4 ms·

In my opinion, the SOP is a bad/broken solution for the problem it tries to fix. The problem are browsers, using the authentication from another origin when doi

In my opinion, the SOP is a bad/broken solution for the problem it tries to fix. The problem are browsers, using the authentication from another origin when doing cross-origin requests. The SOP tries to fix it by disallowing certain cross-origin requests. But the problem aren't cross-origin requests. The problem is using the authentication/state of another origin during cross-origin requests.

andrewla 6y ago
Exactly -- the context under which a resource should be fetched from a remote should be strictly scoped to the origin. Remote fetches should never use any information from the remote site as a top-level context. That is, if I navigate to foo.com which serves an image from bar.com, bar.com can set cookies, etc., and on future visits to foo.com the foo.com->bar.com context should be used. But if I go to hat.com and it serves an image from bar.com, none of the foo.com->bar.com context should be used, only the hat.com->bar.com context. Disabling third party cookies gets you maybe 60% of this, but we need to keep going, disabling all caches, etc., except as tied to the context of interest. It's probably also time to get rid of the idea of "visited" for a link and similar features that use global information rather than information scoped to the currently visited site. And, of course, eternal vigilance against browser fingerprinting attacks. Since this would cripple a fair share of targeted advertising, we might not see this appearing in Chrome (although they do offer third-party-cookie-blocking, so there's that), but we should definitely see it in Firefox.
- Macha 6y ago
  I think First Party Isolation (available by default in Tor browser and via a about:config flag in Firefox) is this feature?
  - andrewla 6y ago
    Neat -- this looks like exactly it. Maybe it's time to make the switchover.
  - the_duke 6y ago
    Exactly. I've used this for over a year now in FF. It can be a bit annoying with things like recaptcha, and sadly some login systems completely break (like Atlassian SSO), but overall most things work just fine.
    - kiliancs 6y ago
      Also many sites claim I'm blocking their ads, and sometimes they attempt to prevent me from continue using the site.
      - pmontra 6y ago
        If it's a blog or equivalent, with content served in HTML, you can disable JavaScript for that site. The page loads faster, as if we were 20 years back in time and the adblock check doesn't happen. uBlock Origin and uMatrix can do that. If the content is served by JavaScript, sorry.
    - inetknght 6y ago
      > Atlassian SSO Atlassian products are garbage for many reasons. But this is literally #1 for me. It's 100% unusable in a securified browser.
- hunter2_ 6y ago
  That sounds quite a bit like the double-keyed cache partitioning that has been in Safari since 2013, Chrome since 2020, and is being considered for Firefox. e.g.: https://blog.josephscott.org/2019/10/16/prepare-for-fewer-cache-hits-as-chrome-partitions-their-http-cache/ https://blog.josephscott.org/2019/10/16/prepare-for-fewer-ca... https://dev.to/zwacky/time-to-say-goodbye-to-google-fonts-16dd https://dev.to/zwacky/time-to-say-goodbye-to-google-fonts-16... etc. This is not the exact same thing as what you're describing, but I'd say it's along the same trajectory (i.e., there's hope).
- jopsen 6y ago
  According to MDN SameSite=Lax is default. Isn't that exactly this behavior? https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Se...
  - andrewla 6y ago
    This is voluntary on the cookie-setter's part. There should be no way to override it. Also, it only applies to cookies, which are already covered under the disallow third-party cookie umbrella.

andrewla 6y ago

Exactly -- the context under which a resource should be fetched from a remote should be strictly scoped to the origin. Remote fetches should never use any information from the remote site as a top-level context. That is, if I navigate to foo.com which serves an image from bar.com, bar.com can set cookies, etc., and on future visits to foo.com the foo.com->bar.com context should be used. But if I go to hat.com and it serves an image from bar.com, none of the foo.com->bar.com context should be used, only the hat.com->bar.com context. Disabling third party cookies gets you maybe 60% of this, but we need to keep going, disabling all caches, etc., except as tied to the context of interest. It's probably also time to get rid of the idea of "visited" for a link and similar features that use global information rather than information scoped to the currently visited site. And, of course, eternal vigilance against browser fingerprinting attacks. Since this would cripple a fair share of targeted advertising, we might not see this appearing in Chrome (although they do offer third-party-cookie-blocking, so there's that), but we should definitely see it in Firefox.

Macha 6y ago
I think First Party Isolation (available by default in Tor browser and via a about:config flag in Firefox) is this feature?
- andrewla 6y ago
  Neat -- this looks like exactly it. Maybe it's time to make the switchover.
- the_duke 6y ago
  Exactly. I've used this for over a year now in FF. It can be a bit annoying with things like recaptcha, and sadly some login systems completely break (like Atlassian SSO), but overall most things work just fine.
  - kiliancs 6y ago
    Also many sites claim I'm blocking their ads, and sometimes they attempt to prevent me from continue using the site.
    - pmontra 6y ago
      If it's a blog or equivalent, with content served in HTML, you can disable JavaScript for that site. The page loads faster, as if we were 20 years back in time and the adblock check doesn't happen. uBlock Origin and uMatrix can do that. If the content is served by JavaScript, sorry.
  - inetknght 6y ago
    > Atlassian SSO Atlassian products are garbage for many reasons. But this is literally #1 for me. It's 100% unusable in a securified browser.
hunter2_ 6y ago
That sounds quite a bit like the double-keyed cache partitioning that has been in Safari since 2013, Chrome since 2020, and is being considered for Firefox. e.g.: https://blog.josephscott.org/2019/10/16/prepare-for-fewer-cache-hits-as-chrome-partitions-their-http-cache/ https://blog.josephscott.org/2019/10/16/prepare-for-fewer-ca... https://dev.to/zwacky/time-to-say-goodbye-to-google-fonts-16dd https://dev.to/zwacky/time-to-say-goodbye-to-google-fonts-16... etc. This is not the exact same thing as what you're describing, but I'd say it's along the same trajectory (i.e., there's hope).
jopsen 6y ago
According to MDN SameSite=Lax is default. Isn't that exactly this behavior? https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Se...
- andrewla 6y ago
  This is voluntary on the cookie-setter's part. There should be no way to override it. Also, it only applies to cookies, which are already covered under the disallow third-party cookie umbrella.