[Bricker]

To clarify, the website had encoded SSN's not encrypted them, but the person who found this were called a "hacker" for disclosing.

The web page was taken down, hopefully before malicious users of the site could exploit this weakness.

Makes me wonder then if it's considered 'hacking' when people discover improperly redacted documents (making text backgound black) by just copying and pasting the text into notepad. Wouldn't be surprised if it is. 

Back on topic: While I kinda get the point these regulators are trying to make, I feel like they aren't really getting the picture and understanding the real problem. Cookies being used to fingerprint, track and identify users habits across multiple sites for marketing and advertising is the problem. Not the little convenience cookies like staying logged in, etc. If users were really against cookies and not herd mentality, they could just straight up disable cookies. The government agencies could have just spent time telling people how to do that instead of mandating every single site give users a prompt to disable some cookies.

I always thought putting the onus on end users to accept or reject cookies per site was absurd in the first place. Great idea on paper, but as we all know from every single site we visit what its really like.

I feel like this path will just lead to users having to decline cookies every time they visit a page because the sites can't even remember if the user declined cookies.