session ID, the actual data in the session is kept on the server. It's just neater not to have to rewrite every URL, and it's nice to have the option of persistance. For everyone who is pointing out ways of living without cookies, you're missing the point. Cookies don't allow you to do (much) you can't do otherwise, they just let you do it more neatly and more reliably.

Whattt??? a cookie doesn't have to be a session ID, it can store data, like say... a USER ID and be used on multiple sites to track your browsing habits - like most online advertising companies (eg. doubleclick) do.
You've just mentioned one use for cookies, there are others - from memory you can store up to 4kb of data that could potentially be read from any server, depending on the domain settings of the cookie.

Cookie blocking

[Phantasmo]

Internet Explorer said it would block cookies that invalidated your privacy.

Now I use Mozilla Firebird and block any cookie that isn't from a site that I'm logged into. Does anyone know what kind of heuristics MSIE used to determine which cookies are good and which are bad?

Re:Cookie blocking

[Anonymous Coward]

By checking if the Evil Bit is set of course.

Re:Cookie blocking

[arkanes]

There's a "privacy policy" standard. In certain configurations (not the default) IE will block cookies from sites that don't have a valid privacy policy.

Re:Cookie blocking

[Isofarro]

Does anyone know what kind of heuristics MSIE used to determine which cookies are good and which are bad?

Internet Explorer 6 uses the Compact Privacy policy as specified in the W3C P3P spec. It uses this to determine whether a cookie is unsatsifactory (different rules based on whether it is a third party cookie or not). MSDN has documentation covering Internet Explorer's decision matrix (unfortunately framed).

EU law

[DaBj]

Actually it's "just" an implementation of an EU law according to a directive from the EU (2002/58/EG) not that it makes it any better though since all of EU has to have this law sooner or later (but before Oct 31st 2003 according to the directive).

Re:EU law

[broeman]

According to 2002/58/EC (British version):

(25) However, such devices, for instance so-called "cookies", can be a legitimate and useful tool, for example, in analysing the effectiveness of website design and advertising, and in verifying the identity of users engaged in on-line transactions. Where such devices, for instance cookies, are intended for a legitimate purpose, such as to facilitate the provision of information society services, their use should be allowed on condition that users are provided with clear and precise information in accordance with Directive 95/46/EC about the purposes of cookies or similar devices so as to ensure that users are made aware of information being placed on the terminal equipment they are using. Users should have the opportunity to refuse to have a cookie or similar device stored on their terminal equipment. This is particularly important where users other than the original user have access to the terminal equipment and thereby to any data containing privacy-sensitive information stored on such equipment. Information and the right to refuse may be offered once for the use of various devices to be installed on the user's terminal equipment during the same connection and also covering any further use that may be made of those devices during subsequent connections. The methods for giving information, offering a right to refuse or requesting consent should be made as user-friendly as possible. Access to specific website content may still be made conditional on the well-informed acceptance of a cookie or similar device, if it is used for a legitimate purpose.

This is one point of 49 other interesting ideas for the rights and protection of privacy in the electronic comm. sector. On the Danish EU-information site it is mentioned as still in progress in Denmark. Many IT-companies have had hearings for this directive, but cookies has not been discussed yet (so to my knowledge).

Re:EU law

[Bazzargh]

Thats 2002/58/EC (not EG)

And here is the full text of that directive. Sections 24 and 25 are the ones referring to the use of cookies.

"Where [...] cookies, are intended for a legitimate purpose, such as to facilitate the provision of information society services, their use should be allowed on condition that users are provided with clear and precise information [...] Access to specific website content may still be made conditional on the well-informed acceptance of a cookie or similar device, if it is used for a legitimate purpose."

ie. it is actually ok to refuse access to a section that requires you to use a session cookie in order to log in. This is not a ban on using cookies, or even requiring the use of cookies to get part of a site to work - its a ban on using cookies without consent.

Re:Vhet is zee prublem?

[Chundra]

Foockeeng mudereturs. Mey yuoo ell rut in hell. Bork Bork Bork!

meanwhile...

[Gavin Rogers]

Meanwhile back in real life millions of scam artists, spammers and paedophiles remain confident that legal loopholes exist that allow them to do what they do without fear of prosecution.

Cookies security problems? That's so 1996... Get with the real problems the Internet needs laws to prevent.

Re:meanwhile...

[__past__]

Spam is currently being addressed, at least in germany. IIRC, it is actually an EU directive as well.

Kiddie-Porn wasn't ever legal, of course. The existing loopholes are of the kind that cannot be fixed legislatively by a single country (or the EU, for that matter).

Only really applies to information gathering

[BELG]

The law doesn't apply to cookies used to supply the user with a service she asked for.

That is certainly open to interpretation, but at the very least it means that sites that really need cookies can relax. Shopping online, logging in to a news site, or any form of web-based mail are all services the user explicitly asks for, after all.

However, silent information gathering becomes illegal. Is that a bad thing? Hell no.

Re:Only really applies to information gathering

[orynge]

The law doesn't apply to cookies used to supply the user with a service she asked for.

When typing an URL, I am requesting a service, right?

Then every site can use cookies, as long as they arent popups.

good excuse for asp developers to move to asp.net

[Anonymous Coward]

Enabling Cookieless Session State in ASP.NET

The people of Sweden should

[semanticgap]

...send a courriel to the government... Oh, wait, that's French...

Thank God I don't live in Europe!

Can someone translate this please

[Rogerborg]

Specifically:

• How explicit does the acceptance have to be?
• Does it apply to all content served, or just to that served to clients that can (reasonably) be identified as being in Sweden?
• Does it mandate a mechanism?
• Is the mandated mechanism pure HTTP/HTML (how do I click on a popup in lynx, for example?).
• How do they distinguish between a human browser, and a robot?
• Do sites have to implement blocking of deep linking to redirect browsers to a cookie acceptance page? Does that screw indexing engines?

Seems to me like there's a metric buttload of questions to be answered before we can have anything like a reasoned debate on this.

Re:Can someone translate this please

[fr0m]

Why not. First of all here's the original text:

SFS 2003:389, 6 kap. Integritetetsskydd

18 Elektroniska kommunikationsnät får användas för att lagra eller få tillgång till information som är lagrad i en abonnents eller användares terminalutrustning endast om abonnenten eller användaren av den personuppgiftsansvarige får information om ändamålet med behandlingen och ges tillfälle att hindra sådan behandling.
Detta hindrar inte sådan lagring eller åtkomst som behövs för att utföra eller underlätta att överföra ett elektroniskt meddelande via ett elektroniskt kommunikationsnät eller som är nödvändig för att tillhandahålla en tjänst som användaren eller abonnenten uttryckligen har begärt.

This is my own translation, more or less word by word since I don't have much experience with translation of laws :-)

SFS 2003:389, 6 chapter. Integrityprotection

18 Electronic communicationnetworks may be used to store or access information that is stored in the subscriber's or user's terminalequipment only if the subscriber or user recieve information about its usage, by the responsible(person?)of the personal information, and has an opportunity to block such a treatment.
This do not stop storage or access that is needed to perform or make it easier to transfer an electronic message via an electronic network or as neccessary to provide a service that the user or subscriber explicitly has requested.

Re:Can someone translate this please

[bentcd]

So, basically, doubleclick has to tell you "We would like to store a cookie on your system so that we can track and catalogue your activities online. Ok?"

RTFA

[DukeyToo]

Oh wait, its in Swedish!

Anyway, AFAIK ASP.NET is the only web technology with built in support for cookieless sessions. Obviously you can roll your own in other technologies.

<conspiracy type="theory">
Microsoft fudged the issue for Swedish lawmakers, thus making ASP.NET the web technology of choice in Sweden?
</conspiracy>

Re:RTFA

[lordholm]

Huh???

WebObjects do cookie-less session management by default, and have for as long I can remember.

You can however activate cookie based session management if you like, but it is not recomended as not all browsers support cookies.

PHP can do cookieless sessions as well, an I beleve that you can do it in JSP as well.

Turning the tables?

[Realistic_Dragon]

Will we now see websites where any user running IE is banned, because all the other web browser users can be assumed to have made a choice about accepting cookies or not?

Browser makers' responsibility?

[mgkimsal2]

Why can't they legislate that browser makers (far fewer of them) make it stupidly easy to manage cookies and include some helpfile about what cookies are? The Mozilla and Konqueror tools are good first steps, but a big 'cookie' icon (with a bite taken out of it or something) that brought up a simple but detailed view of the state of cookies in the browser would help immensely.

5-10 programs would be impacted instead of the tens of thousands of sites which will be impacted by this (stupid) law.

If there were cameras that tracked my usage whenever I took pictures of certain places, the law would be written to mandate that cameras contained functions to limit this ability. They wouldn't require the owners of every place that could possibly be photographed to change how people take pictures of their locations. Maybe that's not a good analogy? :)

You don't really need the consent

[errl]

The article doesn't say that you really need the consent of the user. You only need to provide an option on the website, which when chosen stops the site from using cookies.

So you do not really need to ask the user if he wants to use cookies or not (as the /. article says), you just need to provide an option (on the website) to turn them off. And, as stated, you need to provide information about what the cookies will be used for.

Babelworm translation.

[Anonymous Coward]

The Babel worm is a sweedish to english translator. Here is the Babelworm translation

Wouldn't it be a wonderful world...

[SlowCoder]

..if people actually read and understood the text before making headlines out of it..

First, the law says that if you _requested_ the service, go ahead and use your cookies all you want. But only for the site you wanted to access.
This effectively stops banner-ad companies from tracking your movement between sites using persistent cookies, since you never _requested_ to look at their banners.

Second, it only outlaws _storing_ of the information, which in my mind comes to _persistent_ cookie, ergo PHP / ASP session-cookies should be allowed without problems.

I don't see any problem with this law, but I do see alot of good things coming from it. Less spying from evil banner-ad companies for one.

My 2 cents worth..

Re:Wouldn't it be a wonderful world...

[Anonymous Coward]

Thanks for clearing this up. Since you can read Swedish, would you mind translating it or point us to an English version?

Re:Wouldn't it be a wonderful world...

[Malc]

I would read and try to understand the text, but I don't understand Swedish. I'm waiting for a translation... ;) Anyway, this is /., haven't learnt from your observations of everybody else that RTFA is a fool's errand?

Re:Wouldn't it be a wonderful world...

[SlowCoder]

I wouldn't mind if it wasn't so bloody long..
The link (IDG.se) contains false information.

My conclusions come from the actual law..

This text is enormously long (and boring), so translating it isn't really an option for me. Sorry..

Re:Wouldn't it be a wonderful world...

[babbage]

This effectively stops banner-ad companies from tracking your movement between sites using persistent cookies, since you never _requested_ to look at their banners.

Note: as someone who until recently worked on the advertising systems for a major US newspaper, a big part of the way cookies were used was almost the opposite of this. This came as a big surprise to me, but it was actually done in the user's interest: some of the third party advertisers would be putting out the same popunder ad across many different sites, and would set a cookie not to gather more user data (at least, not as a primary goal), but to prevent that user from being bombarded by the same ad many times per day. The motivating goal was to keep the ads as unobtrusive as possible; users without cookies would get the same ad over & over again, both on our site and when they went to others that had that advertiser as a client.

Now arguably, letting non-cookie users get annoyed could be seen as a kind of incentive to turn on cookies, throttle back the ad, and oh yeah help out with the data collection & analysis. While that makes sense, I'm not aware of anywhere that these advertisers made any effort to making that line of thought clear to the public, and without actually explaining "you are getting all these ads because you don't use cookies", the argument loses quite a bit of momentum.

But anyway, the point -- as has been made many times before, in different ways by different people -- is that cookies have pros & cons, but that not every application of them is done just to screw over the site visitor. Obviously complex transactional sites couldn't work without the preservation of state that cookies (or URL embedding) provide, but even in less obvious areas where it seems like cookies are generally used in someone else's interests, there can still be a positive reason for the users to want them.

Re:Wouldn't it be a wonderful world...

[Pofy]

There is a small box with s snipet of the law that talks about cookies and the excpetions you mentioned. It has allready been translated a few times in the thread if one scroll up.

Thewhointhewhereinthewhatnow?

[faaaz]

My browser settings permit cookies, if that isn't an agreement then I don't know what is.

I will not rewrite my website, so put me in jail! I dare ya!

Actually, I'd love to see how this acts out in court. It seems to me like the browser prefs. argument is valid.

bill the government

[jdkane]

So redesign all Swedish web sites to adhere to the cookie legislation, and then send the bill to the government. If everybody does it then that may force them to reconsider the legislation. Did they even have any technologists or experts available when making this law?

Please accept this cookie...

[Snags]

Do you wish to receive cookies from our website for the purpose of ...?
( ) Yes (X) No Submit

You indicated that you do not wish to receive cookies.
May we set a cookie to remember this decision?
( ) Yes (X) No Submit

You indicated that you do not wish to receive cookies.
May we set a cookie to remember this decision?
( ) Yes (X) No Submit

...

Deep linking

[Winterblink]

How will they handle someone linking to a page well inside the site? I could see the cookie warning being a no-brainer to set up when people type in an url like www.swedishurl.com (or whatever) and get a page like on a porn site, warning you of the content (or in this case, the cookie usage) and giving you the option to bail out. But how can this be handled from users coming via links?

What is a Swedish Website?

[perly-king-69]

Not a facile question, but legally, what constitutes a Swedish Website in this context? i) A Swedish company with a website hosted in the US? ii) A US company with a website hosted (mirrored, even) in Sweden?

And the Swedish Chef says...

[djeaux]

I thuooght iferyune-a knoo PHP fells beck tu useeng URL-incudeeng iff zee user's brooser dues nut sooppurt cuukeees oor iff cuukeees hefe-a beee deesebled. Bork bork bork! Hoo deefffficoolt vuoold it be-a tu roon $_SERVER['REMOTE_HOST'] thruoogh a regex und use-a URL-incudeeng fur /\.se$/ ??

Bork bork bork!

What about software

[Malc]

Say I have an app that talks HTTP back to a server (in this case, located in the US). Now say that app uses embedded IE, and uses cookies. Is that covered by this?

Re:What about software

[ioErr]

The law explicitly allows that. It does not interfere with the sending of messages.

Utterly moronic

[Fweeky]

Cookies keep client-specific data outside URL's and in a well specified, preditable and easy to manage system. You can set your browser to accept or reject them at will quite easily; even IE's really quite good at handling this automatically.

Compare this with storing the same data in the URL; instead of setting a SID=12345 cookie to track your session id, it gets tacked onto the end of every link, Referer header, etc; now you have no automated method to accept or reject the "cookie", nor much control over having it leaking into access logs all over the place by way of referer headers.

Congratulations, by not using cookies you just reduced the user's control over their own privacy! Well done!

craziest thing I've heard for a while

[fishmonkey]

what the?
This is by far the craziest thing I've heard for a while, the onus should be on the client to choose wether they want cookies or not, not forcing the web developer to NOT use a useful web technology enabled in ALL browsers. It's there, they should be able to use it...
Crazy swedes!@

Tripe!

[Malc]

Have you been brainwashed by MSFT's marketing? PHP has been able to do this for a long time. And judging by some of the JSP URLs I've seen, some of the Java based web solutions do to. PHP can re-write URLs embedded in a page as it serves it up to include a session ID parameter. That involves no rolling your own - it comes for free.

Re:Tripe!

[chrysalis]

Transparent session IDs is not that reliable.

For instance it doesn't work with Javascript.

And I really don't like to have the interpreter transparently rewrite parts of my XHTML code in a different way.

Manually adding the SID variable to each link is not a big deal and at least, the result you get is exactly the one you expect.

Re:Tripe!

[DukeyToo]

I stand corrected. (Actually, I suspected as much, thats why I originally said AFAIK - as far as I know).

MS Marketing: -10
Slashdot effect: +20
--------------------
Knowledge gain : +10

Re:Tripe!

[Malc]

What do you mean by it doesn't work with JavaScript? Are you talking about dynamically creating URLs on the client side? Well, it can be made to work - you can assign the SID to a JavaScript variable initialisation on the server side.

Re:Tripe!

[chrysalis]

> Are you talking about dynamically creating URLs on the client side?

Dynamic or not, even window.open('...') is not rewritten.

> you can assign the SID to a JavaScript variable initialisation on the server side.

And how is it still transparent then?

It's half-transparent. Sometimes it works, sometimes you must take care or doing it manually, possibly by adding new tweaks to your code. It's a mess.

Good cookie, bad cookie

[Empiric]

While I'm certainly against governments mandating development methods, there are good technical arguments for coding a web site in a cookie-minimal manner.

Firstly, you can't in any way guarantee their availability for a given client. The user may have chosen to turn them off, they may be working at a company who's corporate policy is to block cookies, they may even be using a browser which does not support cookies. This is a "bear your user in mind" kind of consideration, similar to avoiding non-standardized Javascript in your web site code.

Secondly, "session" variables under IIS (and equivalents) don't scale well. The "scope" of a session variable is at most the server it's running on. Where you could easily redirect to a mirrored server if your site is written such that it doesn't rely on session variables, you suddenly have a significant problem if it does and you try to scale it to a server farm.

Thirdly, for most all capabilities cookies give you, you can easily implement this by passing an identifier from page to page in the URLs. Use this identifier to track which user/session it is, and look up your state values in a database table.

Fourthly, HTTP is at it's core, supposedly a stateless protocol. Cookies go against the spirit of HTTP, which, though it may seem an aesthetic point, leads to various issues such as the story's, in which a stateful implementation requires major rework when forced to support a stateless one.

here is the procedure..

[maharg]

1) serve up a page with a cookie and a redirect
2) attempt to read cookie when client follows redirect
3) refuse to serve any more pages to client if cookie is present
4) ???????
5) PROFIT!!!!

Best Viewed in Opera

[TheDawgLives]

Well, they could always force people to use the Opera browser. It will pop up a box for every cookie displaying the contents and asking if you want to allow the cookie or not. Come to think of it, Opera is headquartered in Norway, maybe there's a connection?

Seems fair

[kingLatency]

This may be tough for developers and leave them scrambling for a little while, but it's fair to the user. They should have the right in all countries to know what data their cookies store and how it's being used.

ASP.NET

[grennis]

Its woth noting that in ASP.NET, the default method for saving the session state key is to put it in a hidden input field on the form. This is ideal because it doesn't use cookies. If for some reason this doesn't work for you, you can configure it to store the key in the URL (although this is a security problem), or use cookies.

To change the method for storing session state, you don't have to write any code. You just tweak a parameter in the XML configuration file called web.config. This is something that Microsoft got right...

What they gather

[SolemnDragon]

The most important- to my mind- part of this is that they have to tell you what info they're collecting. This tells a lot about a company.

My browser is not set up to block cookies. My browser is set to notify me, however, & pops up a privacy notice everytime one gets sent, and gives me the option to block them. You know that AOL ad with the screen full of pop-ups? I was astounded, when i tested, to see how many sites such as MSN will send you. Including the ones for ad servers that deliver popups. My brother laughed and called me paranoid, but i'm not. This is how i learned about computers in the first place, by observing and playing with them, and my HTML started by staring at page source, and now my info about security and so on is coming from watching what brushes up against my computer. Ten websites produced more than 50 cookies. The lowest was zero, the highest was fifteen. (and the site was kind enough to reset my home page for me, d*it)

For those of use who need to use the net at work, it would be beautiful to have a choice in an environment where we can't see or play with things. Besides, eith phone calls they have to tell you if you're being recorded, so i think that both public cameras AND net cookies AND any other such info-recording system should be required to let you know that you're in the lens. If they want my info, they can ask. (set your firewall to make windows only able to connect when YOU want it to, and see how annoyed it gets!)

Stupidity is an incurable disease

[Speljamr]

Apparently the United States isn't the only place where stupidity reigns in the courts.

Re:Stupidity is an incurable disease

[Anonymous Coward]

Actually the stupidity isn't in the US or in Sweden, it's entirely within the virtual nation of Slashdot. The story is 100% bogus.

Again.

Read the freaking law

[JanneM]

I don't mind when slashdot posters comment on things without actually checking the facts, but I get prtetty annoyed when a news site does the same thing. IDG has had a long campaign against any kind of privacy regulation or other things that may hamper their ability to do whatever they want. The article is factually bunk, in other words. These are the same people lobbying for a sales tax exemption to advertising in very shrill overtones.

The law explicitly allows using cookies for session management, identity and presistance without consent by the surfer when it is needed for the functionality the surfer came to the site to use. Slashdot would be in the clear, no problem. So would shopping sites using cookies for keeping track of a shopping cart, for example. Most asp and php sites would have no problem either.

The law _only_ regulates cookies that are not relevant to the site functionality. Specifically, ad tracking stuff, web bugs and other stuff that track you independently of the site functionality can not store cookies without your informed consent. That's it.

Just ignore the hysterical rhethoric from IDG.

Re:Read the freaking law

[yelvington]

The availability of any so-called "free" media Web site is predicated on the functionality of the advertising it carries. Break the advertising, you break the site.

Re:Read the freaking law

[defwu]

Define functionality of the site. I can make a pretty powerful argument that banner ad cookies are relevant to my site's functionality b/c part of my sites functionality is geared specifically to the people who pay to put up banner ads, so I can continue to provide services.

Caveat surfer: if you are personally concerend about privacy then set up your browser to not reveal information. If you don't know how, and are still concerned, then educate yourself, or pay someone else to do it for you, you twink

Re:Read the freaking law

[JanneM]

It's not part of the functionality that the surfer came there to get (unless your site is excplicitly for surfers that wants to view advertising).

Re:Read the freaking law

[JanneM]

It's not the functionality that the surfer came there to experience, however.

And nobody says you can't show ads to the surfers; just that you can't - without their consent - track which surfer has viewed what ad.

You could arguably make a case that the site (not the ad company!) can use session cookies used anyway to rotate ads so the individual does not see the same ad all the time. Once you bring that functionality to the ad provider, however, it is a definite no-no.

Re:Read the freaking law

[richie2000]

The law _only_ regulates cookies that are not relevant to the site functionality.

Check out the cookie warning on www.pts.se and then tell me why they seem to think they need to have people explicitly accept cookies or go away.

Cookies are also used for purely technical reasons and many websites use them today. According to the new Electronic Communications Act, which enter into force on 25 July 2003, everyone who visits websites should be informed about what cookies are used for and given an opportunity to refuse such use.

Cookies are used on the PTS web site to identify the user for the duration of the visit. Cookies are used for certain functions that improve the web site for the user. Cookies are used, among other things, for 'new since last time', when ordering brochures and reports and to differentiate between choice of the Swedish and the English pages. PTS does not save any personal data (information) via cookies and when the visit is ended the link between the web server and cookies is released. Information about the visitor cannot be traced by PTS via cookies.

If you accept the use of cookies, click the Yes box below. This page will then not be shown again.

If you do not accept cookies, you can close this window by clicking the cross at the top right of the screen. You are welcome to contact the National Post and Telecom Agency Communications Department for assistance with ordering material: telephone no +46 (0) 8-678 55 00, email: info@pts.se, fax: +46 (0) 8-678 56 00, postal address Post- och telestyrelsen, Box 5398, 102 49 Stockholm, Sweden.

Yes, I accept the use of cookies and session cookies.

Read the freaking law yourself. You still need to inform the user, no matter what you use the cookies for:

[...] endast om abonnenten eller användaren av den personuppgiftsansvarige får information om ändamålet med behandlingen och ges tillfälle att hindra sådan behandling.

According to PTS, the next paragraph (the exception for requested services) does not apply to the requirement to inform the user, it applies to the service itself - this requirement should not prevent the user from getting the service, which is the delivery of information. In the case of PTS, this is fulfilled by giving an e-mail address and a phone number for further contacts since their website obviously is useless without cookies.

For the record, I think this is possibly the most stupid law I have seen in a long time (or at least PTS' interpretation of it).

Re:Read the freaking law

[AVee]

Nice example of how ridicules this can be. Check the box and click approve to let the server know you will accept the cookies, yet let your browser refuse the cookies, you won't get past the web page...

But sweden needs some further improvement. I suggest a law that mandates website to ask clients permission to use their ip-adres even before asking about cookies...

Microsoft solved this allready

[it0]

If you use IE6 then it only accepts cookies when you have a privacy statement.(default setting) It means that when you want to read/set a cookie you have to provide the browser with a privacystatement. This is actually 3 documents consisting of 2 xml files and a html file explaining what the cookie is trying to do.

Bloody annoying if you are coding a webapplication, I assume it broke a lot of old stuff :)

Re:Microsoft solved this allready

[Captain Large Face]

I believe the project you're talking about is now a recommendation from the W3C called P3P (Platform for Privacy Preferences), which IIRC, has a detailed section relating to the use of cookies. Microsoft implemented this recommendation partially in MSIE 6 before it became a standard.

WTF?

[t_allardyce]

This surprises me, Sweden is supposed to be one of the most open and free countries in the world, it is, or was at the top of the UN human freedom index (which for some reason i cant find anymore).

If you dont want cookies, turn them off, if you dont want advertising companies tracking you with cookies, set your browser to only allow specific sites. Really all annoying things- vbscript viruses, pop-ups, banner ads, tracking can all be stopped by the browser, html believe it or not is an open standard and you can control anything that happens on your computer.

Re:WTF?

[perlyking]

Theft can be stopped by really good security measures, but thats not a good reason to avoid passing laws against theft.

Some european countries have very good progressive laws that help protect people.

Avoiding bad commercial practices

[i-neo]

The law should have been more general, not only about the cookies.
The real problem is that our web activities are stored everywhere to fill in commercial databases. The way it's done doesn't matter: cookie on the client, server side trick, etc.

I hope other countries will realize that it's the real issue.

PS: France already has a such law (I mean a general one protecting the individuals).

www.pts.se

[skojt]

www.pts.se is the Swedish institution in charge of monitoring the cookie behaviour. Click on this link (there is an English translation that you read. What's funny is that a couple of cookies get set as soon as you load the page asking whether you accept the use of cookies. I've heard of a rumour that says that someone has already informed the Swedish police that PTS is committing a crime.

No Cookies? No Problem.

[panda]

Just generate a session id, store everything in a database. If they have to login to use the site, even better, just retrieve the data for their user ID and generate a new session ID.

No cookies, and you can still track just how many times the user clicked on the link for dirty pics of smutty grannies. ;-)

That said, I don't give a crap about cookies. I turn 'em on and leave 'em for every where I go. It doesn't matter to me what gets stored in a cookie on my machine. After all, it could just as easily be stored in a database connected to the web server rather than on my machine.

Sheesh, people. McNealy was right, you have no privacy on the web, get over it!

(Don't worry. I've still got karma to burn.)

Translation of article

[McDutchie]

Since the Fish knows no Swedish, here is a quick translation... any errors are mine. NoT = Note of Translator.

- M.

Here is what the law says

SFS 2003:389, chapter 6. Integrity protection

18. Electronic communication networks may be used to store or gain access to information stored in a subscriber's or user's terminal equipment only if the subscriber or user of the personuppgiftsansvarige (NoT: "entity responsible for handling the personal data", i.e. the website) receives information about the operation's purpose and is given the opportunity to decline such operation. This shall not hinder such storage or access as is necessary to execute or facilitate to transfer an electronic message via an electronic communications network or as is necessary to provide a service that the user or subscriber has expressly requested.

Hard to comply with new law on electronic communication

(07/24/2003 4:24pm)

Today, many sites are becoming illegal, as the new law on electronic communication takes effect. It says that sites must communicate what the cookies' contents is used for. The users must also be given the option to refuse.

Starting today, Swedish websites may not utilise so-called cookies without explaining the purpose of the treatment of the data that's in them. I addition, users must be given the chance to stop the use of cookies.

This is one of the consequences of the new law on electronic communication, SDS 200:389, which is taking effect.

It is apparently not sufficient to set the web browser to automatically accept cookies. The website one visit must explain what the information will be used for and also give the user the option to refuse the use of cookies.

Hard for sites

This gives Swedish websites two options.

"One alternative is to stop using cookies, making the website's functionality suffer", says Jonas Eriksson at Webkonsulterna in Östersund.

The other option is one Jonas Eriksson doesn't even want to think about.

It means that the majority of Swedish sites that use scripting languages with session variables such as asp and php become illegal insofar as they don't rebuild the websites so that the users can approve of cookie use before they enter the site.

But it doesn't stop there.

"It isn't enough that people get a load of banner and popup ads every day. Now even all ad networks must first start a Javascript to ask people if they want to set a cookie before viewing the ad", he says.

PTS complies with the law

The (supervision authority? watchdog?) for the electronic communications law is Post- och Telestyrelsen, PTS, and on their website it says the following:

"Cookies are therefore used for purely technical reason and they are used today by most websites. According to the new electronic communications law, which takes effect starting July 25, 2003, all who visit websites shall be informed about cookie use and be given the option to refuse such use."

Fine threat

According to Charlotte Ingvar-Nilsson, biträdande rättschef (NoT: some high-up function that I don't know how to translate) at PTS, PTS will monitor how the market will act on the new law.

"If websites don't comply with the law, we have to start with educating about the changes", she says.

And if that doesn't work?

"If we suspect someone of not comlying with the law, that website will get at least a month to fix that. After that we have the option to issue an order which could be accompanied with a fine", says Charlotte Ingvar-Nilsson.

PTS also has the option to decide that people who neglect a debt entirely or partially shall cease operations if the infraction is not insignificant.

"It remains to be seen whether it can become applicable in this case", says Charlotte Ingvar-Nilsson.

No position on the law, but...

[Featureless]

I find your argument flawed. It's like the social security card fiasco. "It's not a national ID number," but the funny thing is, once it's out there, you can hardly do anything without it, unless you want to create a big hassle for yourself (have you ever tried not giving up your SOC# to the dozens of different orgs that demand it - actually illegally?).

If you have a state mandate for cookies like this, then rather than having a veneer of "choice" - i.e., I can "choose" to disable cookies but then (feigned surprise) OH! Most websites don't work! Now people actually have the option to exercise this kind of privacy, rather than just the illusion that they do, and websites will use them judiciously, if at all.

Not saying that this kind of policy is ultimately a good idea, but I do have an immense amount of respect (and surprise) at such an apparent concern for privacy. The list of nations where such things seem on people's minds to this degree is perilously short. Laws like this today, meaningful reforms tomorrow... etc etc.

Re:No position on the law, but...

[Tokerat]

but the funny thing is, once it's out there, you can hardly do anything without it, unless you want to create a big hassle for yourself

You can delete cookies, you know. Individually or in bulk.

If you have a state mandate for cookies like this, then rather than having a veneer of "choice" - i.e., I can "choose" to disable cookies but then (feigned surprise) OH! Most websites don't work! Now people actually have the option to exercise this kind of privacy, rather than just the illusion that they do, and websites will use them judiciously, if at all.

Cookies solve alot of problems. NATs for instance. If you can't track by IP, assign an ID to a cookie. How are you planning on making websites that depend on that functionality work...without that functionality? If there was a better way, we wouldn't need cookies in the first place.

That being said, I think cookies should only be used for the website you're on. I don't prefer websites that have ads which place cookies, perhaps the warning could only be required in such situations?

Re:No position on the law, but...

[Featureless]

You can delete cookies, you know. Individually or in bulk.

I repeat: (have you ever tried not giving up your SOC# to the dozens of different orgs that demand it - actually illegally?) and more specifically If you have a state mandate for cookies like this, then rather than having a veneer of "choice" - i.e., I can "choose" to disable cookies but then (feigned surprise) OH! Most websites don't work! Now people actually have the option to exercise this kind of privacy, rather than just the illusion that they do, and websites will use them judiciously, if at all.

NATs for instance. If you can't track by IP, assign an ID to a cookie.

We did quite a bit of work before cookies were invented.

Your alternative is to juggle state with GET or POST form data. And I presume login-related security issues would be handled via basic auth. BTW for non-100%-accurracy needs (like UV counting) IP+User Agent is the current industry standard.

Of course it's a PITA. Perhaps I should repeat my other important point: Not saying that this kind of policy is ultimately a good idea, but I do have an immense amount of respect (and surprise) at such an apparent concern for privacy.

Re:No position on the law, but...

[Tokerat]

No I see your point, wasn't trying to be mean...

I guess what I'm saying is cookies eliminate the hassle of what you can already do. Why write code to make GET or POST session IDs when cookies are there already? Same reason we have window managers for GUIs: Why write your own code to make a window when, since everyone needs to do so, it can just be a function of the platform?

This raises an interesting point, however: Can sites use the GET and POST methods for session IDs and not need to inform the user about it under this law? I'd assume the difference comes in being able to track sessions between periods of browser activity, but then again, you're are storing data on a users computer for tracking purposes. (IANAL)

Re:No position on the law, but...

[Featureless]

I imagine the key difference is the one you pointed out. Given that IP addresses are just too unreliable as unique ID's, sites can't identify someone between visits if they don't identify themselves. Assuming they evaluated it in a meaningful way at all, that's probably what makes one OK and the other not.

This is contrasted against what we have in the states now, where there are companies (like doubleclick) included as 3rd parties on practically every webpage (even ones without ads) "capturing" traffic, and they build a detailed model of your every activity on most of the web. They're integrated with partners providing line-of-business data as well, so that they can tie this data to real people if they buy something or enter their name, email, etc. at the right time (and they only need to get this once). Then they cross-reference it with other marketing databases (such as their Abacus database), so we get to that magic place where someone can just type your name etc into a terminal and find out all kinds of very personal things about you - at the very least practically everything you've ever looked at.

Of course, all of this is still slightly controvertial, hence the investigation by 12 states and the FTC, and the subsequent many promises of doubleclick not to actually do what they spent all those hundreds of millions setting up to do. So now they have all this data which in theory they do nothing with. Sort of like a thief who "just wants to hold" your money but promises to give it all back.

"Remember my setting"

[chrisbw]

Can they use a cookie to remember whether or not the user wants to use cookies or not? :)

Not exactly what it says.

[Znork]

The law has a loophole that allows cookies and other storage for something the customer has expressedly requested. That would conceivably put most websites in the clear, as the viewer requests to view the website. However, cookies tied to, for example, banner ads would not be as easy to get through that hole.

I can think of a simple fix

[meatspray]

you are about to enter the abc123 site

[proceed]use cookies
[go back]don't use cookies

only the truely paranoid are going stop here, (or anyone that cant utilize cookies, but face it they're not coming in anyway)

when every site has an ugly annoying nag page at the head of it, and the law is shown to have failed at it's intended purpose, perhaps it will get tossed out.

This Is Idiocy

[KrispyKringle]

I'm all in favor of privacy, but this is pure lunacy. It is entirely up to the end-user to accept cookies. The only reasons end users may feel they do not have a choice are that their browsers are configured by default to accept them and a few (not many) pages require cookies to work.

So, if they really wanted to mix it up, they'd order the browsers to have them off by default (or ask the user on their first run) and make sure websites don't need them to function. But requiring them to get consent is silly. Cookies are an essential part of web design, misused, for sure, but I can misuse images or session headers or the REFERER field in HTTP/1.1 to track someone as well. Government should not be legislating technology, when possible, be it for corporate gain or perceived consumer safety.

PTS has a compliant website running IIS

[BoxedFlame]

PTS (the department responsible for this law) has a website at www.pts.se and they comply with this law and are using ASP. The reason for this law is simple: organizations are trampling all over peoples privacy rights because it's too damn easy to do so. The swedish law is designed to put the legal advantage at the side of the common man again.

Btw, I might add that I know one of the major lawyers responsible for this law.

Re:PTS has a compliant website running IIS

[Mjec]

The reason for this law is simple: organizations are trampling all over peoples privacy rights because it's too damn easy to do so.

Yes, cookies can be used to invade privacy. So can tracerts. So can credit cards and other sources of info for data miners.

Please realise that most cookies are used for good - saving a state, saving passwords, saving "logged in" status between pages, saving preferences, skinning, cross-page information transfer... the list goes on.
Although they can be used to monitor and report back on people's web behavior this is relativly difficult, often pointless, and in reality most pages that use cookies don't use cookies for this reason.

While there is a small privacy concern directing it at cookies is like directing a concern over drink driving at cars.

Target the driver, not the motor industry.

HTTP Extension

[Anonymous Coward]

What we need, is an extension to HTTP standard to supply the session id alongside with the HTTP request. A client would receive a new id every time it doesn't supply one to a server when making a request.

My compliant application

[petard]

I checked... fortunately all my applications comply with these provisions as described in the /. blurb. (Unfortunately I don't read swedish, so I don't know whether they really comply with the law.)

My application asks permission by sending the following header:
Set-cookie: USERID=80b1818f4b0d3f21306b1982; expires=Saturday, 24-Jul-2004 13:28:11 GMT; path=/; domain=.example.com

This tells the user that the cookie will be used to identify them to *.example.com until 24 July 2004 at the latest. The user gives permission by sending this cookie back to me. If the user doesn't give permission, she doesn't send it back and my site doesn't track her identity.

Is this simply a case of lawmakers not understanding how cookies work? As I see it, anyone who sends me a cookie, as it requires active participation on their (client's) part to SEND it to me as part of subsequent requests, has given permission. If they didn't give permission, why would they send me the cookie?

If there weren't so many moronic laws on this side of the atlantic, I'd sit back and have a laugh at the Swedes' expense about now.

Uh, databases can do this, too.

[Civil_Disobedient]

I don't understand the purpose of this law. Anyone with a snazzy enough backend can just configure a computer to log your info and save it to assigned IP addresses.

To keep "session" info, just add the ?user&bigrandomnumber after the URL, then bookmark it. All it has to do is check if the data is correct in the db, then it calls up your info. No session info required. It's still early, and I haven't had enough coffee, but I believe this would work.

Re:Uh, databases can do this, too.

[angst_ridden_hipster]

Yeah, but IP address is a really lousy identifier. There are a lot of people behind NAT routers and IP-masking firewalls, not to mention the legions of people who get their access via a system that uses DHCP.

The only "sure fire" way to get a good ID is to use authentication. Sure, it can be spoofed, since basic authentication is essentially sent in clear text. But it's more reliable than cookies, which can be deleted or modified. And if you need real certainty, use authentication with SSL. That should be pretty good.

IE vs Moz

[Anonymous Coward]

Cookie handling is the one advantage IE has over Mozilla. Mozilla needs cookie whitelisting.

My current workaround is to use two profiles. My main profile does not allow cookies. When I want to access the sites I need (only two so far, but they are important to me), I switch to the profile that allows cookies.

Hardly an optimal situation, especially on Firebird which does not have profile switching on the fly (unlike Mozilla).

Re:IE vs Moz

[spitzak]

What are you talking about? Both IE and Mozilla have a way to "whitelist" by URL, which would be much easier to use than your "change session" idea.

Re:IE vs Moz

[Anonymous Coward]

In the Mozilla preferences, tick 'ask me before setting a cookie'. The first time a site tries to ask for a cookie you can choose allow or deny or always allow or always deny.

Or if you prefer go to tools/cookies manager and select block or unblock for the current site.

Mozilla has allowed this for as long as I can remember.

Article text - translated

[skurk]

This may be a little inaccurate since I'm Norwegian, but here we go:

Hard to keep up with electronic communication

Today you may experience some unreliable websites. The new law on electronic communication starts today. It says that the sites must inform the purpose of each cookie. The users must also have an option to avoid them.

As of today, swedish websites may not use socalled cookies without informing the user of the purpose and contents stored in them. The user must also have a choice to avoid the cookies.

This is a consequence of the new law on electronic communication, SFS 2003:389, which starts today.

It is not enough to tell the browser to accept all cookies. The website you visit must inform what kind of information is stored, and what the purpose of it is - in addition of giving the user an option to avoid them.

Hard for the sites

Swedish websites have two options.

- One alternative is to stop using cookies. The website functionality may suffer from this, says Jonas Eriksson from Webkonsulterna in Östersund.

Jonas Eriksson doesn't even want to consider the other option.

That makes the majority of all swedish websites who use script languages such as asp and php to become unreliable, unless they rebuild the web sites so the users can use them without cookies when they enter.

But there's more.

- If you thought banners and pop-up ads were bad, considerthe fact that all ad networks now must launch a javascript asking the user wether or not s/he will store a cookie after viewing this ad, he says.

PTS follows up

In the website of Postal and Telecommuncations dept, the PTS, you can read the following:

"Cookies are used by most websites today. The new law on electronic communication, starting July 25th 2003, states that all websites using cookies must inform the user and give an option to work around them."

Hard to tell

According to Charlotte Ingvar-Nilsson, the executive chief of PTS, the PTS will check how the market acts on the new law.

- If the websites don't comply, then we must start informing them on the changes, she says.

What if they don't follow up?

- If we suspect that someone don't follow up, then the website gets one month to comply with the law.

The PTS also have the rights to terminate the service of those who do not follow the new law, unless it is of less importance.

- It remains to see if it will be required, says Charlotte Ingvar-Nilsson.

Well in time..

[mystran]

I though the whole cookie problem was hot some 7 years ago.. now, Sweden being the first country to actually do something about it now that everybody already figured out cookies are good thing and every decent browser having features to control them, what can we expect on other fronts ?

I'd expect popup adds to be outruled in 10 years from now.. in the first country that happens to do it..

I'd expect most swedish sites to do the same as to this date, except add a notice "We will place a session cookie on your computer when you login. If you don't want this, please, do not login." next to their login box.. big deal..

P3P

[Sebby]

Wouldn't it just have been easier to force them to issue P3P policies for their site?

I can see a lot of businesses moving their site 'off-country' or making them "international" if that doesn't cut it....

This is a good thing

[chrysalis]

This is a damn good thing.

Cookies :

- Violate your privacy.

- Is a valuable thing to grab through cross-scripting vulnerabilities.

- Waste space on your hard disk and they are a mess to sort out (visit a web site, get 3 new cookies) .

- There use is totally irrelevant most of the time. You absolutely don't need cookies to track sessions. Ever heard about GET and POST methods and their abilities to carry variables? Ever heard about the SID variable in PHP?

So what are cookies really useful for?

To avoid users type their username/password? Well... most browsers can autofill forms so this is not a big issue any more.

The only real "use" of cookies I can see is for advertisement capping (so that an ad is only shown once) .

Um Dude...

[Greyfox]

I'd view the symptoms that one user's displaying as warning signs. You know he's gonna be the one to snap and riddle the office with bullets, right?

Dumb

[nnnneedles]

I'm from sweden and I must say that this sucks.

It's just one more of those stupid swedish rules that hinders the marketplace. Like back in the day, you couldn't get a .se domain name, you had to get a www.site.region.city.se.

Why can't they just leave the internet alone!

Stupid lawmakers.

What ever happened to old-fashioned websites?

[British]

If your website contains nothing but static content, do you honestly need cookies, a registration system(a la mp3.com) or other garbage like that?

I fear that the web is moving too far away from simple .html pages that don't require you to have knowledge on database programming and require it to be a fully dynamic website, just to display a text file.

*sigh*

Anyone remember when the only annoying website out there was geocities, just because it only had ONE popup ad?

Re:What ever happened to old-fashioned websites?

[Anonymous Coward]

Yes, I agree plain html sites are still a nice thing.

Good purpose but..

[unoengborg]

This law has a good purpose to protect privacy, but it makes the mistake to involve technological ways of doing this.

This means that soner or later sombody will find a way to circumvent it. Perhaps just by moving the sites from Sweden. The text in the law is also very unclear as it allows cookies if they are needed to provide a service that the user have ordered.

The result will be that bad guys will still have cookies on their sites, while users will be pestered with "Do you allow cookies" messages on each and every sites where cookies have a legitimate use.

Good! I like this!

[pair-a-noyd]

Cookies are E.V.I.L. (tm) anyway.
And all those II$ websites should be crushed out of existence because they propagate E.V.I.L. (tm)...

You know what we need?

[DahGhostfacedFiddlah]

We need a way to use mod-points to move a comment 5 places up or down. You, my friend, should be at the top of this non-story.

Why not move away?

[Sagev]

The internet is, by it's very nature, not a location-specific sort of thing. Why wouldn't every ISP in Sweeden simply pack up and move to Norway? They keep their traffic, keep their design, keep their cookies, and all they have to do is live in lovely Norway.

Re:Why not move away?

[GenetixSW]

I'm by no means an expert on Swedish law, but there are so many technicalities with what you're proposing that it isn't feasible for any country, save for the smallest of them (ie. Luxembourg).

The main issue is distance. If an ISP moves, their lines have to move. It may become a long-distance call just to connect to them. DSL lines need a central switching station within no more than 6km generally, and countries are a LOT bigger than that. Just from a technical logistical point of view, this isn't at all possible.

There's also the issue of doing business from other countries. It's trickier thanks to different taxation and business laws, in spite of the European Union's relative ease of business within member countries.

The last point I could make is that ISPs don't really have as much to do with serving web pages as web hosts; it's a different class altogether. Yes, they could move, but realistically it's far easier to just put a clause that says "please accept, and here's why you have to", as someone else in this thread commented.

That also doesn't address the issue that moving any Swedish business that has a web site isn't at all possible. It won't happen. People will adadpt, and pretty easily too. This law isn't *that* bad--some sites make genuine use of cookies, and they'll have no trouble explaining the concept to visitors.

Please explain it to me

[RoLi]

what is so bad about cookies anyway? I'm a web developer and I've met one guy who refuses all cookies (therefore is unable to use some of my sites), I asked him why he did that and even though he is a techie, he wasn't able to give me an answer. And I don't get it, neither. So please: Show me one single incident where cookies caused anybody harm. Thanks.

Re:Please explain it to me

[Reziac]

I don't know if this *could* cause harm, but I've seen a cookie that was stored with username and password in plaintext. (Which IMO falls under Stupid Webmaster Tricks. Apparently it was a bug in one of the early PHP-based message boards.)

What I wondered, was if there was some way for a malicious web page to read *all* cookies, thus to snag said username and password -- which of course would be tied to a specific site, thus useful for hijacking one's account.

Other than that -- well, I don't really care if ad servers follow me around (and I get downright annoyed when an everyday-use login cookie fails to work). But I can see how given the lack of due process surrounding DMCA warrants, that tracked-by-IPaddress cookies might be a legal hazard, if the user was found to have visited a "proscribed" site. Frex: "Aha! we can positively prove that you visited stealMP3s.com! You must now prove your innocence in civil court, or pay into our extortion racket!"

I agree it's a stretch, but given the current legal climate, who knows....

Re:Please explain it to me

[el-spectre]

Once upon a time (in the late 90's) some browsers didn't do cookies correctly, and it was in fact possible to see all cookies. This was of course a potential huge security hole, and cookies haven't been trusted since.

Also, ASP session cookies didn't work really well across load balancers. This problem has largely been relieved by LBs that are smart enough to do persistence (send the same machine the cookie over and over). Of course, if the actual web server dies, the session is lost.

If the web developer is stupid and puts usernames/passwords in cookies, he should be struck with a large O'Reilly book as punishment...

Re:Please explain it to me

[Omestes]

I do use some cookie, I have firebird and IE prompt though, then go clean 'em up with my weekly cleaning, except the cookies I use day to day.

Mostly I do this to prevent usage tracking. Also I can totally see some people refusing cookies all together because they figure that it is THEIR computer and THEY should have complete control about what is put on it. It's a territorial type thing. Don't want doubleclick pissing on your terf.

I find most sites are quite irresponsible with cookies, and mostly use them to tell how many times I have visited, and the cookies have no actual benefit for me. I allow /. because I don't like being an AC, I allow Amazon, I allow my schools cookies, and a couple forums cookies because I get something out of it, easy access. But deny everything else, especially if they are ad.* cookies. Just out of principle.

Re:Please explain it to me

[Anonymous Coward]

If you don't put the username and password in the cookie, how do you automatically authenticate the person the next time they visit the site?

Also, what difference does it really make if the cookie is plaintext or crypted? Either way, the data stored in the cookie is all that is needed to get into the site.

Re:Please explain it to me

[forgoil]

It's not that I think that they can cause harm, but I don't know why I should keep tons and tons more of cookies on my computer that I have no use for at all. I just checked and I had 809 cookies, and I don't think for a second that I have use for more than tops 25-50 of those (slashdot's cookie for instance, or amazon's etc).

It's the abuse of the system that pissies people off for sure.

(As a side note, I have often noticed that Computer Sweden writes a lot of garbage, and I would advice anyone to always check with more sources if you read the story at their web site. Hopefully most of it is in Swedish, so most of you won't miss out;))

Re:Please explain it to me

[Bert64]

I noticed that too...
Nowadays, i configure my browser to ask me before accepting a cookie, and i reject anything automatically, and later add it to the allowlist if the cookies will convenience me in some way (slashdot, ebay, etc...)
I also tend to complain about sites which require cookies in order to work, especially sites where i dont even have a login/pass etc.. Such sites are often just being picky and trying to force you to use cookies for tracking purposes...
or possibly theyre just very poorly coded, either way its not desireable.

Re:Please explain it to me

[Reziac]

Ah. D'ya happen to know which browsers were affected with "Toss all my cookies to anyone who asks" syndrome?

An odd bug in NS3.02: it insisted on storing cookies.txt on the root of the current drive, no matter where it was told to. I forget exactly how I had it rigged, but the upshot was that I could make cookies visible or invisible to the server, by where that drive was logged at the time.

I think I must have seen some of those Stupid ASP Session cookies that won't stay put -- once in a while I have a helluva time staying logged in on a site that ought to know better. (Ebay for one.)

All my O'Reilly books are too small to damage hardeaded developers who store plaintext passwords in cookies. Maybe force them all to colocate in a small room with no air conditioning and lots of roaches?? :)

Re:Please explain it to me

[el-spectre]

I seem to remember it being the early version4 netscape and IE browsers. later revisions of 4.x and above are OK.

You oughta see my 2nd edition of 'dynamic HTML: the defininitve guide'. Friggin' thing is almost 2 inches thick...

Alternately, the perl Resource kit... it's about 5 inches thick...

Re:Please explain it to me

[Reziac]

Ah, thanks. I mostly use NS3.04 (by preference!) and occasionally 4.x, but I've not had any indication that my cookies.txt has gone wandering. Not that it would be particularly useful to anyone if it did!

Oh, those sound like GOOD books for beating in the heads of Stupid Webmasters. Just make sure you don't drop one on your foot -- it'll break your whole leg :)

(I don't do Perl, but I suppose now I gotta be on the lookout for the DHTML one. As if I don't have enough books already!)

Re:Please explain it to me

[el-spectre]

"I don't do Perl"

Well, we're none of us perfect... :)

Re:Please explain it to me

[Reziac]

LOL! Well, I'm not a programmer (unless you count Fortran in high school!) tho I have a passing interest, and can generally muddle my way thru well-commented code :)

Not a big problem

[SCHecklerX]

Any site that is going to use an 'internal' login (ie, not auth'd by the webserver, but by your backend database) must use cookies. My cycling team calendar I wrote does this, and I have always on the login page stated that cookies are needed for the site to work, and what the cookies are used for. What's the big deal?

Doesn't matter

[cr@ckwhore]

My website is in the US. The US has no such law. The Swedish government has no jurisdiction here, so this is completely irrelevant except to those that publish websites within Swedish jurisdiction. Screw Sweden -- they suck anyway.

P3P

[Hooya]

doesn't p3p already cover this? you have to state that you are using cookies and for what purpose in a binary form so the browser can varify what you are stating. then the browser only allows the website to do what you stated. the browser then can display what was stated and what the browser is currently allowing the website to do based upon the binary statement. a human-readable statement is also provided (you could have the browser generate this based upon the binary statement that the browser went by) at a url so the user can click on 'privacy report' and get to the web page. providing the option to leave is so silly... the user, having read the statement and disagreeing can simply point to where ever else they want to go and just leave! i don't get that the website needs to provide an option to 'leave' a website. i didn't know i was trapped by every wesite that i visited...

just because you can concoct and pass a law doesn't mean you should. silly if you ask me.

Re:Speaking of security risks

[Anonymous Coward]

I submitted that story last night. I guess nobody around here is interested. They all must be using Debian.

Needless connection tracking...

[wowbagger]

Consider the following scenario:

You are in a mall. You see a new shop - one you've never been in before. Being curious, you approach the shop.

As you attempt to enter the shop, a large bouncer-like gentleman says

"Before youse what enters the store I gotsa stamp you hand with this ink stamp."

Would you:

1. Allow the bouncer to stamp your hand
2. Ask the bouncer if you could enter the store without being stamped
3. Turn around and not enter the shop

Now, how is this any different than a web site needlessly setting a cookie just to track you?

Too damn many websites want to set a cookie just because you tried to GET index.html - not because you are trying to set a preference or make a purchase.

mindless governments

[solidox]

just another example of why the technologically retarded shouldn't be allowed to make new (IT based)? laws. they really should consult someone who knows what they're talking about before passing stupid laws. cookies are not evil, but the media seems to think they are. people (sites) who misuse cookies are evil.

Stupidity from the Swedes?

[Anonymous Coward]

You just don't normally expect to see this kind of stupidity coming out of Sweden.

"Click 'Yes' to use this website...."

[1of0]

This website requries the use of cookies for proper function. We are required by law to ask you this. No personal information will be stored in them.

Click YES, or bugger off.

Yours Trully, Your Bank.

Knowing how IIS works gets you banned

[g0hare]

You are NOT supposed to actually know anything about Windows on Slashdot. Knowing as much about WIndows as you do about Linux may get an assasin sent to your house.

Re:Knowing how IIS works gets you banned

[Anonymous Coward]

You are not supposed to be able to spell "assassin" on Slashdot, having as bad spelling as you do will get Windows sent to your house.

What's the problem???

[jbottero]

There is absolutely nothing wrong with cookies. You don't agree? Turn them off. It's just so simple...

Interesting

[0x0d0a]

The new Swedish law does not mention cookies as such. The new law is, simply said, a response to the new technologies for collecting/storing/tracking information about private citizens, and the abuse these technologies may be used for.

I recognize the abuses being put on Internet technologies as their commercial applications grow. I've been predicting that spyware would become common when RealPlayer first showed up with their "phone home" gunk. (This is back in the day where phoning home to check for a current version was considered potentially offensive and always disableable.) However, as an engineer, I'm very frusterated by legal restrictions over what can be done, and I'm quite doubt that world legislatures can move quickly enough to make fair laws to control rapidly changing tech. Cookies can go or come, and if the US makes a similar law, I'm sure a differently-named system to store client-side state will be introduced.

In general, it appears the privacy/integrity is more respected/protected in Europe than in USA.

Mmmm...debatable. Traditionally (9/11 has screwed things up a bit) the US has done a better job of preventing government abuse of information. The FBI and the CIA have domain restrictions. FOIA lets people see what data the government is building up on them. Key escrow was shut down. Contrast this to Britain, where passwords must be supplied to the government on demand or jail time can be handed down, or most European countries, where key escrow is common.

Where Europe shines (more socialized environment that it is) is in preventing corporate abuse of information. Companies have a lot of laws regulating what they can do with information on people.

The US has started to get worse WRT government data (Office of Homeland Security, PATRIOT Act) and better WRT corporate information (limitations on sharing of data between financial institutions -- of course, this just prompted a bunch of mergers of financials to bypass said limitation, but still :-) ). The US is becoming slightly more European on information policy.

Yes, this is a great law!

[twitter]

That is certainly open to interpretation, but at the very least it means that sites that really need cookies can relax. Shopping online, logging in to a news site, or any form of web-based mail are all services the user explicitly asks for, after all.

I'll go further than you and say that this is great. It's not so much that the site user must explicitly ask for cookie services as much as the company CAN NOT do anything with cookies that they don't tell the user about and the user approves. I know this sounds like the same thing, but the implementation can be done differently. It's going to be an all or nothing deal we can imagine, but companies that lie are going to get burnt. Hopefully, this will extend to banner adds, theoretically hosted by another machine. Honest companies can relax.

If people have trouble making their stupid IIS servers comply with this, then IIS was never honest to begin with. While M$ dishonesty is the root of their bad performance, complying with Sweedish laws are the least of the problems users of IIS have to deal with.

Cookies are harmless

[Arpie]

Cookies are nothing but a little bit of text stored by your browser. They are domain specific - e.g. a cookie from a server at domain1.com cannot be accessed by a server at domain2.com.

The real problem is the media and some privacy loonies decided that cookies and the monsters underneath children's beds at night are on the same level.

Somehow this myth of cookies being bad was repeated so many times it became an accepted truth.

As a web developer, I say disabling cookies just gets in the way of letting users have a better experience at a site. You have to add sessions to the URLs, and have to have users log in to know who they are in a later session.

The only possible privacy problem is third party cookies. Mostly, advertising that tracks what ads you've seen or not, or what websites you've visited. That I don't love, and I can see privacy issues with.

However it's easy to disable thrid parties cookies with any decent browser. Only accept cookies from the site you're visiting, and nothing should break.

Isn't there a soul in the media who can see through the nonsense? Sheesh.

Re:Cookies are harmless

[Anonymous Coward]

You have to add sessions to the URLs, and have to have users log in to know who they are in a later session.

Good. If users don't all see the same document simply because they're in different "sessions", those differing documents should have different URLs--otherwise bookmarking is meaningless. And you certainly shouldn't be able to identify and track any user without their active and informed consent.

You are missing a VERY important detail.

[TripleA]

This shows one of the major differences between Sweden and the US; the government is by the people, for the people. Although this law might shoot above target and not fulfill it's makers hopes, it is evident that it has been formed with an honest intent of protecting the surfer's privacy, not some big company's capitalistic interrests.

The poster didn't read the full law

[nicke999]

Here is a translation of the law quoted in the magazine:

Integrity protection

Electronic communication networks may be used to store or access information that is on a subscriber or user's terminal equipment only if the user receives information about the purpose of such treatment and is given a opportunity to reject it.

This does not prevent storage or access that is necessary to accomplish or facilitate the transfer of an electronic message through an electronic communication network or that is necessary to provide a service that the user or subscriber explicitly requested.

Follow KRAFT...

[GundyRage]

Maybe they could just make them smaller like Oreo is doing. Smaller Oreos means lowering the risk of getting fat. The new smaller web cookies might not be as big of a security risk. G

What's stored in the cookie

[SnappingTurtle]

The law also states that the user is to be informed of what the information stored in the cookie is

Uh, a long random string?

use mozilla?

[josepha48]

why not? I do and refuse ALL cookies. If I cant visit a site that uses cookies I just leave, unless there is something I really really want from the site like info (oracle, sun, slashdot). Most sites say why they use cookies when you visit the site and you have cookies turned off for that site.

I don't understand why people, especially legislators of any country spend their time on this stuff.

Sweden needs a reality check

[code65536]

Cookies? Dangerous? It seems to me that this whole cookie-paranoia is nothing but a product of a sensational media jumping on the wrong things. Cookies aren't dangerous. And they don't hamper your privacy any more than the security camera in your local grocery store. Sweden's government needs to do a reality check and figure out what is important and what it shouldn't piddle and twiddle about.

Why don't people see . . .

[Joey Vegetables]

Why can't people see the slippery slope here??

Here we have a "government" (and one of the usually more enlightened ones at that) legislating how a piece of software - a Web site - must be designed.

Many of us just sit back and accept this, because Privacy is Good, Cookies can violate Privacy, hence Cookies are Bad, and, ergo, legislation against Cookies is Good.

I don't like or use cookies either, but the mere fact that we don't like something does not give government a legitimate power to ban it.

Here is the logical conclusion of the road you are allowing this government to travel. Computers can be used to violate Privacy. Privacy is Good, therefore Computers are Bad, and we should legislate against Computers.

Ridiculous? You bet.

But no different than what's happening now, except in degree.

Governments exist to protect Life, Liberty and Property. That is why they are created and that is their only legitimate purpose.

Governments that begin to violate these rights, even in a small way, tend to grow to violate them in bigger ways.

People who think there should be a Law against anything they don't like give government exactly the excuse they need to do so.

Please do not let a relatively minor issue, such as the abuse of cookies, justify your support of government coercion over software makers.

If you do, then don't be too surprised when eventually it starts to infringe your freedom as well.

Re:Why don't people see . . .

[Anonymous Coward]

There is no slippery slope here. Unwanted and /or unscupulous cookies are as much an invasion of personal privacy as a wire-tapped phone or a hidden camera in a restroom. I would be much more concerned by a government's giving official sanction or endorsemnet to such practices. As a Libertarian, I think this is one case of government doing its job.

Re:Why don't people see . . .

[gerardrj]

For the same reason that governments can regulate that all new vehicles must have seatbelts, airbags, crumple zones, etc. These force car manufactureres to design cars a certain way.

These car building regulations do nothing to protect anyone's rights or property. The only life they protect is my own, and I should be allowed to choose if I want airbags and seatbelts.

Besides, the government in the situation reported isn't making cookies illegal. They are making the non-consenting use of cookies illegal. And while I'm sure that privacy is partially the cause, security is also partially the cause. If these cookies are going to store your bank account number, and your on a public or multiple user computer, you really should be told what info is being stored.

And before you say "well if you use a public terminal you should know these things", remember that many people who use public terminals are not computer savvy.

Good Idea Even without the law

[Gargon the Rat]

I have Mozilla ask me if I want to accept cookies, and blocking them usually dosn't cause a problem. I really apreciate it when a web site dosn't even try to set a cookie till I click something that might need to be saved like a "buy it" link. That way I know they have a reason other than snooping for the cookie.

Translation of the article

[Anonymous Coward]

Might not be 100% correct, but it gives you a clue:

Svårt följa ny lag om elektronisk kommunikation

(2003-07-24 16:24)

Many sites become illegal today. Since new law regarding electronical communication is taking effect. It says that the sites has to inform about the content in the cookies will be used for. The users should also be given the opportunity to refuse using them.

From today on, Swedish websites can't use so called cookies without informing about the purpose of computing the data that's in them. In addition, the user is given an opportunity to stop using cookies.

That's the consequence of the new law about electronical communication, SFS 2003:389, which has started to take effect.

It's not enough that the web browser automatically chooses to accept cookies. The website you visit must inform about how the information will be used and also give the user the ability to refuse using cookies.

Cumbersome for the web sites
Therefore Swedish websites has two alternatives.

- One alternative is to stop using cookies. The functionality of the website will suffer, says Jonas Eriksson at Webkonsulterna in Östersund.

Jonas Eriksson doesn't want to think about the second alternative.

It means that the majority of the Swedish websites that use scripting languages with session variables - such as ASP and PHP becomes illegal - unless they don't built the websites so that the user can approve the use of cookies before they enter the pages.

But it doesn't end there.

It's not enough that you on a daily basis see a bunch of banner advertisement and popup messages. Now the advertisement network has to start a JavaScript and ask if you're allowed to set a cookie and then show the commercial, he said.

PTS keeps track of the law
The Swedish Post and Telecommunications authority (PTS) is the guardian authority for this law, and on their website it says:

"Cookies are used from a technical point of view and today it's used by most web sites. According to the new law on electronical communication, which takes effect on July 25, 2003, all web site visitors should be informed of the usage of cookies and also be given the opportunity to refuse such usage."

Threat of getting a ticket
According to Charlotte Ingvar-Nilsson, deputy legal manager at PTS, PTS will control how the market is reacting on the new law.

- If the web sites don't follow the law, we'll start informing about the changes, she said.

If that's not enough?
- If we got a suspicion that someone doesn't follow the law, the web site gets at least one month to fulfil the requirements stated by the law. After that we have the right to enforce it in conjunction with a ticket, said Charlotte Ingvar-Nilsson.

If the web site doesn't fulfil the duties, PTS also have the right to decide to shut down their business if it's not a small matter.

- We'll have to wait and see if this is something that will be implemented for this case, said Charlotte Ingvar-Nilsson.

by Anders Nordner

Missed the headline

[Anonymous Coward]

Svårt följa ny lag om elektronisk kommunikation means "Hard to follow the new law on electronical communi"... missed that one.

Cookies aren't the problem

[Cranx]

The problem is what people are using cookies FOR, not cookies per se. Using cookies to store passwords or access keys is insecure unless you take into account the risks involved and go a step further to protect the user.

A blanket decree requiring web sites to require user permission before using cookies of any sort is ignorant.

Re:Cookies aren't the problem

[Anonymous Coward]

You're missing the point. "The problem is what people are using cookies FOR, not cookies per se." is exactly what it's all about. It's to bring to the user's attention what kind of intention the website has with collecting data.

Re:Cookies aren't the problem

[Cranx]

That makes sense, but I think the part about requiring the user's permission is a little harsh. Unless they allow the web site to state "by continuing to use this web site, you are agreeing to the site's use of cookies as described here (link to cookie description)."

If they're happy with that sort of thing, that would be fine. But if they expect every site that uses cookies to push people through a YES/NO page, that would be immensely cumbersome.

Good point but wrong

[metalhed77]

the law restricts the general concept of unauthorized storing of user info. Hence, doing that also now seems illegal. Bizarre eh?

Flash should be outlawed next....

[Anonymous Coward]

Any comments? :-p

Solution to a problem that doesn't exist

[gregmac]

They want to surf the web, safely, without people storing information about them forever.

Don't overlook the fact that a website can't store information about you unless you give it that information somehow. I personally like it a lot more when a website remembers my settings or preferences the next time I come back. I don't have to log into /. every time I come.

Where this breaks down though, is advertising. Advertisers that load banners off a central server could use this for tracking what sites you visit. If this is a big concern to you (despite the fact they don't actually know who you are, or anything about you besides your cookie id and the sites you visit..), then you can always block all the advertising servers. There are lists circulating of hosts files to change the IP's to 127.0.0.1 or something, and updated frequently.

Yeah sure, the average user probably will have a hard time doing that. But then the average user isn't as concerned about privacy. If they are, then they'll learn how to protect themselves.

Hell, I deal with 50+ people a day that don't want to fax their CC number to me, you think that they want their person information stored on a webserver tha is easily hacked?

What does this have to do with cookies? Even if you disable cookies, they can still store your information; they just don't know its you when you come back.

And what's to stop people from using other methods? Track your IP address along with your USER_AGENT string, and as long as that USER_AGENT comes from the same subnet, assume it's the same. Or go further and use Javascript to detect screen resolution, versions, etc. Use as much information as possible to make a 'fingerprint' of that browser.

Overall, I think this whole thing is a legal solution to a already-technologically-fixed problem that doesn't even exist in the first place.

I'd hate to have to deal with this...

[wackoman2112]

I don't see why websites should get your consent for cookies. Most modern day browsers like Mozilla or IE6, there are options to restrict first-party cookies and second-party cookies based on the website's compact privacy policy. You can even create a blacklist of websites you know abuse cookie power. Of course, some sites might not have a compact privacy policy, so maybe better legislation would require a policy on every site!

Even still, I've never been very concerned about cookies. If you're worried about them tracking your every movement on the internet, block third-party cookies. And keep in mind they can track you by IP address!

Overall, I think this is plain unfair to the websites that will have to completely rewrite their whole websites to comply with this ridiculous law. Luckily I don't have to deal with it!

Mod down parent post... -1 Ignorant

[Anonymous Coward]

You need to get by the first paragraph and start to realize what this law is all about. It's about privacy. The web site owners has to tell the users about the way they use the data they collect by having a cookie at their browser.

Cheers!

Hmm interesting though

[OaXlin]

Based on several of the translations I have seen in the other messages the law breaks down to

1) you must give the end user information about the cookie before it is stored
2) the user should have the option of refusing the cookie.

So, cant #1 be completed by sending the information in the HTTP headers??? Who cares if they don't read it (or don't know how)... It was still available to them :P (ignorance of a law doesn't exempt you from the law)

And #2, and cookies can be refuesed by most current clients. If the user elects to use software that doesn't have the refusal ability. All that needs to happen here is that the customer needs to "upgrade" to get that ability.

In fact, wouldn't the act of sending the cookie itself fit the above descriptions???? All the user needs to do is read the cookie themselves and decide wheather or not to accept it.... If they don't choose to do so, or have a browser that can't, they are the only ones at fault.

Browser options - not legislation

[rfmobile]

As someone else pointed out, configuring your browser to accept cookies amounts to consent, IMHO.

This issue has already been addressed as part of the feature set of all major browsers. We don't need a law to enforce this. Users already have all the tools they need.

-rick

I fully do not agree.

[ciantic]

Well i think that question about do you want to use cookies is browsers problem. But some kind of information site about sites cookies is not a bad idea. If you really want to store information about some surfer there are whole bunch another ways so... I think that in future it is even "easier" and more reliable to store information related to IP. Mostly i use cookies cause im too lazy to make db table for users or something else (and also cause IPs are mostly dynamic).

Cookieless? That's easy with .NET

[Anonymous Coward]

Just include:

set sessionState cookieless="true"

in your web.config file and ASP.NET will not use cookies to store the session state. Rather, a hidden form tag stores the session identifier.

stupid.

[VanillaCoke420]

All websites physically in Sweden, or all websites that's in swedish, no matter the physical whereabouts? Either way, stupid law. As such, nothing new to see.

Re:don't want cookies ... don't go there

[Anonymous Coward]

or, as the law says, webmasters could be up-front about what they're doing.
Until all people are honest, there will be laws to punish those who aren't
and some innocents will alway be squeezed in the process.

gewg

Re:People who haven't used IE for years

[Anonymous Coward]

or the people who know M$'s reputation and don't trust Windows Update to get patches for and/or new version of IE.

Cookies Suck - Sites Should Use Hidden Form Fields

[Anonymous Coward]

Title pretty much says it all. Hidden form fields in dynamically generated HTML work fine to maintain state data. I use this method all the time to build shopping carts and navigation systems. There is no need to put session state info into cookies or URLs and I find sites that do so annoying.

What the law basically says

[wootest]

You have to have a page (linked to from the front page) to describe what cookies are, how to disable them and how they are used on your page. Having it as the front page is NOT necessary, nor is having it all as text on the front page. The information should be able to be accessed during the web site visit, in a nutshell. You do NOT need to have a no-cookie version since the user can empty her cookies or simply block cookies from your domain. However, a link to the explanatory page from your login is preferred.