7 ms·

> That being said, there are valid use cases for tracking users across websites. I work for a nonprofit ... Could you explain "valid use" more? I hope that yo

> That being said, there are valid use cases for tracking users across websites. I work for a nonprofit ... Could you explain "valid use" more? I hope that you're not implying that we should allow all non-profits to track people across websites so they can do fundraising.

wolco 7y ago
They have three domains and want one sign-in on one domain to login to all three. Normally they write a cookie the other domains can read.
cptskippy 7y ago
Well in our case we have multiple fundraising tools provided by a myriad of vendors (greater than 10). These tools vary in architecture (e.g. SaaS, PaaS, Turnkey, etc) and age. We also have a number of in-house developed products. We also have training resources that are exposed in different ways from Salesforce Communities to LMS based training systems. Our fundraisers and constituents as a whole have access to these tools to interact with us. Some of the products are self service, others require authorization. All of them are branded and the users consider that they're interacting with us and not the underlying product. So we have a situation where we need to Authenticate a user and possibly authorize them to access tools with varying roles and degrees of access. If a user needs access to Tool A but can't until they've completed training in the LMS, we have a situation where we need to identify and track a user across disparate platforms. It's not unlike having a Microsoft Account shared across Azure, DevOps, Office 365, and TechNet. Or a single Google Account to access Drive, Developer APIs, and Gmail.
withinboredom 7y ago
At WordPress.com, we have millions of sites. Having users be logged in so they can ‘like’ a post or comment or write new content is kinda important. That uses APIs and third party cookies (first party, but the API is a third-party from the perspective of the site they’re on). We are constantly dealing with Safari thinking it’s “tracking”. Disclaimer, we do track things, but only on admin pages, not users’ sites.

wolco 7y ago

They have three domains and want one sign-in on one domain to login to all three. Normally they write a cookie the other domains can read.

cptskippy 7y ago

Well in our case we have multiple fundraising tools provided by a myriad of vendors (greater than 10). These tools vary in architecture (e.g. SaaS, PaaS, Turnkey, etc) and age. We also have a number of in-house developed products. We also have training resources that are exposed in different ways from Salesforce Communities to LMS based training systems. Our fundraisers and constituents as a whole have access to these tools to interact with us. Some of the products are self service, others require authorization. All of them are branded and the users consider that they're interacting with us and not the underlying product. So we have a situation where we need to Authenticate a user and possibly authorize them to access tools with varying roles and degrees of access. If a user needs access to Tool A but can't until they've completed training in the LMS, we have a situation where we need to identify and track a user across disparate platforms. It's not unlike having a Microsoft Account shared across Azure, DevOps, Office 365, and TechNet. Or a single Google Account to access Drive, Developer APIs, and Gmail.

withinboredom 7y ago

At WordPress.com, we have millions of sites. Having users be logged in so they can ‘like’ a post or comment or write new content is kinda important. That uses APIs and third party cookies (first party, but the API is a third-party from the perspective of the site they’re on). We are constantly dealing with Safari thinking it’s “tracking”. Disclaimer, we do track things, but only on admin pages, not users’ sites.