3 ms·
Trying my best! This is really confusing stuff, and I probably shouldn't have come out so hot with "This is false." Safari's rollout of ITP broke my company's
by thrwwy0304 6y ago
Trying my best! This is really confusing stuff, and I probably shouldn't have come out so hot with "This is false." Safari's rollout of ITP broke my company's code three times over, so I've been in the weeds on this for a while.
I think you're missing that setting cookies alone isn't what allowed evil.com to sync identities. They needed to set the cookie from one site, and receive that same cookie when the user visited a different site.
With CNAME cloaking, it's true that EvilCo can set cookies on both evil.foo.com and evil.bar.com. But when a user is on evil.foo.com, there's no way to make a request to evil.bar.com that includes evil.bar.com's cookies. This is the mechanism that stops syncing identities.
Does that help?
- jrochkind1 6y agoOK, so here's the basic issue. What did banning third-party cookies actually stop then? Nothing? So whatever they were able to do before banning third-party cookies, why did banning third-party cookies matter at all? The whole point of the CNAME as described is to get around third-party cookie bans. If getting around the third-party cookie ban doesn't actually help -- that seems to suggest the third-party cookie ban in the first place didn't actually do anything, if getting around it doesn't give you anything? no?
- thrwwy0304 6y agoIt stopped syncing identities with the first-class web APIs, and forced trackers to use browser fingerprinting. That _does_ help. It adds noise to things and helps us shift our focus to stopping fingerprinting.