16 ms·
Building a more private web: A path towards making third party cookies obsolete
- EGreg 7y agoWhat about single-sign-on stuff? What about iframe widgets where you are logged in?? Will there be a way to choose to keep being logged in, in iOS and Android? Or will everything become stateless and dumb?
- tyingq 7y agoIt's difficult to take Google's position on 3rd party cookies as altruistic. Between Chrome, GA, AdSense, DoubleClick, Gmail, etc, they don't need 3rd party cookies to gather user data. Even if killing 3rd party cookies drops them back a little, it drops the #2 panopticon back more...extending Google's lead.
- IAmEveryone 7y agoAdSense, DoubleClick, and Analytics all need 3rd-party cookies, no?
- lmkg 7y agoDV360 (formerly DoubleClick) definitely does. Analytics uses first-party cookies for its core functionality. There are optional features where it connects to a third-party cookie from another Google service, e.g. connecting to the DV360 cookie to pull in demographic information.
- Rychard 7y agoThey do, but seeing as how most users are force-feeding user data directly into Google's mouth via usage of their search engine and gmail inbox, removing 3rd party cookies from the equation is unlikely to affect their bottom-line in a measureable way.
- rahuldottech 7y agoNot if the user is logged in to the Chrome or Android
- unilynx 7y agoThey can use redirect flows and POST back to the page you’re logging in to. It will be fine for most Auth flows (but not eg SAML passive logins)
- ma2rten 7y agoWhy can't they do this for ads?
- rafaelturk 7y agoHard to read this and extract facts. My sense that this article is intentionally vague.
- Ajedi32 7y agoTl;Dr: > [...] we plan to phase out support for third-party cookies in Chrome. Our intention is to do this within two years [...] As for what they're replacing them with, sounds like they don't quite know yet. They seem to still be in the requirements gathering phase: https://github.com/w3c/web-advertising https://github.com/w3c/web-advertising
- SimeVidas 7y ago> we plan to phase out support for third-party cookies in Chrome This is news to me.
- Scarbutt 7y agoLooks like safari gave them no choice, so now they grab this as an opportunity to say the want to do it too.
- duxup 7y agoDoes chromium really have to do what Safari did? aka "no option"?
- atonse 7y agoSafari has a tiny share on the desktop, but is pretty large on mobile. Credit to Apple for being aggressive taking on the ad companies. Yes this is totally a business decision that benefits them, but it also benefits consumers. So in that sense, the incentives are aligned. Hope they keep going.
- wnevets 7y agoHasn't safari always defaulted to no 3rd party cookies?
- pornel 7y agoSafari used to allow 3rd party cookies in some circumstances, and of course Google abused that for tracking: https://nakedsecurity.sophos.com/2017/11/30/google-sued-over-iphone-safari-workaround-data-snooping/ https://nakedsecurity.sophos.com/2017/11/30/google-sued-over...
- ergothus 7y agoAs I understand it: No. Rather, Safari uses "Intelligent Tracking Prevention". This blocks SOME (most?) 3rd Party cookies, but not all. For example, single sign on providers will often use cookies, and they are often explicitly 3rd party. ITP tries to let those through. IIRC Safari can be set to block ALL 3rd party cookies, but it is not the default setting. SSO providers don't NEED cookies, they can do full page redirects to avoid being 3rd party, but it does complicate matters, and the relationship between you, a site, and a 3rd party identity provider you've presumably agreed to can be a different beast than the tracking cookies that are the focus here, though of course identity providers could always join the dark side as well.
- jka 7y agoThere's a short summary of some of the features proposed for the Privacy Sandbox here - https://blog.chromium.org/2019/08/potential-uses-for-privacy-sandbox.html https://blog.chromium.org/2019/08/potential-uses-for-privacy...
- zpeti 7y agoI think this is an easy move for Google, it's a "strategy credit" as Ben Thompson would put it. Google already knows most of what it needs about you, and it will in the future from searches. It has no motivation to allow 3rd parties help in tracking visitors. This way it can build a moat around its business while pretending to care about privacy. It's bullshit.
- 3fe9a03ccd14ca5 7y agoSo... let anyone who wants to keep tracking us without our material consent or knowledge? No thanks.
- zpeti 7y agoIf you want to use chrome, be aware of the company’s underlying motivations. But I’d recommend not using it at all, I don’t.
- wtetzner 7y agoGoogle's reason for wanting this is bullshit, but that doesn't mean it wouldn't be a beneficial move in general.
- ocdtrekkie 7y agoThe beneficial move would be for Chrome to accept the industry-standard choice of letting users easily block all tracking and fingerprinting... including Google's. But that wouldn't be good for Google. This is the exact reason an ad company should not be allowed to own a web browser.
- IAmEveryone 7y agoBut... they are going to not just allow users, but per default, block 3rd party cookies? Edit: comment was either edited, or I’m going senile. In any case: Chrome does allow blocking all cookies as well, and has from the first release. Fingerprinting isn’t easily avoided, but they have taken some steps to make it harder.
- bilekas 7y agoThere have been articles recently which are claiming the value of those cookies are not as valuable as before because the majority of them are avoided/altered to obfuscate to the requester. So I see this as a : 'Hey we got in before everyone and stopped using cookies first' — When in reality, they're becomming less of a valuable commoddity. I'll be very happy when companies stop storing excess info in their own storage. Until then, no round of applause from me .
- ragebol 7y ago> I'll nurse a semi What? Care to explain for a non-native speaker / non-US based reader?
- bilekas 7y agoUpdated, as a non native speaker, it's really not an expression you should learn!
- IAmEveryone 7y agoIt’s sexual, and therefore probably not a good expression to use unless you know what you are doing. But it’s a somewhat eloquent term, in a way. (It refers to getting sexually aroused, but only mildly)
- Tepix 7y agohttps://www.urbandictionary.com/define.php?term=nursing+a+semi https://www.urbandictionary.com/define.php?term=nursing+a+se...
- awinter-py 7y agoa large chunk of G's business is first-party ads, i.e. in their own SERP vs on someone else's inventory interesting to see if that's the future. certainly anyone with substantial inventory has experimented with this (NYT for example) because they suspect they're getting cheating by G/FB
- jszymborski 7y agoIn the past Chrome has played fast and loose with standards and features, which was fine for them since Firefox and friends needed to adopt them lest they widen the "Only works on Chrom(e/ium)" gap. I wonder how removing a feature might go, however. The answer is "probably well because Chrome has overwhelming market share", but I do wonder if, between AMP and "no URLs" and no 3rd party cookies, if there's room for a small but growing "it just works how I'd expect it to on Firefox" contingent to spring up...
- dmitriid 7y agoOr, you know, it might not "just work" in Firefox because Google sabotages it: https://twitter.com/johnath/status/1116871231792455686?s=20 https://twitter.com/johnath/status/1116871231792455686?s=20
- unlinked_dll 7y ago"only works in chrome" == "not going to use" for me and all any company/team where I have influence over software dependencies/tools. Same goes for "only works on one target" software in general though, usually means something is under tested.
- phelm 7y agoI have disabled 3rd party cookies in my browser for about a year now. My experience has been fine, I have had very few issues with things that I care about, no whitelist and not had to re-enable them yet.
- ocdtrekkie 7y agoIndeed. Google Chrome's statements about the dangers and risks of blocking third party cookies is classic FUD. And it's solely about protecting their own data collection.
- driverdan 7y agoI've been blocking 3rd party cookies for many years. It doesn't cause any issues for 99.9% of sites. I think I've encountered less than 10 and I whitelisted the ones I needed.
- reaperducer 7y agoSame here. Web sites that block content because of a lack of third-party cookie support are pretty rare. I ran into one last week and was so surprised by the message it took me a few seconds to realize was happening.
- cj 7y agoSeconding this. chrome://settings/content/cookies Go there and enable "Block third-party cookies". The internet still works without them.
- cpeterso 7y agoSafari has blocked third-party cookies by default for a long time, so websites and advertisers that want to support iOS web users already need to work without third-party cookies.
- wnevets 7y agoThis has been my experience as well. Most sites I've encountered have already moved away from depending on 3rd party cookies.
- negus 7y agoYes this will have a great negative impact for Google's adtech competitors who unlike Google do not have other means to spy on users such as Chrome, search engine, Accelerated Mobile Pages, Gmail, voice assistant and so on. But Google really has no choice here due to aggressive campaign by Mozilla, Apple and Microsoft who boast with their Intelligent Tracking Prevention ( https://webkit.org/blog/8828/intelligent-tracking-prevention-2-2/ https://webkit.org/blog/8828/intelligent-tracking-prevention... ) implementation blaming Google as a company which does not value users privacy. Google would lose privacy-conscious users otherwise. But it is clear for me how all this anti-thirdparty cookies situation will go further: server side third party ad trackers -- this will bypass Same Origin Policy and will pose a privacy and security threat for users and websites even more than todays third party frontend ad trackers.
- dylz 7y ago> Google would lose privacy-conscious users otherwise. Would these users be using Chrome in the first place?
- negus 7y agoWhy not? Privacy is not the only goal even for paranoids. It is all about compromise. Otherwise you would use lynx or wget -- truly private web clients. Or at least turn off JS.
- unknown2374 7y agoWhy are you speaking as if there are no better alternatives than Chrome? Other than a few organizations who decided that only supporting Chrome as a browser is enough for their sites and some extensions, there are viable web browser alternatives from companies which don't make their money off of user's data.
- rpastuszak 7y agoI find their "removing 3rd party cookies will incentivise businesses to rely on fingerprinting" discourse dangerous. It implies that other browser vendors (Mozilla, Safari/WebKit, new Edge) are in fact making the Web a more dangerous place. I believe it's dangerous because it creates a harmful, unproductive PR narrative—people might just assume this is a true statement, without learning about both sides of the problem. I'm not trying to strip anyone of agency, I just don't think most of my friends would have time to research this topic and might decide to follow the main opinion instead. The answer I'd like to hear: Yes, it does push some actors towards fingerprinting, but preventing fingerprinting should be dealt with regardless. Changes should happen both on legislative and browser-vendor level. > But it is clear for me how all this anti-thirdparty cookies situation will go further: server side third party ad trackers -- this will bypass Same Origin Policy and will pose a privacy and security threat for users and websites even more than todays third party frontend ad trackers. Server-side as well as white-labelled (subdomain) integrations already exist. Lotame (DMP) has at least one product of this kind, afaik.
- driverdan 7y agoThis is so two-faced. This is the key line: > Once these approaches have addressed the needs of users, publishers, and advertisers, and we have developed the tools to mitigate workarounds… A browser vendor that cared about its users would make a browser for them, not publishers or advertisers. It would block all tracking garbage by default. Just admit it Justin, the real Chrome customers are advertisers. You don't actually give a shit about users if it interferes with ad dollars. Edit: I left out this good quote > Some ideas include new approaches to ensure that ads continue to be relevant for users More user-hostile advertiser appeasement.
- fredley 7y agoGoogle cares very much about its customers. Its customers are advertisers. Like any good business, it puts its customers first, and anything beneficial it offers anyone else is just to serve its customers, ultimately.
- rubber_duck 7y ago> it puts its customers first Have you ever dealt with Google as a customer :) ?
- negus 7y agoIt is not that easy. Consider Mozilla, the privacy maniacs. Even they let proprietary and intrusive DRM plugin inside, though it is totally contradicts FOSS approach https://news.ycombinator.com/item?id=7746585 https://news.ycombinator.com/item?id=7746585 This is life -- you have to take other parties interests into account or you will be buried. Start block all tracking garbage by default and sites will ban your users, forcing them to choose another product. Speaking about Google: when you're (unlike Apple) making most of your revenue from ads, any hostile action to ad industry will be considered hypocrisy and unfair competition
- jolux 7y agoThe DRM is totally different though. Not having it means certain sites can’t be used.
- bilekas 7y agoAnother reason why Google's concern here for our privacy is nonsense is if we look here : https://webkit.org/tracking-prevention-policy/ https://webkit.org/tracking-prevention-policy/ We can see, google doesn't need to inform their chrome users : > A privileged third party is a party that has the potential to track the user across websites without their knowledge or consent because of special access built into the browser or operating system. INOL but my understanding of this would put Google's Chrome into that bracket. Potentially also Microsoft/Apple ?
- exabrial 7y agoI believe they'll just be using the QUIC protocol and IPv6 to track users instead.
- exabrial 7y agoFor the downnvoters that don't believe me, go read Brave Browser's research into this.
- jotto 7y agoThis will break a lot of auth0 jwt/login default integrations since it depends on 3rd party cookies.
- marcosdumay 7y agoThis. Mozilla got the right tactics by making them session lived by default. Completely banning them will only break stuff.
- Tepix 7y agoSites shouldn't rely on 3rd party cookies being enabled. Safari has had them disabled since years (forever?) and more and more people are disabling them manually.
- tboyd47 7y agoIt's the classic regulatory capture move of pulling up the ladder behind you, only they don't need regulators to do it. What's more, Firefox is just an off-brand of Google to capture the "privacy first" consumer market segment. Doesn't mean I'm going to stop using Firefox, but it just helps to see the big picture.
- amluto 7y ago> By undermining the business model of many ad-supported websites, blunt approaches to cookies encourage the use of opaque techniques ... This is disingenuous. Reducing tracking does not undermine websites. It undermines advertisers that depend on tracking. If tracking stopped, advertisers would target something else (e.g. content or coarse location) and roughly the same amount of money would go to websites. Google’s privileged position would be a lot less inherently valuable, though.
- apeace 7y agoIf anyone from Google is reading this, the new SameSite policies coming to Chrome 80 are breaking "Login with Google" functionality. I opened an issue here: https://github.com/google/google-api-javascript-client/issues/592 https://github.com/google/google-api-javascript-client/issue...
- Despegar 7y ago> Users are demanding greater privacy--including transparency, choice and control over how their data is used--and it’s clear the web ecosystem needs to evolve to meet these increasing demands. Some browsers have reacted to these concerns by blocking third-party cookies, but we believe this has unintended consequences that can negatively impact both users and the web ecosystem. By undermining the business model of many ad-supported websites, blunt approaches to cookies encourage the use of opaque techniques such as fingerprinting (an invasive workaround to replace cookies), which can actually reduce user privacy and control. We believe that we as a community can, and must, do better. The Webkit team already proposed a privacy-preserving way to do ad click attribution [1]. I'm guessing that was too private and Privacy Sandbox works better for Google. [1] https://webkit.org/blog/8943/privacy-preserving-ad-click-attribution-for-the-web/ https://webkit.org/blog/8943/privacy-preserving-ad-click-att...
- markosaric 7y agoThis will hurt the ad-tech businesses and websites/publishers who rely on third-party ads/targeting much more than it will hurt Google (and Facebook). Still, Google's revenue on third-party site ads was $6.4bn in Q3 of 2019 out of the $40.5bn in total revenue so it could be felt a bit there too. I fear that it all will move to first-party tracking though which will be so much more difficult to block and so much more dangerous in terms of security.
- hurricanetc 7y ago>By undermining the business model of many ad-supported websites, blunt approaches to cookies encourage the use of opaque techniques such as fingerprinting (an invasive workaround to replace cookies), which can actually reduce user privacy and control. Sure. So how about we block fingerprinting? Oh waaaaaait I see. What you actually want is your privacy invading business model to not be impacted. Why are sites able to ascertain the type of browser, operating system, OS version, webkit version, Safari version, time zone, language, platform, vendor, screen dimensions, plugins, etc. This shit should be as locked down as location, web cam, and microphone. Block all of it.
- notsureifreal 7y agoYou'll end up trying to read a news article in a foreign language, that looks like a mobile website, has 1000px headline and can't be navigated because some of the functionality is broken.
- hurricanetc 7y agoNonsense. You can write a perfectly modern and beautiful site without any JS at all.
- Canada 7y agoBrowsers send an accept language header that I wish web sites would respect instead of using geoip.
- npx13 7y agoYou care about users privacy? Judging by how passive aggressively Google tries to prevent us actually logging out of a Google Account, you are having a laugh.
- sub7 7y agoGood riddance. Unfortunately (almost) all our conversations - verbal and text messaging - are being spied on to target us with ads right now. Addressing anything else is like pissing in the ocean to change it's colour.
- ryanmccullagh 7y agoSo now ad companies will just require a CNAME entry in the website's DNS record.
- deleted 7y ago[deleted]
- pc2g4d 7y agoThe arms race moves to its next phase. I'm not sure this will accomplish much as it's not that hard to serve things from one's own domain. More work for the tracking company to get things set up, I suppose, but harder to detect once established.
- Tepix 7y agoFor privacy conscious users who have blocked third party cookies for years, this may make evading tracking ever more complicated. My guess is we will need custom GreaseMonkey scripts that prevent parameters from being appended to URLs so when you click on a link to another site it will not pass tracking information. Generally whenever a tracking network changes these parameters the Greasemonkey scripts will have to be updated whereas in the past you could just block the third party cookies and avoid a lot of the tracking.
- deleted 7y ago[deleted]