5 ms·

Google has plans to deprecate cookies over http

31 points by mike22223333 8y ago

deleted 8y ago
[deleted]
ZiiS 8y ago
>> Should we special-case the cookie value "OPT_OUT"? It would be unfortunate indeed if removing old cookies meant that users who had opted out of interest-based advertising started being targeted again. Perhaps excluding the special value OPT_OUT (and asking advertisers to standardize on it?) is justifiable. Still suggesting the Evil Bit? https://www.ietf.org/rfc/rfc3514.txt https://www.ietf.org/rfc/rfc3514.txt
- _verandaguy 8y ago
  To be fair, the evil bit's a great idea; it just failed to get much support from the malware developer community.
  - John_KZ 8y ago
    Maybe they didn't ask them nicely enough. Likewise, instead of using technical measures to stop websites from acquiring analytics, we can make them pinky-swear to delete out data. This simply cannot go wrong.
ToFab123 8y ago
plan? No, some guy has suggested it. That does not equal to plan.
angrygoat 8y ago
Discussion thread on the blink-dev list here: https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/r0UBdUAyrLk https://groups.google.com/a/chromium.org/forum/#!topic/blink...
m90 8y ago
Can we change the clickbaity headline? This is a Google employee, but there is no evidence in that repo that supports the claim that "Google has plans".
- eganist 8y ago
  Speaking with some amount of experience working with people on that team: his role at Google is precisely what you see him doing here—deprecating insecure fundamental components of the web. A proposal like this wouldn't have been approved for public release if the rest of the Chromium security team didn't see merit to it. Everyone keeps calling him "some guy." Mike West is attached to a number of similar RFCs. That all being said, I wouldn't immediately discount the idea even if it only turns out to be a research exercise.
- nmjohn 8y ago
  See the Intent to Deprecate on blink-dev: https://groups.google.com/a/chromium.org/d/msg/blink-dev/r0UBdUAyrLk/E_iCCBCRBAAJ https://groups.google.com/a/chromium.org/d/msg/blink-dev/r0U...
- giovannibajo1 8y ago
  This went to blink-dev: https://groups.google.com/a/chromium.org/forum/m/#!topic/blink-dev/r0UBdUAyrLk https://groups.google.com/a/chromium.org/forum/m/#!topic/bli... I’m not familiar with their workflow but it looks like something that the development team is considering, not random babbling from a random employee.
- pimterry 8y ago
  This is the background explainer for "Intent to Deprecate: Nonsecurely delivered cookies", from the official Blink mailing list ( https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/r0UBdUAyrLk https://groups.google.com/a/chromium.org/forum/#!topic/blink...). Technically yes, it's the Blink team that has plans to deprecate, but that is effectively Google.
whoisburbansky 8y ago
Shouldn't the title have 'deprecate' instead of 'depreciate'?
- bencollier49 8y ago
  They want them to last for less time. Perhaps that's the right word.
  - mykeliu 8y ago
    I think so as well. The intent of this write-up is explicitly to advocate for a practice to "Expire cookies early". "Depreciate" might not be the perfect word, but "deprecate" is outright misleading.
  - christophergray 8y ago
    Depreciate is an intransitive verb. It does not take an object such as cookies, but refers back to the subject. So short GOOG now.
- jasonkostempski 8y ago
  One of my earliest memories of professional programming was talking to another dev, many years my senior in experience, about a "deprecated" API. They insisted the word was "depreciated". I didn't push it for the conversation, but afterwards triple-double-checked I wasn't crazy. Nearly 20 years later, I still feel I might be using the word wrong.
  - drivingmenuts 8y ago
    I die a little inside every time I see 'commerical'.
    - jasonkostempski 8y ago
      I imagine the Urban Dictionary definition to be "A comical commercial" :)
sbr464 8y ago
Might cause an issue for WiFi access portals in short term. Not really related, more of a side effect of poor implementations. Some use cookies to route around settings, I’ve had trouble with in past.
lousken 8y ago
next step: disable javascript served over http
- vultour 8y ago
  next step: disable javascript
  - mike22223333 8y ago
    It's not the 90's... WebApps and PWA's require JS. And Javascript in browser is secure as it is sandboxed. Minute privacy concerns are not enough for 99.9% of the people to disable js either.
LinuxBender 8y ago
Should there be an official Google update or blog on this?

31 points by mike22223333 8y ago

deleted 8y ago

[deleted]

ZiiS 8y ago

>> Should we special-case the cookie value "OPT_OUT"? It would be unfortunate indeed if removing old cookies meant that users who had opted out of interest-based advertising started being targeted again. Perhaps excluding the special value OPT_OUT (and asking advertisers to standardize on it?) is justifiable. Still suggesting the Evil Bit? https://www.ietf.org/rfc/rfc3514.txt https://www.ietf.org/rfc/rfc3514.txt

_verandaguy 8y ago
To be fair, the evil bit's a great idea; it just failed to get much support from the malware developer community.
- John_KZ 8y ago
  Maybe they didn't ask them nicely enough. Likewise, instead of using technical measures to stop websites from acquiring analytics, we can make them pinky-swear to delete out data. This simply cannot go wrong.

ToFab123 8y ago

plan? No, some guy has suggested it. That does not equal to plan.

angrygoat 8y ago

Discussion thread on the blink-dev list here: https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/r0UBdUAyrLk https://groups.google.com/a/chromium.org/forum/#!topic/blink...

m90 8y ago

Can we change the clickbaity headline? This is a Google employee, but there is no evidence in that repo that supports the claim that "Google has plans".

eganist 8y ago
Speaking with some amount of experience working with people on that team: his role at Google is precisely what you see him doing here—deprecating insecure fundamental components of the web. A proposal like this wouldn't have been approved for public release if the rest of the Chromium security team didn't see merit to it. Everyone keeps calling him "some guy." Mike West is attached to a number of similar RFCs. That all being said, I wouldn't immediately discount the idea even if it only turns out to be a research exercise.
nmjohn 8y ago
See the Intent to Deprecate on blink-dev: https://groups.google.com/a/chromium.org/d/msg/blink-dev/r0UBdUAyrLk/E_iCCBCRBAAJ https://groups.google.com/a/chromium.org/d/msg/blink-dev/r0U...
giovannibajo1 8y ago
This went to blink-dev: https://groups.google.com/a/chromium.org/forum/m/#!topic/blink-dev/r0UBdUAyrLk https://groups.google.com/a/chromium.org/forum/m/#!topic/bli... I’m not familiar with their workflow but it looks like something that the development team is considering, not random babbling from a random employee.
pimterry 8y ago
This is the background explainer for "Intent to Deprecate: Nonsecurely delivered cookies", from the official Blink mailing list ( https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/r0UBdUAyrLk https://groups.google.com/a/chromium.org/forum/#!topic/blink...). Technically yes, it's the Blink team that has plans to deprecate, but that is effectively Google.

whoisburbansky 8y ago

Shouldn't the title have 'deprecate' instead of 'depreciate'?

bencollier49 8y ago
They want them to last for less time. Perhaps that's the right word.
- mykeliu 8y ago
  I think so as well. The intent of this write-up is explicitly to advocate for a practice to "Expire cookies early". "Depreciate" might not be the perfect word, but "deprecate" is outright misleading.
- christophergray 8y ago
  Depreciate is an intransitive verb. It does not take an object such as cookies, but refers back to the subject. So short GOOG now.
jasonkostempski 8y ago
One of my earliest memories of professional programming was talking to another dev, many years my senior in experience, about a "deprecated" API. They insisted the word was "depreciated". I didn't push it for the conversation, but afterwards triple-double-checked I wasn't crazy. Nearly 20 years later, I still feel I might be using the word wrong.
- drivingmenuts 8y ago
  I die a little inside every time I see 'commerical'.
  - jasonkostempski 8y ago
    I imagine the Urban Dictionary definition to be "A comical commercial" :)

sbr464 8y ago

Might cause an issue for WiFi access portals in short term. Not really related, more of a side effect of poor implementations. Some use cookies to route around settings, I’ve had trouble with in past.

lousken 8y ago

next step: disable javascript served over http

vultour 8y ago
next step: disable javascript
- mike22223333 8y ago
  It's not the 90's... WebApps and PWA's require JS. And Javascript in browser is secure as it is sandboxed. Minute privacy concerns are not enough for 99.9% of the people to disable js either.

LinuxBender 8y ago

Should there be an official Google update or blog on this?