3 ms·

I've never understood the thinking that went behind allowing one site to see the existence of another site's cookie in the first place. I don't think I'm even c

by ghusto 4y ago

I've never understood the thinking that went behind allowing one site to see the existence of another site's cookie in the first place. I don't think I'm even coming at this with the security hindsight of decades, it's just common sense, isn't it?

ComodoHacker 4y ago
A site isn't allowed to see another site's cookies, common sense doesn't fail you.
- ghusto 4y ago
  No, but I said see the _existence_ of. Or am I wrong there? Ha, I should really know this :P
  - ComodoHacker 4y ago
    I'm not a front end guy, but AFAIK no, even the existence of. Apart from various hacks, of course.
Renaud 4y ago
It's not that one site is seeing another site. It's that multiple sites will serve content (ads, Javascript libraries, like buttons) from a common site (eg an ad network) that uses its own domain. That domain is allowed to get the cookie for itself because it is referenced by multiple site, that's how this type of tracking works. If you go to bbc.com, it still won't be able to see cookies from cnn.com, but say if advert.com is included by both sites, then it will see that you visited them both. That's the power and great danger that things like facebook and google sense represent. The owner of the sites get some stats for free by using these services, but the biggest benefit is for google and facebook to be able to track what users are looking at accross the web. And you just need to be identifiable on one site that you visit (say, FB or gmail) for them to know exactly who you are. From what I understand, Firefox will only allow advert.com to get the cookie it created when being loaded as part of bbc.com, but it won't be able to read its own cookie from cnn.com, it will have to create a new, separate one, thus breaking the link tracking you between sites, or at least making it harder to connect the dots. Everyone should use FF.
- Sohcahtoa82 4y ago
  > Everyone should use FF. Wouldn't simply installing an ad/tracking blocker like uBlock Origin be just as effective, if not moreso?
  - robin_reala 4y ago
    uBlock Origin works best on Firefox anyway: https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-best-on-Firefox https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-b...
  - johannes1234321 4y ago
    Isn't it better to remove the different root problems isntead of having plugins working around?
    - Sohcahtoa82 4y ago
      Personally, I use uBlock Origin more to block obnoxious ads than to block the tracking. I'm not sure I really care that much about tracking, honestly. So what if reddit knows I bought a toaster on Amazon recently? What are they going to do with that data, show me toaster ads? I'm going to be blocking that ad. Sell the fact that I bought a toaster? Whatever. It's all going to be so advertisers can personalize ads...which I will be blocking.
  - cpmsmith 4y ago
    There's some overlap, but ads aren't the only thing using this. Google Fonts is the classic example of something that does add value (nice fonts) to a webpage, and as such isn't blocked by most adblockers (including uBO) by default, but is still able to use this for tracking because the same domain serves the font files on every website using them.
    - taftster 4y ago
      Very insightful response. The tendency is to look at the cookie problem as an advertising problem. Whereas, there are other cross-origin use cases that are not adverts but pose the same tracking threat. Anything on a CDN (like common javascript libraries) share this trait.
ajvs 4y ago
It's a legit usecase for Single-Sign On providers. However this functionality has been mainly abused by ad trackers, and has thus been curtailed.
- i2shar 4y ago
  Can you elaborate how? From what I know, the two most popular implementations - SAML and OIDC don't rely on 3rd party cookies. They rely purely on HTTP redirects.
aimor 4y ago
I never understood it (third party cookies getting external information) either. Same thing with the referer request header, or user agents, or disabling the right-click menu, or editing the browser history, or opening new windows, or changing scroll behavior, or replacing the cursor icon, or autoplaying videos. There are reasons to want to do these things. In some cases it's difficult for the browser to prevent them. But I'd sure like it if the standards and browsers were on my side, not the side of those nefarious web developers.
mdavidn 4y ago
Sites can't see the existence of other sites' cookies. They can, however, request resources from other sites. Those requests, in turn, would send third-party cookies, if any, to the third-party server _and_ save new third-party cookies in response. "Tracking beacons" abuse this behavior to correlate user behavior across many web sites.
feanaro 4y ago
Sites A and B both include content from the spying website S, which sets some cookies. Now S can correlate your visits to A and B because it's able to read its own cookies. This change makes it so that requests A -> S (requests from A to S) and B -> S are treated as A -> S1 and B -> S2 instead. Now S1 cannot read cookies from S2 and vice versa, even though they are the same site.

by ghusto 4y ago

ComodoHacker 4y ago

A site isn't allowed to see another site's cookies, common sense doesn't fail you.

ghusto 4y ago
No, but I said see the _existence_ of. Or am I wrong there? Ha, I should really know this :P
- ComodoHacker 4y ago
  I'm not a front end guy, but AFAIK no, even the existence of. Apart from various hacks, of course.

Renaud 4y ago

It's not that one site is seeing another site. It's that multiple sites will serve content (ads, Javascript libraries, like buttons) from a common site (eg an ad network) that uses its own domain. That domain is allowed to get the cookie for itself because it is referenced by multiple site, that's how this type of tracking works. If you go to bbc.com, it still won't be able to see cookies from cnn.com, but say if advert.com is included by both sites, then it will see that you visited them both. That's the power and great danger that things like facebook and google sense represent. The owner of the sites get some stats for free by using these services, but the biggest benefit is for google and facebook to be able to track what users are looking at accross the web. And you just need to be identifiable on one site that you visit (say, FB or gmail) for them to know exactly who you are. From what I understand, Firefox will only allow advert.com to get the cookie it created when being loaded as part of bbc.com, but it won't be able to read its own cookie from cnn.com, it will have to create a new, separate one, thus breaking the link tracking you between sites, or at least making it harder to connect the dots. Everyone should use FF.

Sohcahtoa82 4y ago
> Everyone should use FF. Wouldn't simply installing an ad/tracking blocker like uBlock Origin be just as effective, if not moreso?
- robin_reala 4y ago
  uBlock Origin works best on Firefox anyway: https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-best-on-Firefox https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-b...
- johannes1234321 4y ago
  Isn't it better to remove the different root problems isntead of having plugins working around?
  - Sohcahtoa82 4y ago
    Personally, I use uBlock Origin more to block obnoxious ads than to block the tracking. I'm not sure I really care that much about tracking, honestly. So what if reddit knows I bought a toaster on Amazon recently? What are they going to do with that data, show me toaster ads? I'm going to be blocking that ad. Sell the fact that I bought a toaster? Whatever. It's all going to be so advertisers can personalize ads...which I will be blocking.
- cpmsmith 4y ago
  There's some overlap, but ads aren't the only thing using this. Google Fonts is the classic example of something that does add value (nice fonts) to a webpage, and as such isn't blocked by most adblockers (including uBO) by default, but is still able to use this for tracking because the same domain serves the font files on every website using them.
  - taftster 4y ago
    Very insightful response. The tendency is to look at the cookie problem as an advertising problem. Whereas, there are other cross-origin use cases that are not adverts but pose the same tracking threat. Anything on a CDN (like common javascript libraries) share this trait.

ajvs 4y ago

It's a legit usecase for Single-Sign On providers. However this functionality has been mainly abused by ad trackers, and has thus been curtailed.

i2shar 4y ago
Can you elaborate how? From what I know, the two most popular implementations - SAML and OIDC don't rely on 3rd party cookies. They rely purely on HTTP redirects.

aimor 4y ago

I never understood it (third party cookies getting external information) either. Same thing with the referer request header, or user agents, or disabling the right-click menu, or editing the browser history, or opening new windows, or changing scroll behavior, or replacing the cursor icon, or autoplaying videos. There are reasons to want to do these things. In some cases it's difficult for the browser to prevent them. But I'd sure like it if the standards and browsers were on my side, not the side of those nefarious web developers.

mdavidn 4y ago

Sites can't see the existence of other sites' cookies. They can, however, request resources from other sites. Those requests, in turn, would send third-party cookies, if any, to the third-party server _and_ save new third-party cookies in response. "Tracking beacons" abuse this behavior to correlate user behavior across many web sites.

feanaro 4y ago

Sites A and B both include content from the spying website S, which sets some cookies. Now S can correlate your visits to A and B because it's able to read its own cookies. This change makes it so that requests A -> S (requests from A to S) and B -> S are treated as A -> S1 and B -> S2 instead. Now S1 cannot read cookies from S2 and vice versa, even though they are the same site.