WEBVTT Kind: captions Language: en 1 00:00:00.080 --> 00:00:02.720 When Tim Berners-Lee pr… 2 00:00:05.320 --> 00:00:06.920 When Tim Berners-Lee prop… 3 00:00:08.600 --> 00:00:10.800 When T… 4 00:00:15.520 --> 00:00:16.320 When Tim Bern… 5 00:00:16.320 --> 00:00:17.280 oh come on! 6 00:00:20.480 --> 00:00:24.800 When Tim Berners-Lee proposed the idea  for the World Wide Web back in 1989,   7 00:00:24.800 --> 00:00:29.600 he wrote about a “universal linked  information system”. His exact words:   8 00:00:29.600 --> 00:00:32.640 “a place to be found for any  information or reference which   9 00:00:32.640 --> 00:00:36.000 one felt was important, and a  way of finding it afterwards”. 10 00:00:37.120 --> 00:00:43.120 Three decades later, and you’ve possibly  noticed that the web is a bit of a mess. 11 00:00:43.120 --> 00:00:46.880 What happened to that  universal information system?   12 00:00:46.880 --> 00:00:49.760 What even is a cookie, and  why do we need to accept them? 13 00:00:50.640 --> 00:00:53.760 There are two reasons that  the web is terrible right now: 14 00:00:53.760 --> 00:00:57.840 first, advertisers. And second, people. 15 00:00:58.640 --> 00:01:01.200 ...I actually just realised that I just implied that 16 00:01:01.200 --> 00:01:03.040 advertisers are not people,   17 00:01:03.040 --> 00:01:05.360 and there’s some really interesting stuff about corporate personhood 18 00:01:05.360 --> 00:01:07.840 and, employees acting as a hive-mind there, and-- 19 00:01:07.840 --> 00:01:10.800 Anyway! Let’s talk  about the advertisers. 20 00:01:10.800 --> 00:01:14.880 The first versions of the web  were simple. Text and images   21 00:01:14.880 --> 00:01:19.440 and links to other text and images.  You could use forms to send information,   22 00:01:19.440 --> 00:01:23.464 but the whole thing was ‘stateless’. This means neither the web browser 23 00:01:23.464 --> 00:01:26.324 nor the web server kept track of you from one page to the next: 24 00:01:26.324 --> 00:01:29.781 you just sent a request for a document, you got the document back, 25 00:01:29.781 --> 00:01:32.567 and that was it. If you submitted a form, 26 00:01:32.567 --> 00:01:35.653 that one response could be  tailored, but after that, nope, 27 00:01:35.653 --> 00:01:38.636 the server’s forgotten about you because it can’t tell you apart 28 00:01:38.636 --> 00:01:42.081 from anyone else who’s using the same network. 29 00:01:42.081 --> 00:01:45.120 Now this wasn't, long-term, a great plan. 30 00:01:45.120 --> 00:01:47.760 In theory you could hack together  something more complicated,   31 00:01:47.760 --> 00:01:52.204 send forms back and forth, and people  did build things like that, 32 00:01:52.204 --> 00:01:54.451 but they’d break very, very easily. 33 00:01:54.451 --> 00:01:58.691 It was impossible to have something  both reliable and personalised. 34 00:01:58.720 --> 00:02:02.240 Then in 1994, a programmer called  Lou Montulli, who was building a   35 00:02:02.240 --> 00:02:06.480 web browser at a company called  Netscape, came up with “cookies”,   36 00:02:06.480 --> 00:02:10.400 adapting an old computer science  technique called “magic cookies”.   37 00:02:10.400 --> 00:02:14.640 They were so useful that every other  browser started to use them as well,   38 00:02:14.640 --> 00:02:17.120 and they got built  into the web standards. 39 00:02:18.160 --> 00:02:22.800 A cookie is “client-side storage”:  your web browser sends the request to   40 00:02:22.800 --> 00:02:25.830 the server, as usual, but the server sends back  two things: 41 00:02:25.830 --> 00:02:27.555 the page you asked for, 42 00:02:27.555 --> 00:02:32.158 and a little text file called a cookie  that your browser then saves. 43 00:02:32.158 --> 00:02:36.640 After it’s saved, every time that browser  makes a request to that same server,   44 00:02:36.640 --> 00:02:41.120 it sends the cookie along with it.  So that cookie could contain your   45 00:02:41.120 --> 00:02:45.301 preferences: if you choose “dark mode”,  then the browser would now send a 46 00:02:45.301 --> 00:02:49.197 “dark mode” preference, in that cookie, every single request. 47 00:02:49.197 --> 00:02:51.767 If the server asked for it, then that cookie would last 48 00:02:51.767 --> 00:02:54.800 even if you closed the browser, and restarted your computer. 49 00:02:54.800 --> 00:02:57.756 For years and years and years. 50 00:02:57.756 --> 00:03:00.720 Or a cookie could be used for  authentication: so after you’ve   51 00:03:00.720 --> 00:03:03.670 logged into a site, that site gives your  browser a cookie 52 00:03:03.670 --> 00:03:06.405 that’s just a long, random string of characters. 53 00:03:06.405 --> 00:03:11.714 But because no-one except the server and that cookie have that long string of characters, 54 00:03:11.714 --> 00:03:16.640 it can act like a password: the browser sends it back along with every page request,   55 00:03:16.640 --> 00:03:20.320 and the server looks at it and  goes “oh, yeah, I remember you”. 56 00:03:21.760 --> 00:03:26.480 The designers of cookies looked at that, and they knew that they could be used   57 00:03:26.480 --> 00:03:30.160 to track people, so there was a  very, very important rule for privacy:   58 00:03:30.160 --> 00:03:36.560 from the very start, only the site that set the  cookie can read the cookie back. 59 00:03:36.560 --> 00:03:40.160 Except. Because of the way the web  is built, sites can include material   60 00:03:40.160 --> 00:03:43.760 from other servers. A web page can  pull in an image from somewhere else,   61 00:03:43.760 --> 00:03:47.440 or some scripting code, or even an  entire other web site, included in a frame. 62 00:03:47.440 --> 00:03:52.720 And those other servers could  all set and read their own cookies.   63 00:03:52.720 --> 00:03:55.200 “Third-party cookies”, they were called. 64 00:03:55.200 --> 00:04:01.360 So when web pages included advertising,  well, those adverts came from the advertising   65 00:04:01.360 --> 00:04:05.680 company’s servers, so those advertisers  could set a cookie that tracked people   66 00:04:05.680 --> 00:04:10.080 across the entire web. If the same  ad company partnered with loads   67 00:04:10.080 --> 00:04:15.440 of different web sites, they could start  building up some very detailed profiles. 68 00:04:15.440 --> 00:04:20.160 No, they might not know who you  are at first. But they knew you visited   69 00:04:20.160 --> 00:04:23.840 that web site about your hometown, then you visited that web site about your college,   70 00:04:23.840 --> 00:04:28.494 and then you visited that web site about a very specific  medical condition. 71 00:04:28.494 --> 00:04:30.915 Oh, and then you bought something from an online shop, 72 00:04:30.915 --> 00:04:32.960 so they can work behind-the-scenes 73 00:04:32.960 --> 00:04:35.381 combine the details from that shop and their cookies, 74 00:04:35.381 --> 00:04:38.800 and add your name and address to the profile. 75 00:04:38.800 --> 00:04:42.000 All those fancy “share with Facebook” buttons? Well, yeah, loads of them   76 00:04:42.000 --> 00:04:44.495 could report back to Facebook where you were going. 77 00:04:44.495 --> 00:04:49.088 "Hey, this person's looking at all these sites! So now you can tailor adverts for them!" 78 00:04:49.088 --> 00:04:53.353 Which is why you could be on a site that seems to be completely disconnected from Facebook, 79 00:04:53.353 --> 00:04:58.880 and still see adverts that were uncannily linked to  things you’ve been thinking about. 80 00:04:59.920 --> 00:05:03.760 It took a long while before  regulators decided that,   81 00:05:03.760 --> 00:05:07.920 maybe, advertising companies having  enormous databases on basically   82 00:05:07.920 --> 00:05:12.400 everything that people were thinking  might be a bit of a privacy problem. 83 00:05:12.400 --> 00:05:15.440 The European Union acted  first. The “Cookie Law”,   84 00:05:15.440 --> 00:05:20.103 which was the euphemistic name for, um, this mess... 85 00:05:20.103 --> 00:05:23.360 meant that all the EU member  countries had to put a law in place   86 00:05:23.360 --> 00:05:26.735 requiring consent to place cookies. 87 00:05:26.735 --> 00:05:28.808 That wasn’t particularly well-thought-out, 88 00:05:28.808 --> 00:05:31.689 because “consent” requires clicking OK, 89 00:05:31.689 --> 00:05:34.770 and if there’s a confusing box in between the average person 90 00:05:34.770 --> 00:05:37.151 and the article they want to read, 91 00:05:37.151 --> 00:05:40.000 look, nearly everyone is just going to just click OK. 92 00:05:40.000 --> 00:05:43.120 And by this point, browser makers  were starting to give users options   93 00:05:43.120 --> 00:05:47.120 to block third-party cookies anyway, so advertisers were adjusting,   94 00:05:47.120 --> 00:05:50.450 they were tracking people not through cookies, but  through “fingerprinting”: 95 00:05:50.450 --> 00:05:54.784 looking at all the apparently-innocent individual quirks 96 00:05:54.784 --> 00:05:58.815 of how that exact computer was set up and how it rendered a web page. 97 00:05:58.815 --> 00:06:03.005 The fonts you had installed, the size of your monitor,  the web sites you've visited in the past, 98 00:06:03.005 --> 00:06:07.249 all things that individually appear  innocent and safe but which together 99 00:06:07.249 --> 00:06:10.111 uniquely identify each person. 100 00:06:10.111 --> 00:06:14.670 Browser makers and advertisers ended up in an odd war with each other about privacy: 101 00:06:14.670 --> 00:06:18.675 occasionally a civil war, given that one of the  most popular browsers 102 00:06:18.675 --> 00:06:23.040 and also one of the major advertising companies 103 00:06:23.040 --> 00:06:26.560 were under the same corporate umbrella. 104 00:06:26.560 --> 00:06:30.080 So later, the General Data  Protection Regulation, GDPR,   105 00:06:30.080 --> 00:06:33.067 put even stronger requirements in  place, at least for EU citizens. 106 00:06:33.067 --> 00:06:37.840 Not just “no cookies without consent”: no  tracking without consent. At all times,   107 00:06:37.840 --> 00:06:40.749 the user must have full knowledge  what they are signing up for, 108 00:06:40.749 --> 00:06:44.151 and must consent to it. Even if the company’s not in the EU. 109 00:06:44.151 --> 00:06:47.770 Even if they’re storing data on EU citizens "outside", 110 00:06:47.770 --> 00:06:48.891 it still applies to them. 111 00:06:48.891 --> 00:06:53.049 The potential maximum fine is 4% of the company’s global annual revenue. 112 00:06:53.049 --> 00:06:54.565 Not profit, revenue. 113 00:06:54.565 --> 00:06:58.016 Or €20 million, whichever is higher. 114 00:06:58.016 --> 00:07:02.023 And yeah, sure, maybe the EU couldn’t easily fine an all-American company, 115 00:07:02.023 --> 00:07:06.240 but they can definitely stop them doing business in Europe if they don't pay. 116 00:07:06.240 --> 00:07:08.753 So all the advertisers had two options. 117 00:07:08.753 --> 00:07:11.477 Number one: stop tracking people! 118 00:07:11.477 --> 00:07:15.738 Or number two, add a big box on each page saying “hey, is it OK if we track you?” 119 00:07:15.738 --> 00:07:18.365 And legally, you should  be able to easily say no 120 00:07:18.365 --> 00:07:22.329 and still access the site. Opting out should  be a simple, one-click process.   121 00:07:22.329 --> 00:07:26.601 And anyone who’s been on the web  lately knows that’s often not true. 122 00:07:26.601 --> 00:07:31.320 So, yes, at least some of those popups and frustrations are because of advertisers. 123 00:07:31.320 --> 00:07:34.800 Certainly, they normalised  the idea of intrusive popup boxes. 124 00:07:35.840 --> 00:07:38.720 But why can they put those  boxes there in the first place? 125 00:07:39.600 --> 00:07:43.200 The web is built around freedom  of design. It’s one of the most   126 00:07:43.200 --> 00:07:48.000 fundamental principles: within the  box that the web browser gives you,   127 00:07:48.000 --> 00:07:51.120 a designer can put almost anything.   128 00:07:51.120 --> 00:07:53.335 For decade after decade after decade, 129 00:07:53.335 --> 00:07:56.326 programmers have pushed the limits of what’s possible: 130 00:07:56.326 --> 00:08:01.203 someone has even managed to emulate an entire Windows 95 computer in the web browser. 131 00:08:01.203 --> 00:08:04.570 I don’t mean just making a web page look like Windows 95, 132 00:08:04.570 --> 00:08:09.701 I mean an entire virtual machine that thinks it’s running on regular computer hardware 133 00:08:09.701 --> 00:08:13.920 but is actually just simulated in code, in a web browser. 134 00:08:13.920 --> 00:08:15.360 And that's incredible! 135 00:08:15.360 --> 00:08:18.785 Give people power to create and  some will make amazing things. 136 00:08:18.785 --> 00:08:22.573 But some will look at the ability  to run almost any code 137 00:08:22.573 --> 00:08:26.256 and put almost anything on screen, at least within that box, and go 138 00:08:26.256 --> 00:08:29.823 “maybe I can get some more newsletter signups if I interrupt the reader”. 139 00:08:29.823 --> 00:08:33.943 Or "maybe I can make people’s browsers mine cryptocurrency in the background 140 00:08:33.943 --> 00:08:35.360 "while they’re on my site!" 141 00:08:36.560 --> 00:08:39.219 So the war starts again. 142 00:08:39.219 --> 00:08:42.924 Most web browsers now have a separate view that you can switch into, 143 00:08:42.924 --> 00:08:44.760 that shows just  the text you want. 144 00:08:44.760 --> 00:08:47.350 It might be called “article view” or “reader mode”. 145 00:08:47.350 --> 00:08:51.828 The browser tries to figure out what the main content is, what the user actually wants to see, 146 00:08:51.828 --> 00:08:53.871 and puts just that text on screen. 147 00:08:53.871 --> 00:08:57.200 Stripping out the adverts,  removing all the popup boxes, and, 148 00:08:57.200 --> 00:09:00.560 yes, losing all the creativity  and design that the web allows.   149 00:09:00.560 --> 00:09:05.520 But that ‘reader view’ is a lot closer  to Tim Berners-Lee’s original design:   150 00:09:05.520 --> 00:09:08.560 a place for information, and  a way to find it afterwards. 151 00:09:09.440 --> 00:09:13.120 Of course, there are already techniques  to detect and defeat reader view,   152 00:09:13.120 --> 00:09:17.680 and make sure that the user has to see the  adverts, or the newsletter popups, or   153 00:09:17.680 --> 00:09:18.560 whatever else. 154 00:09:19.280 --> 00:09:23.760 Every bit of freedom that a  designer has for creativity and good   155 00:09:23.760 --> 00:09:27.360 is also freedom for abuse.  That’s true not just on the web,   156 00:09:27.360 --> 00:09:30.240 but in every single aspect  of the online world.