6 ms·

I am surprised how complicated it is, they even use machine learning. It will look like a bug to developers when the third-party cookies will suddenly stop work

I am surprised how complicated it is, they even use machine learning. It will look like a bug to developers when the third-party cookies will suddenly stop working without obvious reason. Why don't just block third party cookies except where it is enable by the user? I think 100% of the sites I visit use third-party cookies only for tracking. And of course this is not enough. Using a combination of an IP address and browser fingerprint allows tracking a user without any cookies. And websites can still track users if they use a redirect through an analytics website (when a user visits a site for the first time he is redirected to an analytics domain, that redirects the user back adding an identifier to URL).

eddieh 9y ago
Third-party cookies are blocked by default unless enabled by the user. This has always been the case with Safari. Always! It is the second sentence of the second paragraph of the article. > From the very beginning, we’ve defaulted to blocking third-party cookies
codedokode 9y ago
Actually I am against machine learning. It only makes the debugging more difficult. There should be simple rules and not some classifier one cannot understand without a math degree.
- lawrenceyan 9y ago
  You make it sound like machine learning is some kind of black box. Machine learning is a huge field and there are many analytical methods within it that can offer direct understandable insights into a process.
  - SilasX 9y ago
    Rescinding downvote to give an explanation. Yes, ML isn't magic, but that's irrelevant to the parent's point: the issue is that websites a stable "browser API" to work against so they can know what the user will send back where and when. If the user is selectively setting cookies based on the results of machine-learning some non-obvious then it becomes that much harder to debug "why didn't this part of the site remember who they were?"
    - lawrenceyan 9y ago
      But that's what I mean. Machine learning as a field is enormous. There are wide variety of implementations that can be 100% derived with every step of logic being open for people to analyze. It would be no different than building any other form of conditional system.
      - SilasX 9y ago
        That's still missing the point: from the fact that your model derivation is intelligible, it doesn't follow that websites will know that you're using the model, or will be able to product consistent, desirable behavior for both you and everyone else using some different behavior. Sites will break without warning for users until some engineer discovers that some ML model told the browser to only set cookies for a particular set of sites determined by IP, domain, "trustworthiness", and a few other factors engineers don't want to think about when designing the app. If you're saying that you can publish the model openly with the expectation that sites will know you're using it, that's fine, and that's a valid approach, but that has nothing to do with ML per se, and is just another attempt at rearchitecting the browser/server interface with all of its associated issues, and continues the same arms race between sites that want to de-anonymize you. In short: there's a tradeoff between "hiding information about yourself" and "providing a stable set of expectations for web sites to build off of"; ML can favor one of those objectives but not eliminate the tradeoff and somehow get the best of both worlds. The only way to get the best of both worlds is to rearchitect the API by which browser clients talk to webservers so that it's easy to separate out what you do want/need to tell the server vs what you don't.
        lawrenceyan 9y ago
        That's definitely a valid consideration. I was more focusing on refuting OP's statement in implying machine learning is a black box because only a select few people are able to understand it due its complexity. I think I should have made that more clear in my original comment in order to avoid any confusion.
dullgiulio 9y ago
That's right, browsers should ask permission for a site to set cookies. Which also means there should be a prior user action for a site to even offer cookies. For example, opening a site and receiving cookies with it: doesn't work any longer. Receiving cookies after submitting a POST request: keeps working.
- tokenizerrr 9y ago
  Congratulations, you just broke nearly every website out there. This would trigger bot detection all over the place. This also means that on load the first thing that will happen is an AJAX POST in the background, or the moment you press the mouse on anything on the page in case that gets further restricted.
  - mobilethrow 9y ago
    What? I browse without cookies (even first-party), and apart from the WE USE COOKIES banner that ironically can't be acknowledged most sites work just fine. Obviously shopping sites and similar get whitelisted.
    - tokenizerrr 9y ago
      If you don't interact with sites (POSTing, like the parent comment is talking about) you obviously won't notice the breakage. Since you whitelist the sites you interact with (shopping sites and similar) you are already sidestepping the problem.
      - mobilethrow 9y ago
        POST requests work perfectly fine without cookies. Edit: I just saw your comment in the sibling thread. Guess I won't be interacting with your sites any time soon. (brb updating my bots and scrapers to use cookies)
        tokenizerrr 9y ago
EvilTerran 9y ago
> I think 100% of the sites I visit use third-party cookies only for tracking. You probably use sites that rely on 3rd-party cookies for single sign-on, too. Stack Overflow, for instance: https://nickcraver.com/blog/2017/05/22/https-on-stack-overflow/#global-login https://nickcraver.com/blog/2017/05/22/https-on-stack-overfl...
- cptskippy 9y ago
  We've had to jump through numerous hoops to get SSO functioning across our sites on Safari due to their policy of rejecting third-party cookies. When you control the full stack on all of your sites it's less of an issue but when you're using multiple vendors SAAS solutions with custom authentication it can be a huge pain.
dsr_ 9y ago
"Self-Destructing Cookies" is an extension for Firefox that automatically deletes cookies 30 seconds after you close the last tab associated with a site, unless you put it on a whitelist. It is the most sensible and useful policy I have ever seen. Sadly, it can't be done as an extension in the new Firefox model.
- themagicteeth 9y ago
  Yes it can see here: https://addons.mozilla.org/en-US/firefox/addon/cookie-autodelete https://addons.mozilla.org/en-US/firefox/addon/cookie-autode... The only thing it can't do yet is delete local storage due to the API not being implemented.
- squarefoot 9y ago
  you may want to take a look at Palemoon. https://www.palemoon.org/ https://www.palemoon.org/ https://addons.palemoon.org/addon/crush-those-cookies/ https://addons.palemoon.org/addon/crush-those-cookies/ https://addons.palemoon.org/incompatible/ https://addons.palemoon.org/incompatible/
  - bigbugbag 9y ago
    Pale Moon is lacking security wise, maybe waterfox is a more suitable alternative. Also Waterfox author plans to fund a startup to fork the firefox to support XUL and go from there: https://www.ghacks.net/2017/03/13/waterfox-dev-has-big-plans-for-the-browser/ https://www.ghacks.net/2017/03/13/waterfox-dev-has-big-plans...
    - squarefoot 9y ago
      Thanks for the info, I never heard about that project before.
- arviceblot 9y ago
  https://addons.mozilla.org/en-US/firefox/addon/cookie-autodelete/ https://addons.mozilla.org/en-US/firefox/addon/cookie-autode... is compatible with the new add-on model.
will4274 9y ago
If you login to apps with Facebook, Google, or Microsoft, you use third party cookies for something besides tracking.
- andy_ppp 9y ago
  How is that true, Oauth2 doesn't set any cookies, it uses query strings, https and redirects. Maybe you are thinking about displaying the logged in state for things like Like Buttons or other social widgets that you'd be signed into such as Disqus or Facebook comments?
  - codedokode 9y ago
    Facebook widgets are used for tracking user across the web too. So one cannot protect user from being tracked without breaking those widgets.
  - will4274 9y ago
    Logout. The standard mechanism for OAuth logout is to iframe the relying parties (RPs aka apps) which is a third party cookie context. Redirecting to each RP is substantially slower because logout is serialized rather than parallelized and requires well behaved RPs as any badly behaved RP breaks logout for the rest of the RPs. (This is why some browsers have a setting like "third party cookies after visited in a first party context" - first party for login, third party for logout. But advertisers screwed this up by asking sites to do full frame redirects through them. )
    - andy_ppp 9y ago
      >>> The standard mechanism for OAuth logout is to iframe the relying parties No it isn't. OAuth2 doesn't specify cookies in the entire spec and definitely doesn't require third party cookies, especially for logout. Here's the RFC: https://tools.ietf.org/html/rfc6749 https://tools.ietf.org/html/rfc6749
      - will4274 9y ago
deleted 9y ago
[deleted]
Sukotto 9y ago
Ad networks can track you without cookies. Cookies are just an easy first step. Any time any user hits any page with your javascript[1] in it: record ip address, referer (sic), locale preferences, available fonts, what's in their cache, what extensions they have, and anything else you can get. You can even track if they have certain 3rd party sites blocked. Then it is a matter of bayesian guessing about who they are. Given that a typical person spends most of their time in only a few specific places (home, commute, work, favorite coffee shop/pub, etc) you can make very good guesses about which person is visiting your page after only a few visits... even if they have cookies disabled. [1]And if they have js disabled they can't really use your site because js is basically required now. And you can still track that information and advertise to that cohort. How many people hitting the site from these 5 ip addresses, who use chromium, and have no cookies, and have js turned off? One? Well, then they just identified that person
- om2 9y ago
  We studied the behavior of many trackers in detail. We believe many track you solely with client-side state (including cookies, indexeddb, LocalStorage, The http cache, etc). It's true that some others use fingerprinting like you describe, and it's something we will think about in the future. But stateful tracking is still the most reliable mechanism, and for many trackers it's the sole mechanism.
- bigbugbag 9y ago
  Don't we have a few extensions mimicking the most common settings to defeat such fingerprinting ?
om2 9y ago
The challenge lies in trying not to break any user-facing website functionality. Things like single sign-on, login with Google/FB, Share and Tweet This buttons, CDNs for static content, etc. We also had a goal of not blocking ads. These limitations require a more complex feature, but it can be on by default without upsetting users or publishers.
- bradgessler 9y ago
  I can't upvote the complexity concerns in here enough. In effect you've banned 3rd party cookies, or at least that's the assumption that a lot of us will have to make to support Safari users because the state of their browser is harder to determine.
  - om2 9y ago
    You should definitely code websites as if you don't have third-party cookies. It's always been our intent to ban them, and we're closing the loopholes as much as we can without breaking the web.
    - bradgessler 9y ago
      Yeah, we had to assume that because of the way iframes work in Safari. Its obviously great for privacy, but very frustrating from an application developer perspective. Too bad the interwebs are becoming more hostile and require these measures. IMO the Webkit team would make developers' lives much easier if you more clearly articulated that intent; otherwise they have to guess the direction your team is heading and might build something in the short term that ends up breaking.
  - bigbugbag 9y ago
    People aware of third party cookies usually disable them anyways, so don't assume third party cookies support is a given.
bigbugbag 9y ago
How do you implement browser fingerprinting ?

eddieh 9y ago

Third-party cookies are blocked by default unless enabled by the user. This has always been the case with Safari. Always! It is the second sentence of the second paragraph of the article. > From the very beginning, we’ve defaulted to blocking third-party cookies

codedokode 9y ago

Actually I am against machine learning. It only makes the debugging more difficult. There should be simple rules and not some classifier one cannot understand without a math degree.

lawrenceyan 9y ago
You make it sound like machine learning is some kind of black box. Machine learning is a huge field and there are many analytical methods within it that can offer direct understandable insights into a process.
- SilasX 9y ago
  Rescinding downvote to give an explanation. Yes, ML isn't magic, but that's irrelevant to the parent's point: the issue is that websites a stable "browser API" to work against so they can know what the user will send back where and when. If the user is selectively setting cookies based on the results of machine-learning some non-obvious then it becomes that much harder to debug "why didn't this part of the site remember who they were?"
  - lawrenceyan 9y ago
    But that's what I mean. Machine learning as a field is enormous. There are wide variety of implementations that can be 100% derived with every step of logic being open for people to analyze. It would be no different than building any other form of conditional system.
    - SilasX 9y ago
      That's still missing the point: from the fact that your model derivation is intelligible, it doesn't follow that websites will know that you're using the model, or will be able to product consistent, desirable behavior for both you and everyone else using some different behavior. Sites will break without warning for users until some engineer discovers that some ML model told the browser to only set cookies for a particular set of sites determined by IP, domain, "trustworthiness", and a few other factors engineers don't want to think about when designing the app. If you're saying that you can publish the model openly with the expectation that sites will know you're using it, that's fine, and that's a valid approach, but that has nothing to do with ML per se, and is just another attempt at rearchitecting the browser/server interface with all of its associated issues, and continues the same arms race between sites that want to de-anonymize you. In short: there's a tradeoff between "hiding information about yourself" and "providing a stable set of expectations for web sites to build off of"; ML can favor one of those objectives but not eliminate the tradeoff and somehow get the best of both worlds. The only way to get the best of both worlds is to rearchitect the API by which browser clients talk to webservers so that it's easy to separate out what you do want/need to tell the server vs what you don't.
      - lawrenceyan 9y ago
        That's definitely a valid consideration. I was more focusing on refuting OP's statement in implying machine learning is a black box because only a select few people are able to understand it due its complexity. I think I should have made that more clear in my original comment in order to avoid any confusion.

dullgiulio 9y ago

That's right, browsers should ask permission for a site to set cookies. Which also means there should be a prior user action for a site to even offer cookies. For example, opening a site and receiving cookies with it: doesn't work any longer. Receiving cookies after submitting a POST request: keeps working.

tokenizerrr 9y ago
Congratulations, you just broke nearly every website out there. This would trigger bot detection all over the place. This also means that on load the first thing that will happen is an AJAX POST in the background, or the moment you press the mouse on anything on the page in case that gets further restricted.
- mobilethrow 9y ago
  What? I browse without cookies (even first-party), and apart from the WE USE COOKIES banner that ironically can't be acknowledged most sites work just fine. Obviously shopping sites and similar get whitelisted.
  - tokenizerrr 9y ago
    If you don't interact with sites (POSTing, like the parent comment is talking about) you obviously won't notice the breakage. Since you whitelist the sites you interact with (shopping sites and similar) you are already sidestepping the problem.
    - mobilethrow 9y ago
      POST requests work perfectly fine without cookies. Edit: I just saw your comment in the sibling thread. Guess I won't be interacting with your sites any time soon. (brb updating my bots and scrapers to use cookies)
      - tokenizerrr 9y ago

EvilTerran 9y ago

> I think 100% of the sites I visit use third-party cookies only for tracking. You probably use sites that rely on 3rd-party cookies for single sign-on, too. Stack Overflow, for instance: https://nickcraver.com/blog/2017/05/22/https-on-stack-overflow/#global-login https://nickcraver.com/blog/2017/05/22/https-on-stack-overfl...

cptskippy 9y ago
We've had to jump through numerous hoops to get SSO functioning across our sites on Safari due to their policy of rejecting third-party cookies. When you control the full stack on all of your sites it's less of an issue but when you're using multiple vendors SAAS solutions with custom authentication it can be a huge pain.

dsr_ 9y ago

"Self-Destructing Cookies" is an extension for Firefox that automatically deletes cookies 30 seconds after you close the last tab associated with a site, unless you put it on a whitelist. It is the most sensible and useful policy I have ever seen. Sadly, it can't be done as an extension in the new Firefox model.

themagicteeth 9y ago
Yes it can see here: https://addons.mozilla.org/en-US/firefox/addon/cookie-autodelete https://addons.mozilla.org/en-US/firefox/addon/cookie-autode... The only thing it can't do yet is delete local storage due to the API not being implemented.
squarefoot 9y ago
you may want to take a look at Palemoon. https://www.palemoon.org/ https://www.palemoon.org/ https://addons.palemoon.org/addon/crush-those-cookies/ https://addons.palemoon.org/addon/crush-those-cookies/ https://addons.palemoon.org/incompatible/ https://addons.palemoon.org/incompatible/
- bigbugbag 9y ago
  Pale Moon is lacking security wise, maybe waterfox is a more suitable alternative. Also Waterfox author plans to fund a startup to fork the firefox to support XUL and go from there: https://www.ghacks.net/2017/03/13/waterfox-dev-has-big-plans-for-the-browser/ https://www.ghacks.net/2017/03/13/waterfox-dev-has-big-plans...
  - squarefoot 9y ago
    Thanks for the info, I never heard about that project before.
arviceblot 9y ago
https://addons.mozilla.org/en-US/firefox/addon/cookie-autodelete/ https://addons.mozilla.org/en-US/firefox/addon/cookie-autode... is compatible with the new add-on model.

will4274 9y ago

If you login to apps with Facebook, Google, or Microsoft, you use third party cookies for something besides tracking.

andy_ppp 9y ago
How is that true, Oauth2 doesn't set any cookies, it uses query strings, https and redirects. Maybe you are thinking about displaying the logged in state for things like Like Buttons or other social widgets that you'd be signed into such as Disqus or Facebook comments?
- codedokode 9y ago
  Facebook widgets are used for tracking user across the web too. So one cannot protect user from being tracked without breaking those widgets.
- will4274 9y ago
  Logout. The standard mechanism for OAuth logout is to iframe the relying parties (RPs aka apps) which is a third party cookie context. Redirecting to each RP is substantially slower because logout is serialized rather than parallelized and requires well behaved RPs as any badly behaved RP breaks logout for the rest of the RPs. (This is why some browsers have a setting like "third party cookies after visited in a first party context" - first party for login, third party for logout. But advertisers screwed this up by asking sites to do full frame redirects through them. )
  - andy_ppp 9y ago
    >>> The standard mechanism for OAuth logout is to iframe the relying parties No it isn't. OAuth2 doesn't specify cookies in the entire spec and definitely doesn't require third party cookies, especially for logout. Here's the RFC: https://tools.ietf.org/html/rfc6749 https://tools.ietf.org/html/rfc6749
    - will4274 9y ago

deleted 9y ago

[deleted]

Sukotto 9y ago

Ad networks can track you without cookies. Cookies are just an easy first step. Any time any user hits any page with your javascript[1] in it: record ip address, referer (sic), locale preferences, available fonts, what's in their cache, what extensions they have, and anything else you can get. You can even track if they have certain 3rd party sites blocked. Then it is a matter of bayesian guessing about who they are. Given that a typical person spends most of their time in only a few specific places (home, commute, work, favorite coffee shop/pub, etc) you can make very good guesses about which person is visiting your page after only a few visits... even if they have cookies disabled. [1]And if they have js disabled they can't really use your site because js is basically required now. And you can still track that information and advertise to that cohort. How many people hitting the site from these 5 ip addresses, who use chromium, and have no cookies, and have js turned off? One? Well, then they just identified that person

om2 9y ago
We studied the behavior of many trackers in detail. We believe many track you solely with client-side state (including cookies, indexeddb, LocalStorage, The http cache, etc). It's true that some others use fingerprinting like you describe, and it's something we will think about in the future. But stateful tracking is still the most reliable mechanism, and for many trackers it's the sole mechanism.
bigbugbag 9y ago
Don't we have a few extensions mimicking the most common settings to defeat such fingerprinting ?

om2 9y ago

The challenge lies in trying not to break any user-facing website functionality. Things like single sign-on, login with Google/FB, Share and Tweet This buttons, CDNs for static content, etc. We also had a goal of not blocking ads. These limitations require a more complex feature, but it can be on by default without upsetting users or publishers.

bradgessler 9y ago
I can't upvote the complexity concerns in here enough. In effect you've banned 3rd party cookies, or at least that's the assumption that a lot of us will have to make to support Safari users because the state of their browser is harder to determine.
- om2 9y ago
  You should definitely code websites as if you don't have third-party cookies. It's always been our intent to ban them, and we're closing the loopholes as much as we can without breaking the web.
  - bradgessler 9y ago
    Yeah, we had to assume that because of the way iframes work in Safari. Its obviously great for privacy, but very frustrating from an application developer perspective. Too bad the interwebs are becoming more hostile and require these measures. IMO the Webkit team would make developers' lives much easier if you more clearly articulated that intent; otherwise they have to guess the direction your team is heading and might build something in the short term that ends up breaking.
- bigbugbag 9y ago
  People aware of third party cookies usually disable them anyways, so don't assume third party cookies support is a given.

bigbugbag 9y ago

How do you implement browser fingerprinting ?