Slashdot Mirror
Sweden Crunches Cookies
dillkvast writes "According to this article (swedish) at ComputerSweden swedish websites must now have the user's consent to use cookies. The law also states that the user is to be informed of what the information stored in the cookie is, and its intended use. This leaves swedish website with two options: No cookies at all, or a special page where the user is informed of the cookie use and can choose to either accept or reject the cookies. This represents a huge problem for swedish sites which use .asp and .php session variables, the article states, which will have to rewrite their sites to present the user with a chance to confirm that cookie use is ok. The law comes into force today."
Do these people not know you can reject cookies with your browser?
If you configure your browser to accept no cookies, some cookies, or all cookies, isn't that consent for websites to SET the cookies? Seems to me that this is an attempt to legislate a human problem - people want 'privacy' but are too bothered to keep clicking the button to acknowledge the "this site wants to set another cookie - you already have 12345 cookies from this site. Continue?" button. So the State 'makes' things 'secure' and 'private' by passing a law that says that only 'bad' people will use hidden cookies.
Wake up folks, know how to operate your browser. You can work an answering machine, a VCR, and an automobile, why not a web browser?
I want to delete my account but Slashdot doesn't allow it.
There's no need to rewrite your site, just direct any visitor to this splash page. If they don't choose to use the cookies, they don't get to use your site.
Sounds a bit harsh, but speaking as a Web developer, if you're working with a non static site it's simply too much of a pain to produce a good site. It's not impossible, it's just a huge pain. Almost all users will accept the restriction of cookies.
A few years ago I wouldn't have said this, but browsers today who refuse to use cookies are just cutting themselves off from a large part of the Internet. Let them cut themselves off. When they're ready to join the rest of us, they're welcome to.
As for privacy concerns, Mozilla has a nice warn-me-before-storing-a-cookie mode. Here's a clue for the Swedes, it should be the browser manufacturers providing consumers with options to protect their privacy.
---
I support spreading santorum
I've said it before and I'll say it again - the terminology employed in internet law as it relates to internet standards is seriously screwed up.
What they're legislating here is that before a server transmits an HTTP response featuring a Set-Cookie header, they must send a prior (human readable) HTTP response to the client saying that they'll be sending a response with a Set-Cookie header along next if the client doesn't mind.
This is ridiculous - there's no law saying a client must obey set-cookie headers, there's no reason for Set-Cookie headers to have any more legal status than Cache-Control headers. Set-Cookie is just a suggestion from the server to the user agent that it would help the server if the user agent remembered the attached cookie data, and sent it back in a cookie header with any subsequent requests.
Set-Cookie is a request, not an order. If the client chooses to accept the cookie, that's the client's business. If the client chooses to ignore the cookie, so be it.
Legislation doesn't belong in this field. The protocol provides for the situation where the client has privacy concerns about the server. legislating to effectively override IETF standards is a dangerous direction to go in.
There's a greater chance that your session would be hijacked accidentally if you fwd a URL that has your session ID in it to someone else.
creation science book
Meanwhile back in real life millions of scam artists, spammers and paedophiles remain confident that legal loopholes exist that allow them to do what they do without fear of prosecution.
Cookies security problems? That's so 1996... Get with the real problems the Internet needs laws to prevent.
Specifically:
Seems to me like there's a metric buttload of questions to be answered before we can have anything like a reasoned debate on this.
If you were blocking sigs, you wouldn't have to read this.
The new Swedish law does not mention cookies as such. The new law is, simply said, a response to the new technologies for collecting/storing/tracking information about private citizens, and the abuse these technologies may be used for. It attempts to give the private citizen some control of what type of information is collected, and what may be done with that information.
In general, it appears the privacy/integrity is more respected/protected in Europe than in USA. While US funds the Total Information Awareness Agency, the German State funds Anonymity is not a crime
Oh, and while storing the source IP is a partial solution, it's not 100% (think people behind a common proxy), and the whole point of the session id is that you DON'T re-enter your user/pw at every page. Cookies are the best, cleanest way to maintain state over a session. They're even better if you want to maintain state over multiple sessions (on the other hand, this can be dangerous and I'm not sure that it's usefull enough to outweight the security and privacy concerns).
- M.
So, if they really wanted to mix it up, they'd order the browsers to have them off by default (or ask the user on their first run) and make sure websites don't need them to function. But requiring them to get consent is silly. Cookies are an essential part of web design, misused, for sure, but I can misuse images or session headers or the REFERER field in HTTP/1.1 to track someone as well. Government should not be legislating technology, when possible, be it for corporate gain or perceived consumer safety.
While US funds the Total Information Awareness Agency, the German State funds Anonymity is not a crime
That is because we have not had our Police State experience yet. After the Untied Police States of America comes into being, and then eventually is overthrown, we will value things like anonymity. If we never have this experience, then we might instead just continue to have a gradual erosion of many rights. Of course, I suppose that eventually this would have to lead to the Unites Police States. The pendulum will probably have to swing fully one direction and then back.
Those who would give up liberty in exchange for security and DRM should switch to Microsoft Palladium!
I'm from sweden and I must say that this sucks.
.se domain name, you had to get a www.site.region.city.se.
It's just one more of those stupid swedish rules that hinders the marketplace. Like back in the day, you couldn't get a
Why can't they just leave the internet alone!
Stupid lawmakers.
Will code a sig generator for food
Cookies are often over used anyway. Check youre own cookie cache and check the number that are used to track you vs the number for youre convenience. (like slashdot remembering youre login). For me at least the first category by far outweighs the latter.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
The internet is, by it's very nature, not a location-specific sort of thing. Why wouldn't every ISP in Sweeden simply pack up and move to Norway? They keep their traffic, keep their design, keep their cookies, and all they have to do is live in lovely Norway.
This basically means you can't use ASP sessions AT ALL. You could have a session-disabled ASP page at the start of your site to present a "do you want to use cookies?" option - but then you've got to code your site without sessions at all.
Right!
Take a deep breath and repeat after me: "Gratuitous session state is a bad thing."
Oh, I'm not saying a login session (for sites where logging in is apropriate) with a few variables is bad, but session state for sites where folks are essentially "browsing through" is evil. Yes, I understand that it is harder to do it right, but the resulting improvement in performance and scalability you get w/o session state is well worth the effort.
If you can do your site w/o session state, you absolutely should do your site w/o session state.