5 ms·

> Third party cookies, love them or hate them, have been with us for a long time, and simply dropping them would not be viable without the long phase out. Not

by tomxor 6y ago

> Third party cookies, love them or hate them, have been with us for a long time, and simply dropping them would not be viable without the long phase out. Not true, FireFox and Safari have had them off by default for over a year now. Additionally Chrome had planned to turn them off last year but then cried "covid" which for some reason = delay... because... think of the adverts! i mean covid! Anyway, I'm pretty sure any large websites relying on 3rd party cookies for functionality will have already experienced users blocking issues. We have and have already been forced to change, we don't do ads, but our use case is a bit esoteric in that it needed 3rd party cookies for sessions.

hirsin 6y ago
Care to reach out? This username at Microsoft. We're working to understand what legitimate use cases are broken without 3p cookies so we can work with Google to backfill them. FLOC helps ad trackers track but doesn't help with any of the legitimate uses of 3p cookies like auth.
- pabs3 6y ago
  Auth should be doable with just redirects though right? Isn't that how OAuth and OpenID connect work?
  - catlifeonmars 6y ago
    Same thought. I’m curious to know what other kinds of authentication protocols require third-party cookies to operate. Within OIDC, even more obscure/advanced features such as session management and global logout require only 1st party (the IdPs) cookies in order to function. I guess the tradeoff being made here is just leaning into our reliance on the certificate authority system. Whereas before, with third party cookies, you might have had more flexibility with how you structure your domains.
    - hirsin 6y ago
      The implicit grant, while deprecated, is still used across the ecosystem. Further, embedded apps (eg you have a portal that iframes Salesforce and Salesforce needs to be authenticated) can't redirect to the login page or open that iframe for cookies. Front channel logout is also broken, part of the OIDC spec. It opens iframes to sites, but the sites don't get their cookies and can't write them.
  - om2 6y ago
    OAuth sometimes is done using an iframe and a pop-up window instead of by navigating to the federated auth provider and back. That version often needs third party cookies.
- livre 6y ago
  Since you seem to work for Microsoft, the broken use case I know: without 3p cookies Microsoft Teams is broken (it shows a not very useful error page asking to refresh the page, when you do it shows the same error again). Many of us need it for remote work so I guess this one of the things Google had in mind when they delayed disabling 3p cookies by default.
  - hirsin 6y ago
    Yes, Teams relies on silent auth from within an iframe (all those chat windows etc). This is impossible without 3p cookies, so we're working with Google to find a solution. Storage access API in Safari works, but sounds like it won't make it to Chrome.
    - livre 6y ago
      Thanks, nice to know you are working on it.
jffry 6y ago
Sure, I suppose all that (waves hand at third-party cookies situation) is what I meant by the long phase out of them. As far as I can recall those defaults were signaled a fair amount of time in advance. I have sympathy for anybody with a legitimate use for third-party cookies whose life has been made more difficult by bad actors abusing features to maximise their own profits. Same tragedy that finally caused origin-based cache partitioning at the expense of some performance.
surround 6y ago
> Not true, FireFox and Safari have had them off by default for over a year now. Not quite. They will block some 3rd party tracking cookies that fall on their tracking blacklist. If you want to block all 3rd party cookies you have to explicitly disable them.
- om2 6y ago
  Safari does actually block all third party cookies by default, not just a subset. And has been doing so for about a year now.
  - mk81 6y ago
    If I understand correctly, they allow 3rd-party cookies but delete them at the end of the browsing session rather than respecting the expiry.
propogandist 6y ago
this is the same execuse facebook's been using, although they're trying to push the narrative that limited tracking in Apple's iOs 14+ "hurts Small Business!" https://twitter.com/jason_kint/status/1383391849902075911 https://twitter.com/jason_kint/status/1383391849902075911 (video in thread)

by tomxor 6y ago

hirsin 6y ago

Care to reach out? This username at Microsoft. We're working to understand what legitimate use cases are broken without 3p cookies so we can work with Google to backfill them. FLOC helps ad trackers track but doesn't help with any of the legitimate uses of 3p cookies like auth.

pabs3 6y ago
Auth should be doable with just redirects though right? Isn't that how OAuth and OpenID connect work?
- catlifeonmars 6y ago
  Same thought. I’m curious to know what other kinds of authentication protocols require third-party cookies to operate. Within OIDC, even more obscure/advanced features such as session management and global logout require only 1st party (the IdPs) cookies in order to function. I guess the tradeoff being made here is just leaning into our reliance on the certificate authority system. Whereas before, with third party cookies, you might have had more flexibility with how you structure your domains.
  - hirsin 6y ago
    The implicit grant, while deprecated, is still used across the ecosystem. Further, embedded apps (eg you have a portal that iframes Salesforce and Salesforce needs to be authenticated) can't redirect to the login page or open that iframe for cookies. Front channel logout is also broken, part of the OIDC spec. It opens iframes to sites, but the sites don't get their cookies and can't write them.
- om2 6y ago
  OAuth sometimes is done using an iframe and a pop-up window instead of by navigating to the federated auth provider and back. That version often needs third party cookies.
livre 6y ago
Since you seem to work for Microsoft, the broken use case I know: without 3p cookies Microsoft Teams is broken (it shows a not very useful error page asking to refresh the page, when you do it shows the same error again). Many of us need it for remote work so I guess this one of the things Google had in mind when they delayed disabling 3p cookies by default.
- hirsin 6y ago
  Yes, Teams relies on silent auth from within an iframe (all those chat windows etc). This is impossible without 3p cookies, so we're working with Google to find a solution. Storage access API in Safari works, but sounds like it won't make it to Chrome.
  - livre 6y ago
    Thanks, nice to know you are working on it.

jffry 6y ago

Sure, I suppose all that (waves hand at third-party cookies situation) is what I meant by the long phase out of them. As far as I can recall those defaults were signaled a fair amount of time in advance. I have sympathy for anybody with a legitimate use for third-party cookies whose life has been made more difficult by bad actors abusing features to maximise their own profits. Same tragedy that finally caused origin-based cache partitioning at the expense of some performance.

surround 6y ago

> Not true, FireFox and Safari have had them off by default for over a year now. Not quite. They will block some 3rd party tracking cookies that fall on their tracking blacklist. If you want to block all 3rd party cookies you have to explicitly disable them.

om2 6y ago
Safari does actually block all third party cookies by default, not just a subset. And has been doing so for about a year now.
- mk81 6y ago
  If I understand correctly, they allow 3rd-party cookies but delete them at the end of the browsing session rather than respecting the expiry.

propogandist 6y ago

this is the same execuse facebook's been using, although they're trying to push the narrative that limited tracking in Apple's iOs 14+ "hurts Small Business!" https://twitter.com/jason_kint/status/1383391849902075911 https://twitter.com/jason_kint/status/1383391849902075911 (video in thread)