17 ms·
Full third-party cookie blocking and more
- kyleee 7y agoAre there efforts to cloak third party cookies via the first party domain?
- bouk 7y agoThe point of third party cookies is cross-site tracking, which doesn't work with a first party domain.
- kyleee 7y agoThanks I think I was conflating this with the cloaking 3rd party JS payloads in first party domains
- speleding 7y agoThere are perfectly valid use cases for third party cookies that do not involve tracking. Our business offers an appointment scheduling widget, it needs cookies for user sessions, and those cookies are third party because the widget is commonly included on a web page inside an iframe. That widget now breaks in the new safari preview.
- pspeter3 7y agoI'm confused about if this means that IndexedDB will always wipe data after 7 days. That seems like it would prevent storage from being used for user data in PWAs.
- jessaustin 7y agoWow they buried the lede; I'm glad you highlighted this. This is going to be an interesting situation for some Safari users. "Why did your app delete my data?" "If you don't like that you should use Chrome." Of course Google could do this too, if they had a reason, even if only downstream from Chromium. It's just a commercial decision. Apple have decided they don't want their users to have usable anonymous web apps. Of course, since they don't support beforeinstallprompt, we already know they don't want their users to have web apps, period. Gotta get that sweet 30% cut!
- internalthief 7y agoI doubt that this is going to be an issue for applications using ReactNative or other solutions to package websites as applications. For applications that have you add it to your home screen using the app icon, it may be more of an issue, but why wouldn't you sync that data back up to the server?
- jessaustin 7y agoYes of course if you're running a business then you're getting users logged in ASAP. There are other models of software development, however. Even if you're in the commercial sector, some users may be less eager than others to sign up for your fine service. Should you preemptively suck in their data, whoops I mean back up their data, without telling them? It seems there could be several responses to that question... It's fine that Apple don't want to support this valid mode of app distribution and use. It is a valid mode, however.
- matsemann 7y agoJust FYI (If I'm reading you correctly): That's not how react native works. It's a native app, not a wrapped website.
- CodeCube 7y agoI suspect they just meant regular react
- dfabulich 7y agoThat is what it means. The only workaround is to require the user to login and to keep a backup of the data on your server.
- dillondoyle 7y agoThis is what we do. Store a 1st party httponly secure cookie jwt representing the user, then grab any extra data from the backend. Or just something like session cookie but persist it. I wouldn't be surprised if this is one of the ways ad tracking tries to rebuild a universal identifier like the old urchin module. Might not be as easy as a cname but those might get blocked. It's always a game of cat and mouse. Could place uuid as 1st party httponly cookie. maybe uuid is domain scoped. then 'echo out' so accessible by 3rd party JS. Like a hash, one would need to know the global pooled uuid already and then combined with knowable domain could tie that uuid into the 2nd party tracking pool.
- dfabulich 7y ago1st party httponly secure cookies will be erased in seven days. You need the user to manually provide an identifier (i.e. login) to avoid losing everything. The user's password safe is now the only non-volatile storage mechanism on Safari.
- johncolanduoni 7y agoThey explicitly say 1st party httponly secure cookies are exempt and are their first recommended alternative.
- shakna 7y ago> 1st party httponly secure cookies will be erased in seven days. httponly cookies can't be set from JS, and the seven day erasure only applies to cookies set from JS. That's why they're the recommended method for keeping a user logged in.
- tempestn 7y agoExactly. Which to me suggests this could result in more tracking rather than less. At AutoTempest we haven't even bothered to make user accounts thus far, since there's no reason why you should need an account to search for used cars, and we can store user preferences in cookies or localStorage. If those only persist for 7 days though, we're basically forced to have users create accounts and store their preferences on our servers, to avoid a poor user experience. Blocking 3rd party cookies I'm fully on board with, but I don't want first party cookies deleted unless I actually specify it. Fortunately as a user I can keep using Firefox, but since iOS is always going to be a large percentage of our users, there's not much choice on the provider side.
- untog 7y ago> after seven days of Safari use without user interaction on the site If it's a PWA that's regularly used you should be fine. But if not, yeah, that's going to be very annoying.
- cageface 7y agoIf this is really about protecting users and not about kneecapping web apps shouldn't Apple also wipe user data in native apps that haven't been used in a week?
- untog 7y agoNative apps don't really have the problem of third-party ad networks storing data intermixed with app data in this way, though.
- pspeter3 7y agoWhy not though? It seems like third-party SDKs could be included by the developer and stored on my local device.
- cageface 7y agoEvery iOS app I ever built for a client had Facebook's SDK and tracking installed, at the client's request. Often Google's and Twitter's too and the user has no awareness of this.
- detaro 7y agoThe regular reports about tracking in random advertising/... SDKs suggest otherwise
- sroussey 7y agoThey are much worse.
- progval 7y agoOutside privacy issues; visiting a website once shouldn't be enough for a website to store as much data as it wants on someone's computer. Installing a native app is a stronger form of opt-in than simply clicking an URL to a new website.
- doctoboggan 7y agoMy understanding was that yes, if the user doesn't interact with the site in 7 days then the stored data (in cookies and localStorage) will be deleted.
- koolba 7y agoIt’s the usual “this is why we can’t have nice things”. Anything persistent will be turned into a tracking cookie. So eventually everything becomes ephemeral.
- drdaeman 7y agoNot if there's a proper opt-in permission prompt, just like for GPS or camera/microphone access. It's not trivial, though, seeing how notification prompts were abused...
- currysausage 7y agoSites would just instruct users to accept permanent storage in exchange for free content.
- cutemonster 7y agoBut then why don't they already force visitors to accept push notifications?
- infotogivenm 7y agoIt is confusingly worded, but DOES NOT mean all browser storage mechanisms will break. The key phrase is “without user interaction”. Only e.g. invisible nested iframes that scammy ad companies love to use will have their localstorage limits affected. Top level frames are unchanged.
- infotogivenm 7y agoTo be clearer; this is a huge win for privacy/antitracking without any? real downsides. > “chrome will never have this” Indeed :)
- jahewson 7y agoI think you’ve also misread the original text: “seven days of Safari use without user interaction on the site” Does not mean that top-level frames are unaffected. Everybody is affected. They specifically call out first party storage as being misused currently. I think the correct interpretation is: Whenever the user interacts with your page then the clock gets reset to 7 days, also the clock only runs on days the user uses Safari.
- jessaustin 7y agoI hope you're right! Where TFA has: Now ITP has aligned the remaining script-writable storage forms with the existing client-side cookie restriction, deleting all of a website’s script-writable storage after seven days of Safari use without user interaction on the site. ...maybe "script-writable" should be "third-party-in-iframe-script-writable"? If so this document should be edited.
- vbezhenar 7y agoApple have to put restrictions on websites, otherwise users might break free from AppStore walled garden.
- alexcroox 7y agoDon’t they just mean the localstorage containers for other domains than the current one? Ie your normal app’s storage will be left untouched as it is currently but third party domain localstorage containers will be wiped?
- tpush 7y agoI might be misremembering, but didn’t Safari block third-party cookies by default before all this tracking protection stuff started?
- bouke 7y agoI was thinking the same, and a image search revealed the old preferences dialog for Safari: https://www.howtoisolve.com/wp-content/uploads/2014/12/Brower-setting-for-Cookies.jpg https://www.howtoisolve.com/wp-content/uploads/2014/12/Browe.... So yes; you could block third-party cookies before ITP was introduced. So it seems like they're now backtracking on ITP and just default to blocking third-party cookies by default? Although maybe ITP is still involved, as Google implemented workarounds to be able to set third-party cookies regardless of this Safari setting, costing Google $22.5M. https://www.ftc.gov/news-events/press-releases/2012/08/google-will-pay-225-million-settle-ftc-charges-it-misrepresented https://www.ftc.gov/news-events/press-releases/2012/08/googl...
- skrowl 7y agoSoooo... like Firefox has done be default since June 2019 then https://blog.mozilla.org/blog/2019/09/03/todays-firefox-blocks-third-party-tracking-cookies-and-cryptomining-by-default/ https://blog.mozilla.org/blog/2019/09/03/todays-firefox-bloc... ? I guess later is better than never, but this seems like something they could have done long ago.
- nydel 7y agoI really thought Firefox did all of this already too. I have no justification for not having truly checked. Hopefully other browsers from Safari will not be far behind. I hope that there might be a way to safely auto-sync my Firefox profile, bookmarks and history especially, to Safari iff it's really the more secure of the available browsers for iOS.
- detaro 7y agoThe blog post you reference clearly describes a limited blocklist. As the submission says, no other mainstream browser has blocked all third-party cookies yet.
- kstrauser 7y agoFrom the article: > Safari continues to pave the way for privacy on the web, this time as the first mainstream browser to fully block third-party cookies by default. As far as we know, only the Tor Browser has featured full third-party cookie blocking by default before Safari, but Brave just has a few exceptions left in its blocking so in practice they are in the same good place. We know Chrome wants this behavior too and they announced that they’ll be shipping it by 2022.
- deleted 7y ago[deleted]
- deleted 7y ago[deleted]
- danceparty 7y agoStill dreaming of a way to block cookies per-domain Edit: someone just told me you can do it with osx adguard, in the user rules you can set "||domain.com^$cookie" to block all cookies from domain.com
- Animats 7y agoI've had third party cookies blocked for years in Firefox. It doesn't break much.
- distances 7y agoExactly. I don't see why they should be allowed in the first place. I also block first-party cookies and while that does break more sites, it's still pretty manageable.
- chance_state 7y ago>I also block first-party cookies This is the front loaded approach which can cause breakage. I prefer the back loaded approach of using an extension like Cookie Auto Delete or similar that deletes cookies once you're away from a domain for a set amount of time (I think mine is set to 2 minutes).
- recursive 7y agoDo you use any sites which require any kind of authentication?
- distances 7y agoBy "manageable" I mean I'll allow them for the sites that need them. So yes, I do use sites with login.
- bradly 7y agoFirefox users can turn on privacy.firstparty.isolate which I believe will scope third party cookies to the top level domain you are on. It is off by default, but I've been using it for sometime without issue (except very persistent re-captcha).
- JeremyNT 7y agoThis is one approach, but you can avoid breakage by accepting cookies initially while enabling "clear cookies on exit." Combined with Firefox containers this works pretty well.
- quotemstr 7y agoSo much for the advertisement-powered web. Congratulations, privacy people: you win. I hope the new web is everything you hoped. If it isn't, you have only yourselves to blame. Enjoy the paywalls.
- nydel 7y agoWhat do you think the new web is going to be? Sincere. Not sure what you're talking about at all and would like to.
- quotemstr 7y agoI think the new web will be one made up of closed off islands that use strict paywalls to finance themselves. I also think the total amount of content will be lower and that the remaining platforms will more heavily skew towards "safe" guidelines.
- layoutIfNeeded 7y agoI don’t remember the internet being like that before invasive advertising and tracking took over...
- ficklepickle 7y agoIt won't go back to the early web, but it will certainly survive. Much like life, people find a way. If there is demand, innovators will find a way to meet it. The webs continued existence is not dependent on surveillance capitalism.
- quotemstr 7y ago> Much like life, people find a way. If there is demand, innovators will find a way to meet it. That's like saying that life is equally good and the US and North Korea because "people find a way" to work around problems. There's a real way in which economic inefficiencies reduce our standard of living. Making advertising worse on purpose is just a race to the bottom, all feel-good crusading without any end benefit to humanity. "But I won't be tracked!", the privacy people say. So what? What harm will you have prevented?
- sebastien_bois 7y ago> Safari continues to pave the way for privacy on the web, this time as the first mainstream browser to fully block third-party cookies by default Too bad Safari isn't my default browser anymore, ever since they essentially killed it when they neutered extensions.
- doctoboggan 7y agoI initially felt the same way, as I relied on ublock origin, but the loss of that extension forced me to switch to pihole, which I think is an overall better approach to ad blocking. It works for all devices on your network, so you get ad blocking on devices that you normally wouldn't like your smart tv and the apple news app.
- bouke 7y agoNeutering extensions was necessary as they were a major privacy problem in itself. Most extensions would inject themselves in any page, having access to everything on such sites; for example your bank login, credit card transaction details, private FB messages, Gmail etc.
- etaioinshrdlu 7y agoIs there any legitimate reason Chrome doesn't follow suit other than they like ad revenue? An answer from a Googler here would be great. And a real answer, not corp-speak. Blocking third party cookies seems like overall a good thing for security. Security is good right? Edit: 2 years is a long time to wait for a security improvement that is literally flipping a switch.
- twiceaday 7y agoJanuary this year Chrome committed to phasing out third party cookies by '22.
- TwoBit 7y agoLong enough from now that we'll forget, in case they conclude they can't do it without jeopardizing ad revenue.
- msoad 7y agoAlex Russel and friends love to bash Safari for lack of PWA support but are mute when it comes to things Google does to Chrome that doesn't benefit (or ever harm) the user and only benefit $GOOG.
- jefftk 7y agoI'm a Googler who works in ads, speaking only for myself. If Chrome blocked third party cookies today we'd see something between these two outcomes: a) Publishers lose about half their revenue because ads aren't personalized anymore: https://services.google.com/fh/files/misc/disabling_third-party_cookies_publisher_revenue.pdf https://services.google.com/fh/files/misc/disabling_third-pa... b) Advertisers figure out how to keep personalizing ads through fingerprinting (non-cookie tracking) Since (b) is worse than the status quo (users can't reset their fingerprint) I think "a security improvement that is literally flipping a switch" doesn't fit. Chrome's approach (as described in https://blog.chromium.org/2020/01/building-more-private-web-path-towards.html https://blog.chromium.org/2020/01/building-more-private-web-...) is: * Block fingerprinting * Figure out how to let advertisers personalize in privacy preserving ways (https://www.chromium.org/Home/chromium-privacy/privacy-sandbox https://www.chromium.org/Home/chromium-privacy/privacy-sandb... primarily FLoC and TURTLE-DOV) * Then remove cookies I'm skeptical about the approach, since I think blocking fingerprinting and server-side correlation of requests is very difficult, but I think the people working on this are very good and have thought a lot more about it than I have.
- osrec 7y agoRather than wiping indexed DB data after 7 days, could you not just make it an opt in thing, like the camera or mic? For example, ask users "Allow myapp.com to store app related data on your computer?". If they allow it, then give access to indexed DB API. That way we can still have fully local PWAs.
- fomojola 7y agoThe 7-Day Cap on All Script-Writeable Storage is troublesome: if I don't log into a computer for a week 'cause I'm on vacation then you wipe my saved data? I have local storage based utilities I've written that I sometimes don't touch for weeks, but whenever I go back everything I put in there is STILL THERE. Seems like a great way to drive less use of local browser storage options and promote greater use of cloud storage solutions. Cynical me says "YAY iCloud".
- om2 7y agoThe day count is days of active browser use, not calendar days, so what you describe is unlikely.
- fomojola 7y agoAh, that would be an improvement: just re-read the article and I can't find any reference to "active use" vs "calendar". Can you point out where that is?
- Flenser 7y agoI think om2 means this from the article: "seven days of Safari use without user interaction on the site" It's not immediately obvious the way it's phrased but they couldn't be calendar days if there are days you don't use Safari; it's only counting a day as one where Safari is used and you don't visit the site.
- franciscop 7y ago> this time as the first mainstream browser to fully block third-party cookies by default Third party cookies have been blocked in Firefox since September 3rd (2019) [1]. They mention Brave in the article, so surely Firefox being large than Brave should be included in "Major browsers", but not a single mention was made in the article. It really reminds me of the meme "what do you mean you've seen it?". [1] https://blog.mozilla.org/blog/2019/09/03/todays-firefox-blocks-third-party-tracking-cookies-and-cryptomining-by-default/ https://blog.mozilla.org/blog/2019/09/03/todays-firefox-bloc...
- detaro 7y agoBlocking cookies from a blocklist of "trackers" as your link clearly describes is not the same as disabling them completely.
- js2 7y agoYou know what I'd really like from Apple: a per-site option for disabling JavaScript and another for blocking even first-party cookies.
- scarface74 7y agoThe number of people who care about blocking Javascript in 2020 is minuscule.
- mikro2nd 7y agoMiniscule, and growing. That site that shouted at me that I'm filthy lowlife scum for running an adblocker? Pphhht. JS disabled; nastiness averted.
- SquareWheel 7y agoIt wouldn't be that difficult to build a JS-free version of the same nag. If global JS support somehow goes down, the nags will just adapt.
- toxik 7y agoI completely disabled Javascript. I just use another browser when I really need it, turns out that 90% of things I need javascript for, I can just not use. It’s even helped my productivity.
- ganzuul 7y agoThe list of addons I consider essential for privacy just keeps growing. Here is another great addition: https://github.com/Cookie-AutoDelete/Cookie-AutoDelete https://github.com/Cookie-AutoDelete/Cookie-AutoDelete Does what it says on the tin.
- cies 7y agoWhat's more on yr list?
- techslave 7y agomeh. i mean ok yes this does kill the tracking (although i can imagine how to be more devious) but i already very easily do this with ghostery. i suppose it’s great for the 90% of “default settings” users. because a solution (many) is already available for tracker blocking , i’d rather see effective html5 video and popup blocking. is that infeasible?