My life as a criminal cookie clearer: Register vulture writes Chrome extension, realizes it probably breaks US law Over the weekend, I created my first Chrome extension and prepared to publish the project to GitHub until I realized it was possibly illegal under America's Digital Millennium Copyright Act. It's not a great loss to the world. The extension, which I called Bloom Broom, is about as basic as can be. I wrote it after completing …
Seems an almost pointless crusade in a world where it's apparently illegal to "bypass" a lame-ass "protection" method that relies upon leaving rubbish behind on the user's machine; yet it's all too easy to spot a photo or whatever that one likes and "Share" it with the world. Just think how empty sites like Pinterest would be if all the material that wasn't created by the uploader was cleared out...
Meanwhile Orphan Works battle it out with the mighty Mouse for interesting ways to further break the concept of copyright that does exist, along with the wheeze of "licensing" content simply because it is supplied as a stream of zeroes and ones.
The whole thing is not fit for purpose.
The magnificent work of Adnauseam is not illegal because we are still seeing the ads (as far as the ad broker is concerned) but the really good news is that we are poisoning the well by clicking on all of their links (as far as the ad broker is concerned)
It is the only way of fighting fire with fire - ad blockers and cookie removers on their own are fine - the easiest thing to use Firefox's inbuilt settings to throw the cookies when you shut the browser.
Looks like I might be the first (and only?) one to point this out, but this is about more than potentially breaking the law. What about ethics? Seems to be that it's a case of misplaced entitlement. It's available, so I should be able to get it for free.
Here's how I see the situation. Content provider (say, a magazine or newspaper) offers products (articles) for purchase. After all, they've got to eat too. First five or so are on them. Then you're supposed to pay.
How is this different from a food place that hands out free samples to passers-by - one per visitor, please? Do you just keep coming back in a different disguise?
If you want to down-vote this, fine. But it'd be good to also drop a comment on your rationale.
Not the same argument, but:
@Drew Scriver. yes, "they've got to eat", but why does that make them too lazy to sort out micropayments.? Why do we have to set up a pricey monthly or annual subscription for all we can read, when we only want to read a couple of articles?
I never buy anything I see advertised on TV - does that mean I'm breaking the law watching that. If I use an add-blocker I am saving the advertiser the effort of sending me an advert that I will either ignore or pointedly not buy.
If you want people to pay for your content dont give it away like free samples all the time, because yes I will continue to eat your free samples if you are dumb enough to keep giving them away.
Pubs used to get it right - free snacks on the bar to make you thirsty. My old local used to do peanuts, crisps, roast potatoes and home made scratchings on the old time limited Sunday lunch and it was mobbed. Co-operative marketing is far better than the snipey shit you get now.
Instead of running an ancient version of Firefox, why not just install CookieAutodelete?
I run that as standard so only cookies on the allowlist are kept, the default is to remove cookies after a session.
Another option is uMatrix - gives fine grained control over what you will let your browner do and read (and which cookies it will accept), on a per-URL basis. It’s a faff and takes time to set it up so that stuff you’re interested in still works, but if you want fine control it’s difficult to beat
To view (and remove) individual cookies in the latest Firefox hit the F12 button to bring up the Developer Tools when the open tab is the site you want to clear cookies from. Click the Storage tab and expand the Cookies option in the left hand menu. Click the relevant site name and all cookies for that site will be listed in the main pane. Select any you want to remove and hit the Delete key.
All of those options are a major PITA compared to a dialog that pops up for a new site and you just say Y/N
> hit the F12 button to bring up the Developer Tools when the open tab is the site you want to clear cookies from. Click the Storage tab and expand the Cookies option in the left hand menu. Click the relevant site name and all cookies for that site will be listed in the main pane. Select any you want to remove and hit the Delete key.
Seriously? Fuck that.
> No, it's still there.
Yes, that is still there, but Preferences -> Privacy -> History -> Keep Until "ask me every time" is gone.
And the point is that you don't know what sites or subdomains are setting cookies, and that "Manage permissions" requires the full subdomain.
"Ask me every time" became ridiculous on the web like 15+ years ago.
Nowadays the best strategy is use an extension that auto-deletes them, make the default "session only" and set the timeout after tab close to delete to ~60 seconds. (In case you're doing an e-commerce transaction or some other page that pops a new window to enter credentials in and then redirects back to the original page afterwards to complete the transaction with cookies carrying the login status)
Then just add the few sites you do need persistent cookies on as necessary and that's that.
Of course, now that we have reasonably effective cookie management tools, site developers are moving onto other mechanisms that don't rely on them, like local storage/DOM storage and browser fingerprinting.
Goodness forbid you're using a mobile browser, the choices there are bleak.
I tried that, too; but I didn't bother recompiling it across an OS upgrade because it was getting to be a pain in the backside saying no to all the cookie requests. Between NoScript, Adblock Plus and Privacy Badger, I think I've got the Internet almost how I want it; especially when I had my DNS-based advert and tracker blocking solution in place.
"Deleting cookies, using ad-blocking software, or other routes past the paywall could be said to 'deactivate' or 'impair' the paywall protecting the online news article,"
That's me. I delete cookies every time I close Firefox (checkbox in current Firefox options) and trackers aren't allowed to store cookies in the first place. I run uBlock Origin to block ads and other annoyances. If I run into a hard paywall I avoid the site.
DCMA has gotten far too big for its britches.
Considering the fact that Google isn't particularly interested in making it easy for people to circumvent advertising and paywall tech, don't expect much help from them in Chrome/Chromium (and all its forks) either.
Yes, it should not be easy for websites to ascertain if someone is using incognito mode. Or any other privacy/security enhancing tactic if the user so chooses.
If you use Firefox you can use the Temporary Containers extension set to Auto. This will run each new tab in a new temporary container that gets deleted when you close the tab, including not only cookies but also on device storage, etc.
With the multi account containers extension you can also assign permanent containers to sites where you want to be permanently logged in.
Containers are an isolated browser environment preventing sites from sharing data. They also allow you to have multiple simultaneous logins to the same site in different containers/tabs.
I don't generally believe in skipping around pay walls but I do understand why some folks do. Many of the major print titles simply took their old print budget as profit rather than sharing the cost reduction of digital with the consumer, leading to some quite large subscription costs.
Much as I might malign the BBC and its telly tax, it is remarkably better value (if you ignore the insufferably left leaning slant) than most of the publications listed on that github page.
This post has been deleted by its author
Doncha love those sites (like <cough> El Reg) that display a popup with their 'cookies policy' that invites you to click to accept all their cookies but has a smaller 'learn more' link that displays options for Functional/Necessary, Performance and Advertising and only the Functional/Necessary is (permanently) ticked... it's as if they read my mind
Or sites like rockpapershotgun who won't enable some content unless you accept targeting cookies!
Quote: "To experience this #content, you will need to enable targeting cookies."
This seems to block images in some articles, and you can't use their built in search function to find articles either without accepting targeting cookies!
Is this even legal?
Standard browser features can defeat these soft paywalls so I think it can be argued that they are no barrier at all. And, who is going to sue Google, Microsoft, Apple and Mozilla for including them?
The simplest way is 'open in private tab' or if you have Firefox with Containers (invaluable for keeping work + personal accounts on the same site separate) open in a container. Alternatively deleting the cookies form a particular site is more awkward but is a feature that is in all browsers and has been with us since the first cookies were baked.
Since these paywalls rely on cookies on MY computer I would counter that they placed the cookie without my permision so who should be suing who here?
If you check the code, you'll find a lot of websites actually set the cookies, then display that warning. The cookie laws that require notification of cookie use actually just require the web site TELL the user they use cookies. Not get approval. The "Accept" or "Close" button normally just sets a cookie so that it doesn't show the banner again.
Read and understand the reason you can be fined and imprisoned for picking up a feather. If more people do perhaps the problem will be solved ... next century.
You have to love how often this hits in areas which seemed to be very simple and clear. Clearing a cookie could be illegal because it tracks your usage while that cookie over there is unlawfully tracking your usage and you are encouraged to delete it.
Reminds me of an online banking Catch-22...a certain Spanish bank suggest installing Trusteer to help defeat ungentlemanly attacks such as man in the middle (also know as 'Variations on Verified by Visa') but while you can say no, this pops up every time you log in unless you allow it to set cookies. So you have a choice of trying to be secure or to clear these annoying adverts (no, AdBlock et al do NOT block it and it needs you to say No multiple times before it will set the 'do not ask again' cookie).
Remember the DMCA was written by a group know for their venality and stupidity according to Mark Twain and Czar Reed. So the idiocies in the law should be expected both to keep the money (bribes) rolling in and the fact average Congress critter would have trouble carrying on a conversation with the vast intellect of a rock.
Dear example.com
It has come to my notice that you are storing data on my computer. Please find attached my invoice for storage costs at 1 [currency unit of choice] per byte. Payment is due in 7 days. If this invoice is not paid all such existing data will be removed as will any further data you may attempt to store.
They can't complain about the consequences they were warned about and which result from their own inaction. They should consider themselves lucky that you didn't get a winding up order on non-payment.
What would happen if, for every paywalled news article found, a quick Wikipedia stub with the bare essence of the restricted article was added?
Should do a lot more damage to the bottom line than just letting people read it who aren't going to pay in the first place, no matter the strong arm tactics tried. Whenever I see that pop up, reflex action ^W kicks in and goodbye tab (and a little memory is created of "don't bother with greedy site [X]", which gets reinforced every time this happens).
I know this doesn't work for proper written "art" type articles, but then again, you probably know paying for those in one way or another is the right thing to do? Myself, I won't pay for them if I can't get them in dead tree print form so I can share the ideas with friends / family, but others have looser standards. If the author uses non-tracking static ads (no JavaScript) and lets me save off a personal copy, then I'm also perfectly fine leaving those ads enabled in exchange for access to good quality written material. If not, well, there's an entire library of ideas (literally) that I can select from instead of the article beyond the rental-only paywall.
Threaten me with the DMCA for viewing something on my computer that you published online, however, and I hope your works die, still encrypted, in obscurity, and that your name (along with the decryption keys) is absolutely and utterly forgotten.
Strangely, if a site is greedy enough, I also remember not to sign up for their dead tree subscription version, where I might have otherwise. Odd that!
One thing which amuses me is sites which aren't paywalled but retaliate against blocking their Javascript by fuzzing the pictures that punctuate the article. Pictures that contribute nothing to understanding the article but which presumably cost the site good money from a picture library.
Why should anyone residing in the civilised world beyond USA borders give a damn about the DMCA?
Well, I've no prior experience with any custodial establishment, however I have seen a few on TV, and without exception the worst seem to be in America as opposed to say Sweden where they seem almost nice.
America regards its judicial law as having global reach, which may or may not amuse you, but its quite difficult to avoid having anything to do with either the USD or an american company - for all I know El Reg is hosted on AWS and so we're interacting within the bounds of American legal oversight.
Idealism is one word and reality is another because it is something else. I'd not fancy a decade or two in Terror Hut or San Quentin because I wanted to watch something for free. Ripping off Sweden and stuffing it through google translate if you don't speak the language is far safer :)
DMCA was, and still is, a horribly written law. Also poorly understood. For example, there is a penalty clause for companies (or whoever, but lets face it, it'll be a company) that make false DMCA claims -- they are legally attesting the content they file against IS violating their copyright, not that it MIGHT be, with penalty of perjury plus additional penalties for false claims (intentional or not.) I.e., they can automatically scan for files, but each and every time they file based on those scans without checking the content first, they are committing perjury, and it can be shown they committed perjury when they flag files that are nowhere related to the song or movie or whatever they are filing about. There are DMCA penalties for this besides the perjury. BUT, I've only ever heard of this clause being used once.
I'm with EFF on this one. I will absolutely NOT be told what kind of software I can or cannot write, or what I can discuss; this thoroughly violates people's first ammendment rights. In a more specific sense, your site sends data to a web browser, the browser can interpret it however it wants. It is NOT obligated to track cookies, it is NOT obligated to run javascript, it is NOT obligated to pop a giant "buy it" box over the text on the screen. My personal preference now, so during the prohibition, several beer and liquor companies published pamphlets or booklets "warning" people how beer is produced so they don't accidentally leave the hops and such in there to ferment and produce beer, since that's illegal.
My personal objection to these paywall sites right now, the "new tabs" thing in firefox has article links with no indication of if they are "3 free articles then you are done" sites or not, often I would not "use up" my free articles to click on some link. In one case the page failed to load properly, so I reloaded, at which point that had used up my "free" article for the month. On several sites... and per the DMCA, I'm warning you so you don't accidentally do this... you better not hit the "stop" button too quickly, on several sites the article will load but the box covering it will not if you simply hit stop early enough; whatever you don't do that because it may violate the DMCA supposedly. Thank you, I'm here all night!
Maybe, instead of using a botched-"privacy" browser like Chrome and try to write an auto-delete cookie add-on to do what you want, you could use a real browser like Firefox that gives you two different methods to accomplish your task: cookie blocking and/or NoScript (because that cookie that you think is the cause is in fact just a switch examined by the JS, and if you block the JS you disable the soft firewall completely).
Anonymous, because experience and DCMA firewalls.
There are a couple sites I read that I didn't even realize had paywalls until I saw how they rendered in someone else's browser, because I'd been reading the sites with NoScript. I wonder how the DMCA would treat it if you're not deleting anything, just never loading it in the first place?
"People have a First Amendment right to browse the Internet anonymously, ..." [Naomi Gilens, EFF Legal Fellow]
The full text of the First Amendment to the US Constitution reads
Amendment I
Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the government for a redress of grievances.
So in fact the First Amendment confers no rights whatsoever. It explicitly and solely limits the ability of Congress to legislate limitations to certain specified rights and freedoms which the framers clearly think are conferred by the Constitution itself. Now, I understand that law is interpreted for situations that the framers did not envisage, and that Thos Jefferson et al had not clearly foreseen the Internet, but, since IANAL (unlike Ms Gilens), I struggle to see how one reasons from Amdt I to the opening quote.
Edit: source for Amdt I Cornell Law School LII
Cheers! I am a big fan of Ken, and I read his post carefully, and while I am prepared to believe that I might be wrong about the First Amendment, I am not wrong in either of the ways he mentions. My point was only that a lawyer (I guess) said that the First Amendment gave people rights, and... it just doesn't. It gives them protection from laws which would take away those rights, one of which is free, and as Carlie points out, anonymously free, speech.
in re McIntyre v. Ohio Elections Commission
Thanks for that, I think it is an example of the law being extended and interpreted for changing conditions, as I said. It still doesn't get us as far as Ms Gillens' statement, though.
In a 7–2 decision authored by Justice John Paul Stevens, the Court found that the First Amendment protects the decision of an author to remain anonymous.
So clearly by this precedent an author can be anonymous, but it says nothing about readers.
My understanding of US law is that if you manufacture a gun you can't be done for murder if some uses that gun to kill someone (other laws around gun manufacture may apply). However it seems tha the DMCA would turn that on its head and say someone how provided code ( as was published above in the article) could be liablefor someone else using it to bypass a paywall. On this basis anyone that manufactures or sells a crowbar that is used to break in to a house could be done for breaking and entering.
I am afraid America appers to heading in to a world of stupidity and nonesensical law making *has been for a awhile) because most law makers don't understand technology or how to apply existing laws to it.
Frankly the more I learn about the governance layer in the US the more it seems to be destroying itself and dragging the country down with it. China and Russia have pwnd the US and its once great companies so many times it can't belong before they either up sticks and move elsewhere or just wither and die.
One good natural disatser and ....oh we have one.
My understanding is that, supposedly, intent counts when providing a tool or service. To use your example, a licensed firearm manufacturer may advertise a a shotgun, say, for hunting. If someone buys that model of shotgun and uses it to rob a bank, the manufacturer is not liable because the purpose for which the gun was used is out of bounds of the intended and advertised use. OTOH if someone offers to sell you a shotgun with a 15" barrel, a pistol grip instead of a shoulder stock and the serial number filed off, and tells you that "those stupid bank guards will never see you coming," that seller IS liable, since the whole intent of the sale is to enable an illegal use.
Its my browser and therefore any cookies installed on my device are using my paid for storage space (even if a they only take up tiny amount) so if I want to delete them I can't see how the DMCA laws would have the power to stop me. Besides the DCMA is not a law where I live, and bypassing a paywall is hardly going to be a crime large enough to get extradited to the states over no matter what Team America world police think about how their laws should apply world wide.
But claiming cookie cleaning was carried out due to privacy or security concerns doesn't guarantee immunity under the DMCA. As Troupson's article notes, the DMCA's anti-circumvention provision lacks any intent requirement.
This is false, or at best playing word games... The term in US law is "substantial noninfringing use". If you write an extension that refuses cookies, or accepts and deletes them after a short amount of time (I use "Cookie AutoDelete"), then the fact it works-around restrictions on some sites is only incidental, there are lots of other users of your extension that never use it for that purpose, and you are quite safe. You can even HINT that is makes certain sites more usable/private/etc, as long as you're not dumb enough to come out and admit you're trying to break digital access controls.
The same intent issue is true for many other areas of criminal law... You can carry a sword around legally, as long as you have an excuse that has not the faintest whiff of even potentially using it against someone. Meanwhile, any mundane object, like a pencil, can be illegal if you're dumb enough to admit you're carrying it because you think you might possibly have a need to stab someone... (self defense or not does not matter).
"You can carry a sword around legally"
No, the girls with swords are warrior nuns.
For the rest of us, I rather suspect any sword carrying that isn't directly within the sphere of some sort of reenactment would lead to a world of pain. This is a world where people carrying swords (and other large sharp pointy objects) tend to want to do grisly things. I think most people would not consider it acceptable to carry a sword, and the fuzz would likely treat you as hostile from the outset, because, well, it ought to be bloody obvious...
Clear your cookies when you exit or use private browsing. This works okay for the Washington Post although they still make you click through a cookie acceptance popup for European visitors.
A few more tips
1) Some websites that truncate articles are still readable if you hit esc in the time between them loading and their paywall / article truncator Javascript kicks in
2) Others don't truncate at all if you use Firefox's reader (F9) mode
3) Tunnelbear and other VPNs circumvent those blocks that some US news websites put on European visitors. If you ever wondered why they do this then it's because they must exploit the ever loving f out of US visitors with hundreds of scrapers, trackers etc. and have chosen to block Europeans rather than fix this.
If you ever wondered why they do this then it's because they must exploit the ever loving f out of US visitors with hundreds of scrapers, trackers etc. and have chosen to block Europeans rather than fix this.This is technically illegal, but unenforcible as long as the perpetrator and victim disagree over jurisdiction.
It's still not a good look to be doing things to your audience that are illegal in some countries of the world, though .....
"Others don't truncate at all if you use Firefox's reader (F9) mode"
This. It's great that it " simplifies the page to the point where it throws away all that rubbish and just shows the article.
"those blocks that some US news websites put on European visitors"
For a quick fix, go to hide.me and choose a US proxy.
"and have chosen to block Europeans rather than fix this"
And yet, don't we suppose those same news outlets would scream bloody murder if websites in other places actively blocked Americans?
I also have my browser (Vivaldi) delete all cookies when closed down. The one downside was that Google Maps would keep bugging me for consent to store cookies.
So I wrote a one-line Tampermonkey script to re-create the consent cookie, which, to my surprise, is plain text, not encrypted or obfuscated in any way. (Until they read this.)
I might add some code to mess with their "NID" cookie, which is a long hex string acting as a browser identifier.
.... it is my favorite of all the places I have lived, and has the legal system I'd least like to cross (except perhaps DPRK or Russia). I've never given much consideration to foreign law while I've worked, only to the laws of the nation I was working in and perhaps to UK law as my home nation. This article has opened my eyes to some of the challenges of writing software for an international market.
I wonder how that scales. If I buy a toy or gadget certified for Australia and I later bring it to Europe and sell it second hand online, which laws apply? I presume I would be breaking some law, and in the event of a 3rd party injury potentially face some liability?
"sell it second hand"
Doesn't caveat emptor generally cover sales of second hand goods?
"some of the challenges of writing software for an international market"
The attitude that I take is that I'm based here so the laws of this country/EU apply. If this is invalid in their country, then their use of the software is conditional upon them accepting all liability and responsibility for their use or misuse of the software.
Well, if the American giants think they can only be taken to court in California, allow me the right to demand that I'm only taken to court in a place in rural France that probably nobody has ever heard of...
"clicking on Mail or Express links"
Sometimes the Daily Fail can be amusing comic relief. Try reading a... uh, what's his name... Littleton? Littlejohn? The ranty opinionated columnist that's like a second rate Piers Morgan clone. Anyway, try reading one of his rants in an over dramatic way, as if it's utterly a matter of life and death. I don't get far before cracking up.
See here for an example of what I mean https://www.youtube.com/watch?v=MBHOL1PcPR8 (don't worry, it isn't DM, it's a dramatic reading of a mad breakup letter)
I personally don't run ad blockers. While I don't particularly like advertising, I help run a small forum that likely wouldn't be viable to run if it didn't carry adverts, which are there purely to cover hosting costs. So, I am perfectly aware that sites have costs that need to be covered. That actually applies whatever the size of the site.
Where I do have a problem is the tracking advertisers want. They say they need it to ensure we get relevant adverts, and to reduce their costs. But the advertising industry survived (indeed prospered) for decades without that level of tracking.
Whenever a paywall pop-up appears, that website gets closed. I don't need their information. I only clicked on a link someone else provided out of interest. If others absolutely have to have that access, then they can pay for it. I can't be bothered to run scripts or add-ons or extensions to get around these sad attempts to market their "product" to me. There are plenty of news sites out there that get by with advertising so why would I pay? Now if they delivered VALUE FOR MONEY then I would consider paying for it, but so far I have not seen one single news site that operates a paywall that I consider value for money. Others obviously do get value for money (or else they just have so much money that the cost is irrelevant to them) and good for them. As for those ultra-irritating Cookie notification messages, if they are mandated by the EU do we get to no longer see those after the 1st Jan? Did I just find the first actual benefit for all of us from Brexit? <rotlmao>
I've often wondered if the right to be forgotten is compatible with a lot of commercial strategies. For instance - 20% of your first shop? Sign up, get 20% off, demand to be forgotten, rinse and repeat ... Or is there some GDPR getout where you can keep a name and address to ensure someone does not repeatedly present themselves as a new customer?
Hmm, ever try to do something with a browser and it shits the bed? One of the first things you are asked "Can you empty the browser cache and try again?" That is one of the first questions more than one of our SW vendors asks.
Isn't advising someone to do something illegal, also illegal??
Let the owner show a little baker's house,bottom left corner, where I can buy cookies 10 for a dime. CCard/ Debit card accepted.
When I buy a dozen, I can can then peruse any article. If a whole paper cost a dollar, the each individual item is pennies, or even groups of items for one penny. I could then spend as I see fit!
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
