5 ms·
There are legit cross-domain use cases. A good example is how someone here mentioned (comment seems deleted though) account sessions being shared between Atlas
by ravenstine 4y ago
There are legit cross-domain use cases. A good example is how someone here mentioned (comment seems deleted though) account sessions being shared between Atlassian products like JIRA and BitBucket.
The problem with that is domains are a poor way of representing ownership that can be trusted. If the web was rebuilt from scratch, a better approach might be to allow cookies to be shared between secure sites using the same certificate. But that adds more complexity that I'm not sure is worthwhile. The web can absolutely get away with not having shared cookies.
- deleted 4y ago[deleted]
- vman81 4y agoThere are also legit use cases for leaving all your doors unlocked. But they usually aren't really worth considering when you are installing your doors/locks.
- layer8 4y ago> allow cookies to be shared between secure sites using the same certificate Or maybe encrypting cookies using the site certificate, which would still allow cookies to be shared with domains having a different certificate, but the server needs the correct key for decryption.
- exo762 4y agoCiphertext leaks information via its size and its presence / absence.
- dylan604 4y agoyeah and so? how is this information useful? if the actual useful information is encrypted, then size is meaningless as it is just random text until decrypted. presence/absence? you have a cookie or you don't?
- recursive 4y agoYou say the size is meaningless. But sometimes it may actually be meaningful. And presence/absence is information also. Not much, but it definitely exists.
- dylan604 4y agoIn what way? If I'm storing 255 bytes of username/email/credentials/settings/etc, but pad in some fun way to 512 bytes prior to encryption, what in the world does knowing that the cookie is 512 bytes do you? You have no idea what data is stored. You don't know if there are 512 bytes of actual data, 128 bytes with lots of fluff, or anything at all other than 512 bytes. Hell, it could be 0 bytes of data and 512 bytes of random data that I submit to every single person that visits the site just to fuck with people like you! You seem like you need something to do ;-)
- recursive 4y agoIf the contents of the cookie is a JSON array of recently viewed items, then the size is correlated to whether I've been actively viewing items recently. Adding random padding makes it harder to get a signal, but with a high enough sample size, it's still possible to get some information. If you always pad to a fixed size, then there's probably no useful information. At the moment, I think I have enough to do, but I'll probably be looking for something new in the next few weeks. Got any novel single player video game recommendations?
- dylan604 4y ago>If That's are really big word in that sentence. You have NO idea, like 0, what is stored in an encrypted cookie. To even think you do is just pure folly.
- recursive 4y agoI do have ideas. I can strengthen them by reverse-engineering the behavior using my own account. I participate in follies regularly, so that's not a strong disincentive for me.
- deleted 4y ago[deleted]
- Thorrez 4y agoSounds like it'll make key rotation tricky. Also it'll likely break javascript access to the cookies.
- notriddle 4y agoThere’s no technical reason why this has to be hard. If jira was at jira.atlassian.com and bitbucket was bitbucket.atlassian.com, they would have the same origin, plus they would make the relationship between them visible to any moderately savvy user. It’s only complicated because they allow their marketing dept to make it complicated.
- oefrha 4y agoYou do realize acquisitions occur?
- dylan604 4y agoyou do realize reorganization occur after acquisitions?
- notriddle 4y agoSo use a 301 redirect.
- abdullahkhalids 4y agoBusiness operation complications are not a valid reason for the violation of the rights of humans.
- Thorrez 4y agoCross-domain cookies are a tool that can be used for good or bad. It's a tradeoff to block them or not block them.
- filmgirlcw 4y agoI think that’s unfair. By tying things to domains that way, you also make it potentially difficult to change URL structure (look at how long the various go.com domains lasted across all Disney/ABC properties. I know of teams that had very real problems years later b/c the infra was still based on domain stuff that was setup 15 years prior when the parent company thought internet portals were worth spending billions on), not to mention if you want to spin-off or sell an asset. Or if you acquire an asset! To say nothing of SSOs, where you might not want to carry your login across, but you’d like to have the option of saying “yes, I’d like to use this account here too” and then authenticate.
- Groxx 4y agoIsn't this solved with a login redirect? Just return a signed ID and set up cookies on the other end with that. Granted, it's one more redirect per domain than before per login period, but that's hardly onerous. Domains that want to collaborate together can still do so.
- deleted 4y ago[deleted]
- Thorrez 4y ago> allow cookies to be shared between secure sites using the same certificate In some ways that will be less strict than Firefox's implementation. A CDN might have a certificate with hundreds of unrelated sites in it. In some ways that will be more strict than Firefox's implementation. A site might want to serve large static files on static.foo.com but a secure login page on login.foo.com , and want to hand over the private key for static.foo.com to a CDN but not hand over the private key for login.foo.com .