3 ms·
Those work by redirect you on top level domain (the url you see in url bar) shouldn't be affected. They don't even share cookie directly anyway. (Which is just.
by mmis1000 4y ago
Those work by redirect you on top level domain (the url you see in url bar) shouldn't be affected. They don't even share cookie directly anyway. (Which is just.... standard oauth)
Those work by enbedded into pages (iframe) or popups may.
The biggest offender of this kind of usage is probably facebook comment / disqus comment.
- jrochkind1 4y agoMakes sense. The difference will be (I predict) that when you are redirected to the SSO, you will _always_ have to enter your username/password, or at least once per "first party" site you are logging into. Whereas right now, sometimes when you get redirected to the SSO/oath, it already knows who you are, and you don't need to log in again -- you just get invisibly redirected back, and/or just have to click a button saying "yeah, it's cool". But with the cookie sandboxes, you'll always have to actually enter username and password to your SSO. Because the cookies that would have told the SSO(/oauth provider) that you have an active auth session, from when you logged in earlier today or whatever -- won't make it. Or maybe not, depending on how it's implemented -- but if a redirect is enough to defeat it and make it think you're in a different sandbox, then I expect all the trackers will be able to defeat the sandboxing with careful use of redirects. So.
- mmis1000 4y agoAd don't redirect you on top level domain anyway (except for some malicious ad). And silent popup these days don't even work. If the site is willing to redirect you directly to another site. I guess they can share data by themselves anyway? I think sabotage of silent tracking pixel/ajax tracking is enough for most usage without breaking the web.