3 ms·

Like what? I've had third-party cookies blocked for, as you say, ages (and I even block JavaScript, with selective exceptions), and I use everything from Disco

Like what? I've had third-party cookies blocked for, as you say, ages (and I even block JavaScript, with selective exceptions), and I use everything from Discord to Amazon just fine.

iscrewyou 7y ago
Same. I enabled mine about two-three weeks ago. Nothing has been broken for me.
will4274 7y ago
Basically all cloud authentication services. Try signing into a bunch of apps and then signing out - with third party cookies disabled, you'll find you're still signed in to most of the apps, because the browser refused the (third party) session cookie clear.
- jeroenhd 7y ago
  This depends on the service. I believe many authentication services actually use cross-tab communication (so they open a tab/window and can exchange messages as long as both are open). AFAIK Google makes use of that method and other one-click providers do too. That is, however, more difficult than just setting third-party cookies so smaller authentication services might choose not to use such functionality. If Chrome or Edge follows in this path though, websites won't have a choice but to make things work with this feature enabled.
  - will4274 7y ago
    OpenID Connect implementations use iframes for logout, because that's what the spec says. Iframes are a third party context. The big Identity companies (Ping, Oracle, Microsoft) wrote the OpenID Connect spec. Google may be the odd man out (they are notorious for implementing logout poorly in general) but the biggest enterprise authentication services use iframes for logout. There is a compromise here which works for logout which was commonly implemented for a few years - supporting third party cookie clear but not set. But Apple ended this norm.
floatingatoll 7y ago
Note that the Cookies setting Firefox enabled for new users is “Block third-party trackers”. While there is a more restrictive “Block all third-party cookies” option available, that’s not the same thing and as above suggests, the “all” option will break some sites (such as single sign-on) that the trackers-only option will not.

Like what? I've had third-party cookies blocked for, as you say, ages (and I even block JavaScript, with selective exceptions), and I use everything from Discord to Amazon just fine.

iscrewyou 7y ago

Same. I enabled mine about two-three weeks ago. Nothing has been broken for me.

will4274 7y ago

Basically all cloud authentication services. Try signing into a bunch of apps and then signing out - with third party cookies disabled, you'll find you're still signed in to most of the apps, because the browser refused the (third party) session cookie clear.

jeroenhd 7y ago
This depends on the service. I believe many authentication services actually use cross-tab communication (so they open a tab/window and can exchange messages as long as both are open). AFAIK Google makes use of that method and other one-click providers do too. That is, however, more difficult than just setting third-party cookies so smaller authentication services might choose not to use such functionality. If Chrome or Edge follows in this path though, websites won't have a choice but to make things work with this feature enabled.
- will4274 7y ago
  OpenID Connect implementations use iframes for logout, because that's what the spec says. Iframes are a third party context. The big Identity companies (Ping, Oracle, Microsoft) wrote the OpenID Connect spec. Google may be the odd man out (they are notorious for implementing logout poorly in general) but the biggest enterprise authentication services use iframes for logout. There is a compromise here which works for logout which was commonly implemented for a few years - supporting third party cookie clear but not set. But Apple ended this norm.

floatingatoll 7y ago

Note that the Cookies setting Firefox enabled for new users is “Block third-party trackers”. While there is a more restrictive “Block all third-party cookies” option available, that’s not the same thing and as above suggests, the “all” option will break some sites (such as single sign-on) that the trackers-only option will not.