Feds Seek Input On Cookie Policy For Government Web Sites 74
suraj.sun sends along this quote from Information Week:
"The government wants to use cookies to offer more personalized web sites to citizens and better analytics to Webmasters. ... The federal government has drafted changes to its outdated restrictions on HTTP cookies, and wants the public's input. Under the plan, detailed in a blog post by federal CIO Vivek Kundra and... Michael Fitzpatrick, federal agencies would be able to use cookies as long as their use is lawful, citizens can opt out of being tracked, notice of the use of cookies is posted on the Web site, and Web sites don't limit access to information for those who opt out. ... The Office of Management and Budget is considering three separate tiers of cookie usage that will likely have different restrictions for each, based on privacy risks. The first tier of sites would use single-session technologies, the second multi-session technologies for use in analytics only, and the third for multi-session cookies that are used to remember data or settings 'beyond what is needed for web analytics.'"
Oreos (Score:4, Funny)
Content-transfer-encoding (Score:4, Funny)
Re: (Score:2)
Sir, I believe you have the makings of an April Fools RFC.
Re: (Score:1)
I don't have kids, and I haven't watched the show for 30 years, so why do I hear it in Cookie Monster's voice every time I read the phrase 'cookie policy'? (Coo-kie Po-li-cy!)
Re: (Score:2)
The show was just that good.
P.S. the shows today's kids get are not.
Re: (Score:3, Funny)
Oreos are a symbol of black power and the racist ideals Obama is trying to indoctrinate our wonderful nation with. The pure Aryan nation is represented by clean white filling of the Oreo, with the other less pure races as the hard cookie, squeezing on both sides ever last bit of culture the white man has left. We must rise against and elect Vanilla Wafers as or government cookie. White power! /s
Re: (Score:2)
OREO COOKIES nom.nom.nom.nom
What was the rest of the comment about?
Re: (Score:1)
How about no? (Score:5, Insightful)
Just don't use cookies. Or at the very least, allow people to opt *in* rather than out.
What a concept, right?
Re: (Score:3, Informative)
I don't see any problem with a "remember these settings" check box on a web page which sends a cookie if ticked.
Re: (Score:3, Interesting)
Cookies expire at end of session according to my preference.
That's fine for session management, but when sites start storing preferences, I get reset to the bone-headed defaults every time.
Then I leave and never return.
Re: (Score:1)
Cookies expire at end of session according to my preference. That's fine for session management, but when sites start storing preferences, I get reset to the bone-headed defaults every time. Then I leave and never return.
How else do you expect a site to store your preferences, then? I'd rather have a cookie on my computer than have the site force me to make an account (e-mail address and all) with them and store it on their server. (Of course, "bone-headed defaults" are another story...)
Re: (Score:3, Insightful)
Cookies expire at end of session according to my preference. That's fine for session management, but when sites start storing preferences, I get reset to the bone-headed defaults every time. Then I leave and never return.
How else do you expect a site to store your preferences, then? I'd rather have a cookie on my computer than have the site force me to make an account (e-mail address and all) with them and store it on their server. (Of course, "bone-headed defaults" are another story...)
on a database , like it should ? And then retrieve the preferences after logging in. I don't see the problem.
Re: (Score:2)
If you'd read the person you responded to, you'd see that he specifically said that a cookie is a lesser evil than requiring you to make an account in order to preserve settings.
Of course, regardless of whether it's by login or by cookie, the settings have to be stored in a database of some sort, unless there are so few preferences that the preferences themselves are stored in a cookie.
Re: (Score:2)
If you'd read the person you responded to, you'd see that he specifically said that a cookie is a lesser evil than requiring you to make an account in order to preserve settings.
It need not be a full-blown account - "e-mail address and all" - just a username and password that your browser can automatically memorize and fill in each time you start a new "session."
After all, if you don't need "e-mail address and all" for a cookie, then you don't need it for any other identification mechanism either.
Furthermore, any site that requires cookies for full usability is doing its users' a disservice because it is one more site that encourages them to use cookies. Until web-browsers come wi
Re: (Score:2)
So you want your browser to send the site a key and value every time so the site can track your preferences. Congratulations, you just invented cookies.
So basically, you're blaming the web sites for the fact that the browsers do not implement the exact functionality you want. Did I get all that?
Re: (Score:2)
So basically, you're blaming the web sites for the fact that the browsers do not implement the exact functionality you want. Did I get all that?
Nope. I am blaming websites for encouraging users to avoid good security practices.
Re: (Score:2)
What about Web sites that send cookies using the HTTPonly flag so that cookies aren't readable via JavaScript?
Have the Feds, or any other major service, looked at using DOM Storage as an alternative to cookies? DOM Storage allows for more data to be stored, and it removes extra data being transferred via every HTTP request. Yes, it is only available in modern browsers, but that need not stop its use, or at least making policy towards its use.
Re: (Score:2)
How else do you expect a site to store your preferences, then? I'd rather have a cookie on my computer than have the site force me to make an account (e-mail address and all) with them and store it on their server. (Of course, "bone-headed defaults" are another story...)
I think it would be good if sites that store cookies on your computer (especially keys into a server-side databases) were required to describe what information was associated with that cookie, both client-side and server-side. I don't mind them storing preferences for what skin to use for the website UI (OK, I mind that none of them are tasteful, but that's a whole 'nother story) but if there's a large profile of me behind it all, I'd like to know!
I'd also like to know that information for session cookies.
Re: (Score:2)
I was certain pretty much all gov sites that allow logins use cookies. Now I'm wondering how they track sessions... Hmm...
Re: (Score:2)
Everyone already worried about the cookie-tracking habits are already using web browsers and add-ins that deletes the cookies after the end of the session.
So what's left is standalone sessions with a certain habit, but no easy way to detect a re-visit.
Re: (Score:2)
Just don't use cookies. Or at the very least, allow people to opt *in* rather than out.
What a concept, right?
You're an idiot.
HTTP is a stateless protocol. That's fine if all you're doing is looking at documents, but the Web can do much more than that. There are services that I want the government to be able to provide over the Internet that involve more than just looking at documents. These require tracking state, which is what cookies were designed for. You can fake it if you have to, by putting session variables in query strings, but that makes all of your links ugly and makes it rather awkward to send links
Yeah OK (Score:2, Insightful)
Re:Yeah OK (Score:5, Insightful)
This is a legal issue, not a technical one. Replacing lawyers with engineers wouldn't do anything here.
The government isn't trying to engineer a new "cookie" paradigm or anything, they're investigating the legalities of a federally-owned website tracking users.
Cookies have been used by websites forever, but there may be a difference between your browsing history and preferences being recorded by bestbuy.com versus whitehouse.gov, at least in the eyes of the law. That is what the article is talking about.
Re: (Score:2)
Dealing with cookies (Score:2)
If government want my opinion on cookies, I know someone who will deal with them in a kind / compassionate way.
http://en.wikipedia.org/wiki/Cookie_Monster [wikipedia.org]
I think this is great (Score:2, Insightful)
The NSA perfoms illegal wiretaps and then the government consults the public over web cookies? What next, rapists asking their victims if they'd object to being given a hicky?
Go, go "team freedom"!
Re: (Score:3, Insightful)
Re: (Score:1)
It gives the public (electorate) the impression that there is transparency and freedom to choose. I am grateful for every piece of illusion that makes reality more bearable. It sure beats the frontal lobotomies [npr.org] that were popular in the 1940s and 50s to treat moodiness and hyperactivity in children.
Re: (Score:2, Interesting)
There is a significant amount of justified mistrust in the government right now, but the thing is that if they were up to something nefarious, I'd assume they'd use a method that was much less easily dodged by people
This issue is whether it's legal (Score:2)
"it is currently perfectly legal to use cookies"
That's the exact issue. It's currently NOT legal for the government to collect information on someone without a valid reason. Two good examples are the Watergate fiasco and recent illegal wiretapping. This is about trying to define cookies as a valid operational requirement, and set the appropriate boundaries for the collection of any information.
How the cookie crumbles (Score:1)
I think we can trust the government not to misuse the data, right? It's not like it doesn't know everything about you anyway. I'm sure its "privacy policies" are every bit as honorable as Google's, or Microsoft's.
Privacy (Score:3, Funny)
Cookies are evil in the first place. Tho they do taste good.
Re: (Score:2)
Why? (Score:2)
Re: (Score:1)
I mean, theres not any preferences, logging in, etc. by members of the general public
Three federal government programs that do/should provide a Web interface to authenticated users:
These are off the top of my head. I'm not trying very hard.
There's a joke in here... (Score:1)
Suggestions (Score:2, Interesting)
1. Tracking MUST be in aggregate. Any categories of users SHOULD come only from self descriptions fcrom the user. (ie clicking "i run a small business")
a
2. Preferences MUST be stored client-side in cookies, not server-side. Sites MAY use hashing to prevent tampering where appropriate. Preferences SHOULD be stored as plain text so that they can be read and perhaps changed directly by the user.
3. Users SHOULD NOT have unique ids tagged to them, and MUST not have unique id's tagged to them over more than one s
Re: (Score:2)
Re: (Score:2)
Would you tell them that if they were in a corporate environment and HAD NO FUCKING CHOICE not to use a braindead browser on a holey operating system?
Re:Does it matter at all? NOT! (Score:2)
Yeah, right. Granny knows about cookies, privacy, and how to disable one to protect the other, while she's out there reading e-mail from the kids, checking up on the latest on Martha Stewart's site, and going to the political discussion that her smart, college-educated son directed her to on the .gov site. Sure she can just pop in and selectively disable cookies as required.
NOT!
This should be the universal Cookie Policy (Score:5, Insightful)
This is my general policy:
If you are incapable of developing to these standards, say, because you don't understand how session cookies should work, then please find another line of work.
Cookies are bad for the health of your website, news site, or blog. Cookies are good for the health of your web application.
Re:This should be the universal Cookie PolicyIMPOR (Score:2)
That is clearly The Most Important Cookie Commandment of all!
I'd give you Insightful+1 if I had mod points today.
Re: (Score:2)
Cookies are bad for the health of your website, news site, or blog.
Are you retarded? Slashdot would suck ass without cookies.
Re: (Score:2)
Don't ever store a cookie by default on websites that don't have a login.
But they're an excellent way to tell apart humans from bots, which is important for performance reasons since they've got completely different browsing profiles. You'd think that using the browser version string from the HTTP request header would work, but it doesn't. Some bots are stealthed. However, a session cookie is fine for these purposes; if you're distinguishing between session cookies and expiring cookies, then you need to make that clearer; both are still cookies.
Don't ever, ever, ever store cookies on a different domain than the one in the address bar.
Does that even work at all? Should
"Gluten Free"? (Score:2)
I find it funny that this story's been tagged "gluten free"... My wife has celiac so I tend to think of gluten as something I have to deal with and other people aren't too aware of. :)
Public Input? (Score:2)
They say public input, but what is to stop any lobby group with deep enough pockets and a large enough network from organising its own flash mob, to sway the government one way or the other.
This seems to be a common feature of modern life. We are told that policy is driven by the will of the people, but how can we be sure of that? How do you tell the difference between thousands of genuinely aggrieved people, and thousands being paid to be aggrieved? How do you tell the difference between consent, and manuf
lawful? really? (Score:2)
federal agencies would be able to use cookies as long as their use is lawful,
The feds promising to only do lawful things? What a novel concept! I wonder how they will adapt?
Don't share them (Score:3, Insightful)
Is there anything more to say than Don't share them between sites?
If you login then of course you need a cookie. And using them for stats within one site is not much different to using IP addresses. But it's when you start including invisible images from a 3rd party site that shares the stats between multiple domains, that most people think crosses the line into creepy surveillance.
Login cookies = fine. Telling one site that you visited another site = not ok.
(or to phrase that another way: don't exploit loopholes in the security system)
Re: (Score:1)
If you login then of course you need a cookie. And using them for stats within one site is not much different to using IP addresses.
While I agree that there a significant benefit in using login cookies, they are not remotely âoenecessaryâ. Java-based servers have had a fantastic technique using a little-known part of the URI shceme [wikipedia.org] where every segment can have parameters. It looks like this:
http://www.example.com/app;sessionid=ABC123DEF456/<whatever>
This allows cookie-like storage in a way that isn't able to be tracked across multiple domains.
Re: (Score:2)
If you login then of course you need a cookie. And using them for stats within one site is not much different to using IP addresses.
While I agree that there a significant benefit in using login cookies, they are not remotely âoenecessaryâ. Java-based servers have had a fantastic technique using a little-known part of the URI shceme [wikipedia.org] where every segment can have parameters. It looks like this:
http://www.example.com/app;sessionid=ABC123DEF456/<whatever> [example.com];
This allows cookie-like storage in a way that isn't able to be tracked across multiple domains.
great, so every time someone follows a link from your site (or you include an external image) their session key is transmitted via the referer header...
Fed only wants your 'input' as propaganda! (Score:2, Interesting)
The feds are not really interested in realistic input from the public. If they were, they would not require that commenters 'log in'. The cookies are being sought in order to deny the public the option of logging in...or not, simply by placing persistent 'tracking cookies' and other types of malwaaare. I checked their website cited above in the submission and you will find that indeed it does require 'logging in'. As such, only the converted choir will comment, and all these comments will be 'filtered for c
Ask the users.. (Score:2)
Expiration date on cookies (Score:1, Insightful)
When I examine my cookies, the first thing I do is look for anything that has an expiration date more than 5 years in the future.
Those cookies are immediately deleted and blocked permanently.
There is no reason but sloth to set a cookie with such a huge number for the time to live.
I hope the government policy sets reasonable times for their cookie policy.
IE, a session cookie should not outlive the session.
Answer (Score:2)
A simple set of rules (Score:1)
A cookie is acceptable if one of the following is true:
1. The user has directly requested it, such as by clicking a "remember these display settings" button.
2. The user has been warned in advance, and EXPLICITLY OPTED IN to it. Explicit means the warning was in plain, easy to read text, in a single paragraph if possible - not buried on page 7 of a EULA or shoved in a privacy policy that's linked in tiny text and no one ever reads.
3. The cookie is a session cookie, and once the user has closed his browser, i
Cookie Paranoia (Score:5, Insightful)
You know, it's fucking ridiculous that people harp about cookies, which are entirely under the user's control, but ignore the CSS browser-history hack [ckers.org] that allows any site to probe whether you've visited another completely unrelated site.
Wake up people! If you want security, worry about the issues that are actually dangerous, not the ones that just sound the scariest.
Bloodhound Gang (Score:1)
Here's an idea: (Score:1)
Have a clearly accessible page that displays the cookies you're sending, and explains what each cookie they've set is for, what data it ties to you, and most importantly have a button right there on the page to delete it.
Yeah I know most browsers have built in stuff for this already; some don't and most average users would never think to look there anyway.