7 ms·

Chrome ‘Bug’ Exempts Google Cookies from Data Privacy Settings

174 points by betaman0 6y ago

subprotocol 6y ago
FTA- "We are aware of a bug in Chrome that is impacting how cookies are cleared on some first-party Google websites. We are investigating the issue, and plan to roll out a fix in the coming days."
DLA 6y ago
So shocked. Funny how bugs, errors, omissions, and “mistakes” so often benefit the entity making them lately.
- rathel 6y ago
  And often the damage is already done. Cf. AARD code which was only in Windows 3.1 beta
  - swiley 6y ago
    Wow. Compared to what Apple and Google today that's so tame, but it was handled seriously by the government.
jsnell 6y ago
Dupe. Previous discussion: https://news.ycombinator.com/item?id=24817304 https://news.ycombinator.com/item?id=24817304 https://news.ycombinator.com/item?id=24837404 https://news.ycombinator.com/item?id=24837404 https://news.ycombinator.com/item?id=24856402 https://news.ycombinator.com/item?id=24856402
- afrcnc 6y ago
  What's missing from those links is that this was clearly a bug and was already fixed. This just surfaces in cycles from bloggers who can't be bothered to check their articles for outdated info.
  - magicalist 6y ago
    From deep in one of those previous threads, the fix was https://chromium.googlesource.com/chromium/src.git/+/f800edbd1b50ecc13a0d3391f5f45ba9c84625be%5E%21/ https://chromium.googlesource.com/chromium/src.git/+/f800edb...
    - _qulr 6y ago
      It appears to be only partly fixed: https://news.ycombinator.com/item?id=25144791 https://news.ycombinator.com/item?id=25144791
  - reaperducer 6y ago
    bloggers who can't be bothered to check their articles for outdated info. Accurate, timely information doesn't generate clicks. Outrage pays. These days it seems like 70% of the links on HN are rando bloggers trying to make tech nerds angry for fun and profit.
  - bgdam 6y ago
    Isn't this just partially fixed? I believe google.com cookies are still exempt in the current latest release.
falcolas 6y ago
Any followup to this, since the original story is from back in October? Namely, has Google fixed their 'bug'?
- _qulr 6y ago
  It appears to be partly fixed, partly unfixed. Specifically, youtube.com seems to have been fixed in Chrome 86.0.4240.111 on October 20, soon after this went "viral", but google.com remains unfixed in the latest Chrome 87.0.4280.66
wikus 6y ago
It's crazy that even though this came out a while ago, it STILL has not been fixed. Nasty practice by Google. And I do not for a second believe that a bug caused this LOL. Come on...
- shadowgovt 6y ago
  It's fixed for YouTube. And the way the big was introduced is now well-understood.
ars 6y ago
Chrome is open source, right? So can we see the bug and judge if it really does seem like an innocent bug?
- magicalist 6y ago
  > Chrome is open source, right? So can we see the bug and judge if it really does seem like an innocent bug? Not sure what the sibling comments are talking about. The bug fix[1] links the original change that introduced the bug[2]. [1] https://chromium.googlesource.com/chromium/src.git/+/f800edbd1b50ecc13a0d3391f5f45ba9c84625be%5E%21/ https://chromium.googlesource.com/chromium/src.git/+/f800edb... [2] https://chromium-review.googlesource.com/c/chromium/src/+/2181827 https://chromium-review.googlesource.com/c/chromium/src/+/21...
  - CGamesPlay 6y ago
    Thanks for digging this up! It only addresses the YouTube half, but if memory serves the Google half is due to a mandatory deep integration between browser profiles and Google cookies. I'm unclear if they classified that one as a "bug" (not that it really matters since they use custom HTTP headers to implement tracking for google properties).
- ralph87 6y ago
  Chrome is not open source, it's a derived proprietary superset of the open source Chromium. They are not the same thing in very material ways
  - judge2020 6y ago
    Only a few things are different in Chrome. Notably, it has the ability to send crash reports and metrics, play proprietary audio codecs, some Google API keys are added (eg. safe browsing, speech, web store), and the Widevine component to enable DRM. Nothing is different in the core code of the browser. https://chromium.googlesource.com/chromium/src/+/master/docs/chromium_browser_vs_google_chrome.md https://chromium.googlesource.com/chromium/src/+/master/docs...
princevegeta89 6y ago
What other browsers can you guys recommend that support Linux and have cloud sync capabilities? I'm currently eyeing Opera and brave but wanted to see if I have more options. Thanks.
- johnlorentzson 6y ago
  Firefox is far from perfect but it seems to be the best thing out there for now.
- agiroth 6y ago
  Additional vote for Firefox. Lately it's been less buggy for me than Chrome even.
- wikus 6y ago
  Another vote for Firefox. Seems to be the best option out there IMO.
- Jorengarenar 6y ago
  Firefox?
- effingwewt 6y ago
  Funny I would have recommended firefox about a year ago, its hot garbage now. They destroyed the UI and user flow, destroyed bookmarks and downloading from browser recently. Hot. Mess. Also mighty fishy 3 new accts created to say the exact same thing at the same time, especially as it's no longer truly viable IMO. Just the other day I posted an ask hn about how to export saved login data/bookmarks from firefox which used to be easy as could be- they have now completely removed the capability. Firefox is now run by MBAs and is the new IBM. As for an alternative fennec seems to be a close fork and is available on f droid.
  - rorykoehler 6y ago
    And another vote for Firefox. It is way better than Chrome atm.
yuhong 6y ago
https://www.clickz.com/doubleclick-and-google-part-2-the-reality/ https://www.clickz.com/doubleclick-and-google-part-2-the-rea... (2008): "The Google Pack software partner programs may suddenly treat DoubleClick cookies less harshly than those from other tracking services. "
mrtweetyhack 6y ago
It was a feature until it was discovered
anaganisk 6y ago
Everytime a chrome thread comes up I love putting this quote up from a chrome dev here on HN "We put a lot of thought in the APIs we implement you can trust us to do the right thing."

174 points by betaman0 6y ago

FTA- "We are aware of a bug in Chrome that is impacting how cookies are cleared on some first-party Google websites. We are investigating the issue, and plan to roll out a fix in the coming days."

DLA 6y ago

So shocked. Funny how bugs, errors, omissions, and “mistakes” so often benefit the entity making them lately.

rathel 6y ago
And often the damage is already done. Cf. AARD code which was only in Windows 3.1 beta
- swiley 6y ago
  Wow. Compared to what Apple and Google today that's so tame, but it was handled seriously by the government.

jsnell 6y ago

Dupe. Previous discussion: https://news.ycombinator.com/item?id=24817304 https://news.ycombinator.com/item?id=24817304 https://news.ycombinator.com/item?id=24837404 https://news.ycombinator.com/item?id=24837404 https://news.ycombinator.com/item?id=24856402 https://news.ycombinator.com/item?id=24856402

afrcnc 6y ago
What's missing from those links is that this was clearly a bug and was already fixed. This just surfaces in cycles from bloggers who can't be bothered to check their articles for outdated info.
- magicalist 6y ago
  From deep in one of those previous threads, the fix was https://chromium.googlesource.com/chromium/src.git/+/f800edbd1b50ecc13a0d3391f5f45ba9c84625be%5E%21/ https://chromium.googlesource.com/chromium/src.git/+/f800edb...
  - _qulr 6y ago
    It appears to be only partly fixed: https://news.ycombinator.com/item?id=25144791 https://news.ycombinator.com/item?id=25144791
- reaperducer 6y ago
  bloggers who can't be bothered to check their articles for outdated info. Accurate, timely information doesn't generate clicks. Outrage pays. These days it seems like 70% of the links on HN are rando bloggers trying to make tech nerds angry for fun and profit.
- bgdam 6y ago
  Isn't this just partially fixed? I believe google.com cookies are still exempt in the current latest release.

falcolas 6y ago

Any followup to this, since the original story is from back in October? Namely, has Google fixed their 'bug'?

_qulr 6y ago
It appears to be partly fixed, partly unfixed. Specifically, youtube.com seems to have been fixed in Chrome 86.0.4240.111 on October 20, soon after this went "viral", but google.com remains unfixed in the latest Chrome 87.0.4280.66

wikus 6y ago

It's crazy that even though this came out a while ago, it STILL has not been fixed. Nasty practice by Google. And I do not for a second believe that a bug caused this LOL. Come on...

shadowgovt 6y ago
It's fixed for YouTube. And the way the big was introduced is now well-understood.

ars 6y ago

Chrome is open source, right? So can we see the bug and judge if it really does seem like an innocent bug?

magicalist 6y ago
> Chrome is open source, right? So can we see the bug and judge if it really does seem like an innocent bug? Not sure what the sibling comments are talking about. The bug fix[1] links the original change that introduced the bug[2]. [1] https://chromium.googlesource.com/chromium/src.git/+/f800edbd1b50ecc13a0d3391f5f45ba9c84625be%5E%21/ https://chromium.googlesource.com/chromium/src.git/+/f800edb... [2] https://chromium-review.googlesource.com/c/chromium/src/+/2181827 https://chromium-review.googlesource.com/c/chromium/src/+/21...
- CGamesPlay 6y ago
  Thanks for digging this up! It only addresses the YouTube half, but if memory serves the Google half is due to a mandatory deep integration between browser profiles and Google cookies. I'm unclear if they classified that one as a "bug" (not that it really matters since they use custom HTTP headers to implement tracking for google properties).
ralph87 6y ago
Chrome is not open source, it's a derived proprietary superset of the open source Chromium. They are not the same thing in very material ways
- judge2020 6y ago
  Only a few things are different in Chrome. Notably, it has the ability to send crash reports and metrics, play proprietary audio codecs, some Google API keys are added (eg. safe browsing, speech, web store), and the Widevine component to enable DRM. Nothing is different in the core code of the browser. https://chromium.googlesource.com/chromium/src/+/master/docs/chromium_browser_vs_google_chrome.md https://chromium.googlesource.com/chromium/src/+/master/docs...

princevegeta89 6y ago

What other browsers can you guys recommend that support Linux and have cloud sync capabilities? I'm currently eyeing Opera and brave but wanted to see if I have more options. Thanks.

johnlorentzson 6y ago
Firefox is far from perfect but it seems to be the best thing out there for now.
agiroth 6y ago
Additional vote for Firefox. Lately it's been less buggy for me than Chrome even.
wikus 6y ago
Another vote for Firefox. Seems to be the best option out there IMO.
Jorengarenar 6y ago
Firefox?
effingwewt 6y ago
Funny I would have recommended firefox about a year ago, its hot garbage now. They destroyed the UI and user flow, destroyed bookmarks and downloading from browser recently. Hot. Mess. Also mighty fishy 3 new accts created to say the exact same thing at the same time, especially as it's no longer truly viable IMO. Just the other day I posted an ask hn about how to export saved login data/bookmarks from firefox which used to be easy as could be- they have now completely removed the capability. Firefox is now run by MBAs and is the new IBM. As for an alternative fennec seems to be a close fork and is available on f droid.
- rorykoehler 6y ago
  And another vote for Firefox. It is way better than Chrome atm.

yuhong 6y ago

https://www.clickz.com/doubleclick-and-google-part-2-the-reality/ https://www.clickz.com/doubleclick-and-google-part-2-the-rea... (2008): "The Google Pack software partner programs may suddenly treat DoubleClick cookies less harshly than those from other tracking services. "

mrtweetyhack 6y ago

It was a feature until it was discovered

anaganisk 6y ago

Everytime a chrome thread comes up I love putting this quote up from a chrome dev here on HN "We put a lot of thought in the APIs we implement you can trust us to do the right thing."