5 ms·

> increasingly unethical and invasive fingerprinting techniques to remain competitive. ... or serve cookies via first-party subdomain ... Also, hasn't Safari

> increasingly unethical and invasive fingerprinting techniques to remain competitive. ... or serve cookies via first-party subdomain ... Also, hasn't Safari already killed third party cookies?

jay_kyburz 6y ago
Then the advertisers need to trust the first parties.
- adriancr 6y ago
  or the subdomain goes to an advertiser server.
  - hashkb 6y ago
    Yeah... we're all too lazy to relay our data through our own backends. I recommend this to clients but there's always some killer analytics feature that requires the JS integration.
  - jay_kyburz 6y ago
    Oh, I didn't realize a subdomain was not considered 3rd party. So soon we'll see adnetwork.mydomain.com and www.mydomain.com. I think we should just make cookies only work when the domain matches exactly.
    - devlopr 6y ago
      You would see mydomain.com/adnetwork then.
      - jay_kyburz 6y ago
        Can browsers look up a different server addresses to send requests to that way? I didn't think that's how DNS worked but I'm no expert. Advertisers can't trust content people to forward requests because it would be too easy to fake them.
        mikeiz404 6y ago
        No I don’t think so. DNS only works on the domain part of the url. However a server like nginx can be set up to proxy requests matching a specific url pattern to another server. This would be a bit more work than adding a DNS entry and referencing that though.
        adriancr 6y ago
        Or setup cdn to redirect certain paths to the adserver and mark those paths as nocache
      - kmeisthax 6y ago
        The reason why subdomains work is that you can make the root domain go to your own site, while the subdomain goes to your ad provider. If you use a CNAME it's literally just a matter of publishing another DNS recod and you're done. Moving to a subdirectory requires setting up a reverse proxy on your existing infrastructure, and keeping it up to date every time your ad network switches domains. Hell, on a lot of platforms you don't even have the ability to reconfigure the server in such a way as to proxy through an entire ad network, so you'll have to use a platform or technology specific plugin if available. That's why the ad industry used third-party domains in the first place, BTW - it's a zero-setup solution. Subdomains are minimal-setup; subdirectories are a huge hassle.
        ComodoHacker 6y ago
        >That's why the ad industry used third-party domains in the first place Another reason is ad provider doesn't have to trust first party, if ads are served from their server. I'm not sure which reason is more important.
        devlopr 6y ago
        You wouldn't need to. Let's say they gave you a php script (any server side processing language) you could place it anywhere and it would download new ad content and show it as a first party ad. Easier than changing a cname.
Animats 6y ago
I haven't had third party cookies enabled in Firefox for a decade. Google is coming late to this.
- deleted 6y ago
  [deleted]
- aqfamnzc 6y ago
  I hear this argument a lot. Yes, you can turn off third party cookies, and I have as well, but the power to control the default behavior is very important. What we should be asking ourselves is "Does the average user turn off third party cookies?" This is the same reason Facebook is throwing such a fit over apple's new prompt. It makes it easy and likely for the average user to disable something without having to dig through settings.
beagle3 6y ago
How do advertisers reconcile cloaked first party subdomains? It requires fingerprinting, or the first party to tell the real 3rd party (cloaked as a first party) things like email or real name, that can be cross referenced, no?
- dwaite 6y ago
  Yes, that is generally how they resolve it. Apple has started to reduce the effectiveness of CNAME cloaking. The goal is that advertisers will eventually be far better off working with a system like Private Click Measurement (in Safari betas now and set to be in next releases) than insecure things like CNAME cloaking.
ogre_codes 6y ago
Yup. Google is lagging everyone else on this issue because it'll hit their advertising income.
lmkg 6y ago
Google's identity signal that they have given themselves access to works across cross-domain and cross-device. First-party cookies do neither. I would strongly prefer that everyone restrict themselves to the capabilities of first-party cookies. But it's still true that Google is not holding themselves to the same restrictions that they're trying to enforce on other parties.
nr2x 6y ago
The things people don't know about third-party Javascript and "first-party" cookies...
- aabhay 6y ago
  How would third party JavaScript fingerprint users? Only if there’s a backend data broker aggregating identities based on a universal token (e.g. email). Or one of those super shady tech wizardry techniques like timing OpenGL calls.

> increasingly unethical and invasive fingerprinting techniques to remain competitive. ... or serve cookies via first-party subdomain ... Also, hasn't Safari already killed third party cookies?

jay_kyburz 6y ago

Then the advertisers need to trust the first parties.

adriancr 6y ago
or the subdomain goes to an advertiser server.
- hashkb 6y ago
  Yeah... we're all too lazy to relay our data through our own backends. I recommend this to clients but there's always some killer analytics feature that requires the JS integration.
- jay_kyburz 6y ago
  Oh, I didn't realize a subdomain was not considered 3rd party. So soon we'll see adnetwork.mydomain.com and www.mydomain.com. I think we should just make cookies only work when the domain matches exactly.
  - devlopr 6y ago
    You would see mydomain.com/adnetwork then.
    - jay_kyburz 6y ago
      Can browsers look up a different server addresses to send requests to that way? I didn't think that's how DNS worked but I'm no expert. Advertisers can't trust content people to forward requests because it would be too easy to fake them.
      - mikeiz404 6y ago
        No I don’t think so. DNS only works on the domain part of the url. However a server like nginx can be set up to proxy requests matching a specific url pattern to another server. This would be a bit more work than adding a DNS entry and referencing that though.
        adriancr 6y ago
        Or setup cdn to redirect certain paths to the adserver and mark those paths as nocache
    - kmeisthax 6y ago
      The reason why subdomains work is that you can make the root domain go to your own site, while the subdomain goes to your ad provider. If you use a CNAME it's literally just a matter of publishing another DNS recod and you're done. Moving to a subdirectory requires setting up a reverse proxy on your existing infrastructure, and keeping it up to date every time your ad network switches domains. Hell, on a lot of platforms you don't even have the ability to reconfigure the server in such a way as to proxy through an entire ad network, so you'll have to use a platform or technology specific plugin if available. That's why the ad industry used third-party domains in the first place, BTW - it's a zero-setup solution. Subdomains are minimal-setup; subdirectories are a huge hassle.
      - ComodoHacker 6y ago
        >That's why the ad industry used third-party domains in the first place Another reason is ad provider doesn't have to trust first party, if ads are served from their server. I'm not sure which reason is more important.
      - devlopr 6y ago
        You wouldn't need to. Let's say they gave you a php script (any server side processing language) you could place it anywhere and it would download new ad content and show it as a first party ad. Easier than changing a cname.

Animats 6y ago

I haven't had third party cookies enabled in Firefox for a decade. Google is coming late to this.

deleted 6y ago
[deleted]
aqfamnzc 6y ago
I hear this argument a lot. Yes, you can turn off third party cookies, and I have as well, but the power to control the default behavior is very important. What we should be asking ourselves is "Does the average user turn off third party cookies?" This is the same reason Facebook is throwing such a fit over apple's new prompt. It makes it easy and likely for the average user to disable something without having to dig through settings.

beagle3 6y ago

How do advertisers reconcile cloaked first party subdomains? It requires fingerprinting, or the first party to tell the real 3rd party (cloaked as a first party) things like email or real name, that can be cross referenced, no?

dwaite 6y ago
Yes, that is generally how they resolve it. Apple has started to reduce the effectiveness of CNAME cloaking. The goal is that advertisers will eventually be far better off working with a system like Private Click Measurement (in Safari betas now and set to be in next releases) than insecure things like CNAME cloaking.

ogre_codes 6y ago

Yup. Google is lagging everyone else on this issue because it'll hit their advertising income.

lmkg 6y ago

Google's identity signal that they have given themselves access to works across cross-domain and cross-device. First-party cookies do neither. I would strongly prefer that everyone restrict themselves to the capabilities of first-party cookies. But it's still true that Google is not holding themselves to the same restrictions that they're trying to enforce on other parties.

nr2x 6y ago

The things people don't know about third-party Javascript and "first-party" cookies...

aabhay 6y ago
How would third party JavaScript fingerprint users? Only if there’s a backend data broker aggregating identities based on a universal token (e.g. email). Or one of those super shady tech wizardry techniques like timing OpenGL calls.