2 ms·
What's said is that query on CNAME returns the resolved address of evil.com, not "evil.com" as a name that needs to be further resolved. Isn't cookie validity
by fluidcruft 6y ago
What's said is that query on CNAME returns the resolved address of evil.com, not "evil.com" as a name that needs to be further resolved.
Isn't cookie validity selected by the site? A diligent site could setup subdomains to isolate the tracking cookines. Say, .awesome.example.org rather than .example.org. tracking-you.example.org wouldn't match anymore. But then it's a third-party cookie again and ad-block could just keep cookie whitelists for .awesome.example.org and throw any other .example.org cookies out.
- tinus_hn 6y agoIt doesn’t work like this. Cookie domains, like cookie paths, are not a security feature because scripts in documents can manipulate other documents that are considered by the browser to have the same origin. A site can’t change the origin rules, the origin for both ‘awesome.example.org’ and ‘tracking-you.example.org’ both is example.org .
- fluidcruft 6y agoYeah, exactly. awesome.example.org is the example.org site's code and tracking-you.example.org is evil.com's code.