3 ms·

I've gone back and forth on this since it was first announced. It's a very tough pill to swallow and is absolutely going to break a lot of web content. There's

I've gone back and forth on this since it was first announced. It's a very tough pill to swallow and is absolutely going to break a lot of web content. There's just no way around that. And there are very few things that are worth breaking the web over. This is probably one of them. The security benefits of this change are very, very high. It's fixing something that arguably was broken since the introduction of cookies. I am, as a rule, fairly skeptical when Chrome/Chromium devs say they're going to break something for security. Usually I think they're wrong, this time I think they're right, and I'm grateful that they've pushed for the change. Also to the Chromium team's credit, they're taking the lead on something that they are 100% going to get criticized about. There are going to be some very angry threads about how they did it wrong, and how a 2020 release is too soon. I don't think the rollout has been perfect either, but... somebody has to do it. Once everything dies down, Firefox is going to implement the same changes, and no one will bat an eye because everyone will have already adjusted to Chrome. There's very little upside to being the browser that makes these changes first, but one of the browsers needs to do it first. A nontrivial portion of our privacy/security problems on the web come from some fundamentally bad sandboxing; and frankly, cookies are badly sandboxed. This change makes the default at least a little better, and will immediately block a large number of CSRF attacks. So, yeah. I get that it's annoying, but I'm with Google on this one.

dfabulich 7y ago
Firefox and Safari are way ahead of Chrome on this. Safari has blocked third-party cookies for years, with no way to opt-in to supporting them. Ad companies have worked around that restriction, using a number of circumventions that Chrome does not currently intend to block. When ad companies attempt to circumvent Safari's third-party cookie policy, Safari tries to block them as part of their non-standard ITP (Intelligent Tracking Prevention) program. https://clearcode.cc/blog/intelligent-tracking-prevention/ https://clearcode.cc/blog/intelligent-tracking-prevention/ Firefox has followed suit with an "Enhanced Tracking Protection" feature, which was optional, but became mandatory in September of this year. https://blog.mozilla.org/blog/2019/09/03/todays-firefox-blocks-third-party-tracking-cookies-and-cryptomining-by-default/ https://blog.mozilla.org/blog/2019/09/03/todays-firefox-bloc... Rather than fearing to break the web, Apple has broken the web's ad tech frequently and aggressively; users seem not to mind. Browser vendors fear "breaking the web," in part because they're afraid that users will switch browsers if their favorite web site stops working. But it turns out that if you just break the web's ads, users tend to like it, if they even notice in the first place.
- danShumway 7y ago
  The point of this change isn't to break ads, the tracking benefits are at best incidental. Ad networks can just opt-out anyway. The point is to block CSRF attacks on ordinary websites for developers who don't know enough to secure their cookies. > But it turns out that if you just break the web's ads, users tend to like it, if they even notice in the first place. Breaking just the web's ads wouldn't have the same impact on security. The reason this change is valuable is because it's not restricted to specific blacklists or domains or applied via an algorithm, it's universal. I really like the tracking protections that Safari/Firefox are adding, but comparing them to this is apples and oranges. They're policies that are designed for different purposes.
- cpeterso 7y ago
  Firefox's Enhanced Tracking Protection is not mandatory. It's just enabled by default now. You can configure it in your Firefox settings or disable for individual sites via the address bar's shield icon.
KwanEsq 7y ago
Firefox seems to have already implemented it behind prefs in Fx69 [0], and are just now waiting to toggle them to default true, presumably around the same time Chrome ships it, February 2020. [0] https://groups.google.com/d/msg/mozilla.dev.platform/nx2uP0CzA9k/BNVPWDHsAQAJ https://groups.google.com/d/msg/mozilla.dev.platform/nx2uP0C...
- danShumway 7y ago
  Thanks for the heads up, I was curious what Firefox's status was. I think that's just a smart move in general. There's certainly no PR reason to preemptively turn this setting on, it's better to see what happens when Chrome does. If it turns out to be a disaster, you delay, if not, you flip the switch a few days later so you're not lagging behind on security. Again, I have a reasonable amount of respect for the amount of publicity that the Chromium team has done here, because I think that if things go wrong, they're the ones who will be blamed by most people. It's good to bring up that Mozilla and Microsoft are also on board with this. It's not Google going off and doing something on their own or forcing the change despite objections, pretty much everyone including Mozilla seems to agree, and would like to see this change.

dfabulich 7y ago

Firefox and Safari are way ahead of Chrome on this. Safari has blocked third-party cookies for years, with no way to opt-in to supporting them. Ad companies have worked around that restriction, using a number of circumventions that Chrome does not currently intend to block. When ad companies attempt to circumvent Safari's third-party cookie policy, Safari tries to block them as part of their non-standard ITP (Intelligent Tracking Prevention) program. https://clearcode.cc/blog/intelligent-tracking-prevention/ https://clearcode.cc/blog/intelligent-tracking-prevention/ Firefox has followed suit with an "Enhanced Tracking Protection" feature, which was optional, but became mandatory in September of this year. https://blog.mozilla.org/blog/2019/09/03/todays-firefox-blocks-third-party-tracking-cookies-and-cryptomining-by-default/ https://blog.mozilla.org/blog/2019/09/03/todays-firefox-bloc... Rather than fearing to break the web, Apple has broken the web's ad tech frequently and aggressively; users seem not to mind. Browser vendors fear "breaking the web," in part because they're afraid that users will switch browsers if their favorite web site stops working. But it turns out that if you just break the web's ads, users tend to like it, if they even notice in the first place.

danShumway 7y ago
The point of this change isn't to break ads, the tracking benefits are at best incidental. Ad networks can just opt-out anyway. The point is to block CSRF attacks on ordinary websites for developers who don't know enough to secure their cookies. > But it turns out that if you just break the web's ads, users tend to like it, if they even notice in the first place. Breaking just the web's ads wouldn't have the same impact on security. The reason this change is valuable is because it's not restricted to specific blacklists or domains or applied via an algorithm, it's universal. I really like the tracking protections that Safari/Firefox are adding, but comparing them to this is apples and oranges. They're policies that are designed for different purposes.
cpeterso 7y ago
Firefox's Enhanced Tracking Protection is not mandatory. It's just enabled by default now. You can configure it in your Firefox settings or disable for individual sites via the address bar's shield icon.

KwanEsq 7y ago

Firefox seems to have already implemented it behind prefs in Fx69 [0], and are just now waiting to toggle them to default true, presumably around the same time Chrome ships it, February 2020. [0] https://groups.google.com/d/msg/mozilla.dev.platform/nx2uP0CzA9k/BNVPWDHsAQAJ https://groups.google.com/d/msg/mozilla.dev.platform/nx2uP0C...

danShumway 7y ago
Thanks for the heads up, I was curious what Firefox's status was. I think that's just a smart move in general. There's certainly no PR reason to preemptively turn this setting on, it's better to see what happens when Chrome does. If it turns out to be a disaster, you delay, if not, you flip the switch a few days later so you're not lagging behind on security. Again, I have a reasonable amount of respect for the amount of publicity that the Chromium team has done here, because I think that if things go wrong, they're the ones who will be blamed by most people. It's good to bring up that Mozilla and Microsoft are also on board with this. It's not Google going off and doing something on their own or forcing the change despite objections, pretty much everyone including Mozilla seems to agree, and would like to see this change.