4 ms·

Firefox (and chrome) has had this for ages (opt-in till now), and it breaks a lot of services. I don't think they previously would dare to enable it out of the

Firefox (and chrome) has had this for ages (opt-in till now), and it breaks a lot of services. I don't think they previously would dare to enable it out of the box. But now they can just say Apple does this too...

shrimp_emoji 7y ago
Like what? I've had third-party cookies blocked for, as you say, ages (and I even block JavaScript, with selective exceptions), and I use everything from Discord to Amazon just fine.
- iscrewyou 7y ago
  Same. I enabled mine about two-three weeks ago. Nothing has been broken for me.
- will4274 7y ago
  Basically all cloud authentication services. Try signing into a bunch of apps and then signing out - with third party cookies disabled, you'll find you're still signed in to most of the apps, because the browser refused the (third party) session cookie clear.
  - jeroenhd 7y ago
    This depends on the service. I believe many authentication services actually use cross-tab communication (so they open a tab/window and can exchange messages as long as both are open). AFAIK Google makes use of that method and other one-click providers do too. That is, however, more difficult than just setting third-party cookies so smaller authentication services might choose not to use such functionality. If Chrome or Edge follows in this path though, websites won't have a choice but to make things work with this feature enabled.
    - will4274 7y ago
      OpenID Connect implementations use iframes for logout, because that's what the spec says. Iframes are a third party context. The big Identity companies (Ping, Oracle, Microsoft) wrote the OpenID Connect spec. Google may be the odd man out (they are notorious for implementing logout poorly in general) but the biggest enterprise authentication services use iframes for logout. There is a compromise here which works for logout which was commonly implemented for a few years - supporting third party cookie clear but not set. But Apple ended this norm.
- floatingatoll 7y ago
  Note that the Cookies setting Firefox enabled for new users is “Block third-party trackers”. While there is a more restrictive “Block all third-party cookies” option available, that’s not the same thing and as above suggests, the “all” option will break some sites (such as single sign-on) that the trackers-only option will not.
darkpuma 7y ago
> "and it breaks a lot of services." I can't say that's been my experience. It breaks some stuff, but far less than I was expecting it too. (Ditto for disabling javascript entirely with uMatrix..) Talking up the downside like this has the effect of making people hesitate to try it for themselves. I wish I'd started years earlier, but everyone was talking about how much of a hassle it is. It's not a hassle. Most of the time I don't notice anything going wrong.
- mtgx 7y ago
  And if Google wasn't under anti-trust investigation now, it would probably purposefully change its apps so they don't work unless you enable cookie tracking again.
  - tgragnato 7y ago
    But Google is under anti-trust investigation. The question for me is "Will they use partnerships and informal ties to disrupt the feature?".
  - darkpuma 7y ago
    ReCAPTCHAv2 is basically already there. It's easily the greatest pain point for disabled javascript, third party isolation, etc. It never actually gives you harder problems to solve, it just starts rejecting a greater number of correct answers. Eventually it will let you correctly solve dozens of problems in a row without letting you pass, but also never telling you that they've made the decision to keep you out. They also add in a long fade animation for each tile, just to punish humans (bots wouldn't find it annoying, on account of being bots.)
gioele 7y ago
> Firefox (and chrome) has had this for ages (opt-in till now), and it breaks a lot of services. My data-point: Every couple of years I try to enable it, but every time there is _that website_ that breaks because it really needs third-party cookies. Usually they are oldish, unmaintained "third party solutions", a couple of times banks, once the complete university-wide single-sign-on system. I hope that, thanks the vast number of Apple users in key positions, these problems will now be quickly solved.
- panpanna 7y ago
  A lot of new Microsoft products need 3rd party cookies (eg teams needs sso and Skype sites). So not only old software.
tgsovlerkhgsel 7y ago
By making it the default on a sufficiently large percentage of the population, a lot fewer services will be broken by it (because the services will fix their sites).

shrimp_emoji 7y ago

Like what? I've had third-party cookies blocked for, as you say, ages (and I even block JavaScript, with selective exceptions), and I use everything from Discord to Amazon just fine.

iscrewyou 7y ago
Same. I enabled mine about two-three weeks ago. Nothing has been broken for me.
will4274 7y ago
Basically all cloud authentication services. Try signing into a bunch of apps and then signing out - with third party cookies disabled, you'll find you're still signed in to most of the apps, because the browser refused the (third party) session cookie clear.
- jeroenhd 7y ago
  This depends on the service. I believe many authentication services actually use cross-tab communication (so they open a tab/window and can exchange messages as long as both are open). AFAIK Google makes use of that method and other one-click providers do too. That is, however, more difficult than just setting third-party cookies so smaller authentication services might choose not to use such functionality. If Chrome or Edge follows in this path though, websites won't have a choice but to make things work with this feature enabled.
  - will4274 7y ago
    OpenID Connect implementations use iframes for logout, because that's what the spec says. Iframes are a third party context. The big Identity companies (Ping, Oracle, Microsoft) wrote the OpenID Connect spec. Google may be the odd man out (they are notorious for implementing logout poorly in general) but the biggest enterprise authentication services use iframes for logout. There is a compromise here which works for logout which was commonly implemented for a few years - supporting third party cookie clear but not set. But Apple ended this norm.
floatingatoll 7y ago
Note that the Cookies setting Firefox enabled for new users is “Block third-party trackers”. While there is a more restrictive “Block all third-party cookies” option available, that’s not the same thing and as above suggests, the “all” option will break some sites (such as single sign-on) that the trackers-only option will not.

darkpuma 7y ago

> "and it breaks a lot of services." I can't say that's been my experience. It breaks some stuff, but far less than I was expecting it too. (Ditto for disabling javascript entirely with uMatrix..) Talking up the downside like this has the effect of making people hesitate to try it for themselves. I wish I'd started years earlier, but everyone was talking about how much of a hassle it is. It's not a hassle. Most of the time I don't notice anything going wrong.

mtgx 7y ago
And if Google wasn't under anti-trust investigation now, it would probably purposefully change its apps so they don't work unless you enable cookie tracking again.
- tgragnato 7y ago
  But Google is under anti-trust investigation. The question for me is "Will they use partnerships and informal ties to disrupt the feature?".
- darkpuma 7y ago
  ReCAPTCHAv2 is basically already there. It's easily the greatest pain point for disabled javascript, third party isolation, etc. It never actually gives you harder problems to solve, it just starts rejecting a greater number of correct answers. Eventually it will let you correctly solve dozens of problems in a row without letting you pass, but also never telling you that they've made the decision to keep you out. They also add in a long fade animation for each tile, just to punish humans (bots wouldn't find it annoying, on account of being bots.)

gioele 7y ago

> Firefox (and chrome) has had this for ages (opt-in till now), and it breaks a lot of services. My data-point: Every couple of years I try to enable it, but every time there is _that website_ that breaks because it really needs third-party cookies. Usually they are oldish, unmaintained "third party solutions", a couple of times banks, once the complete university-wide single-sign-on system. I hope that, thanks the vast number of Apple users in key positions, these problems will now be quickly solved.

panpanna 7y ago
A lot of new Microsoft products need 3rd party cookies (eg teams needs sso and Skype sites). So not only old software.

tgsovlerkhgsel 7y ago

By making it the default on a sufficiently large percentage of the population, a lot fewer services will be broken by it (because the services will fix their sites).