News for hackers. Stuff that matters.
Re:Google YOLO clickjacking by fivre on Friday May 11, 2018 @12:21PM (#17048571)
Cookie disclaimers at this point need to be taken to their logical conclusion: browser vendors and site operators should add a standard Yes-I-Know-What-Cookies-Are header to the next HTTP update, which can then be vomited at sites by default browser configuration to let them know it's okay to auto-hide the banner.

Hell, let's repurpose Do Not Track for it; it's not like it's being used for anything meaningful otherwise.

Re:Google YOLO clickjacking by stochastic_monk on Friday May 11, 2018 @12:25PM (#17048618)
Does anyone honor Do Not Track requests?
Re:Google YOLO clickjacking by criley2 on Friday May 11, 2018 @12:34PM (#17048699)
I feel like honoring Do Not Tracks is like honoring deadbolts on wooden doors. Most people honor it, but you're not using it to keep those people out...
Re:Google YOLO clickjacking by jake_the_third on Friday May 11, 2018 @09:01PM (#17051865)
I expect that the reason why most people honor the first is the high likelihood of getting caught or seen. This deterrent does not exist for web tracking.

I think it's more likely that most tracking companies ignore do not track.

Re:Google YOLO clickjacking by klapinat0r on Friday May 11, 2018 @12:36PM (#17048727)
Re:Google YOLO clickjacking by wgx on Friday May 11, 2018 @02:04PM (#17049518)
We do (at https://prodlytic.com) - if a client sends do not track, we treat every session as a new user. ie: We don't track that user across sessions.
Re:Google YOLO clickjacking by Frizi on Friday May 11, 2018 @06:48PM (#17051271)
The DNT header reminds me of evil bit RFC [0]. It was funny back then, but times change I guess.

[0] https://www.ietf.org/rfc/rfc3514.txt

Re:Google YOLO clickjacking by colejohnson66 on Friday May 11, 2018 @05:26PM (#17050915)
Adafruit does. They put their YouTube videos behind a click if you send a “Do Not Track” header.
Re:Google YOLO clickjacking by LinuxBender on Friday May 11, 2018 @12:58PM (#17048906)
Is anyone required to honor DNT requests? What happens if they don't?
Re:Google YOLO clickjacking by fenwick67 on Friday May 11, 2018 @03:19PM (#17050115)
It's totally voluntary.
Re:Google YOLO clickjacking by LinuxBender on Friday May 11, 2018 @04:10PM (#17050460)
That was my understanding as well. I was not sure if perhaps recent legislation in the E.U. may have added any verbiage around that.
Re:Google YOLO clickjacking by Sylos on Saturday May 12, 2018 @03:34AM (#17052945)
The GDPR rather makes it obsolete, actually. DNT was meant as a general purpose opt-out, whereas the GDPR requires an explicit opt-in for most things.

And well, DNT could have had legal bearing, since most legislations in the world require you to stop tracking when the user tells you not to.

So, if the user goes and sets up this general purpose opt-out, you'd have to have some sort of argument why you're different than what the user had in mind when they turned DNT on.

Could have had that legal bearing. Microsoft as well as Google and Facebook killed it off pretty well.

Microsoft by turning it on by default in Internet Explorer. Meaning that there were now lots of instances where the user had not explicitely gone into the settings to turn it on (nor did they perform some other action that serves as reasonable sign that this is what they'd want, like going into InPrivate Browsing, or specifically installing a privacy-focused browser / operating system.)

Google and Facebook killed it off by saying right away that they would not respect it. With how many webpages bundle a Facebook Like button or Google: Analytics, ads, GStatic, ajax.googleapis.com, JQuery, fonts, ReCaptcha, Maps, YouTube etc.

As such, there were very few webpages left that could have chosen to respect it and no judge would have just ruled that everyone has to respect it. It would have killed the internet for a few months.