6 ms·

This is wrong: try downloading something with Safari, which blocks third party cookies by default, and it works fine. Instead, the problem is that downloading

by jefftk 4y ago

This is wrong: try downloading something with Safari, which blocks third party cookies by default, and it works fine. Instead, the problem is that downloading from Google Drive is using User-Agent sniffing to determine whether third party cookies are expected to be enabled, and choosing between implementations. (Disclosure: I used to work at Google, but I don't know anything internal on this)

deleted 4y ago
[deleted]
nottorp 4y ago
Or Safari has an exception for google cookies.
- jefftk 4y ago
  If you open developer tools you can see cookies aren't being sent.
  - ruoranwang 4y ago
    Good to know, thanks!
Nextgrid 4y ago
Oh wow - so while there was a non-malicious explanation in another comment (https://news.ycombinator.com/item?id=32149130 https://news.ycombinator.com/item?id=32149130), this clearly looks like malicious behavior. They're relying on the fact that most browsers lack per-domain cookie controls to force Google Drive users to allow third-party cookies knowing full well the majority won't remember (or bother) to disable them after.
- jefftk 4y ago
  The explanation in the other comment is also correct. When you go from drive.google.com to googleusercontent.com to download a file, this historically worked by using third-party cookies to verify that you were authorized to download the file. When Safari dropped support for third-party cookies they added a new flow which uses link decoration instead, but only use this flow when they think the browser doesn't support third-party cookies. Their "does this browser do third-party cookies" logic isn't very good, and doesn't handle Chrome without third-party cookies. I'm not sure why they don't use the new flow for everyone. My guess is that it's less secure? Maybe that if the link they generate is shared it gives access beyond what the original owner chose to share?
  - workingon 4y ago
    It seems obvious to me why they don't use that for everyone, and it has nothing to do with security.
    - jefftk 4y ago
      From my understanding of how these decisions were made inside Google, it's very likely to be one of: * Security: as described above * Efficiency: the method used for Safari requires more server resources * Performance: the method used for Safari is slower What is the reason that seems obvious to you?
      - dataflow 4y ago
        > What is the reason that seems obvious to you? The reason he's thinking of is that they want to annoy people into enabling 3rd party cookies for tracking purposes, with security/performance/etc. as the excuse.
        horsawlarway 4y ago
        Except their instructions are specific to whitelisting the exact subdomains in question - they aren't telling you "Enable 3rd party cookies".
        dataflow 4y ago
        Yeah I'm not agreeing with it, just think that's what he was thinking of.
        Nextgrid 4y ago
        Can you whitelist third-party cookies for a specific set of domains in any mainstream browser? To the best of my knowledge you can’t.
        jefftk 4y ago
- deleted 4y ago
  [deleted]
- kretor 4y ago
  What browsers lack per-domain cookie controls?
II2II 4y ago
I'm not sure if blocking third party cookies is the cause, but I have had difficulty downloading files under Firefox. Disabling third party cookies is one of the first settings I enable after installing Firefox. I would not be surprised if Apple makes an exception for Google.
- jefftk 4y ago
  > I would not be surprised if Apple makes an exception for Google. Apple doesn't, which you can verify with developer tools in Safari.
- ajvs 4y ago
  No point disabling them now due to Total Cookie Protection by the way. All 3rd-party cookies are isolated to the 1st-party domain they're obtained from.
mynameismon 4y ago
I don't think this is the issue. I use Vivaldi, blocking third party cookies by default, and I was unable to download before I disabled third party cookies temporarily.
- jefftk 4y ago
  Vivaldi pretends to be Chrome: https://vivaldi.com/blog/user-agent-changes/ https://vivaldi.com/blog/user-agent-changes/ Ideally they would be using feature detection to check whether third-party cookies are supported, but I think it's UA sniffing (possibly because this is a slow feature to check through behavior?)
lelandfe 4y ago
If you mock your UA string in Chrome, does downloading work like Safari?
seydor 4y ago
How is it wrong? And if safari does it without cookies, why not chrome? Chrome is used by 65% of people, safari ~15% (<10% on desktop)
- Quarrelsome 4y ago
  I believe they're suggesting some code is executed based on the user agent. So Safari gets treated differently. Safari is defacto zero 3rd party cookies but Chrome isn't which is possibly why that site is treating them different.
dheera 4y ago
Yeah, so all you need to do is ask Chrome to report a Safari User-Agent.
deleted 4y ago
[deleted]
jmprspret 4y ago
Not sure if it's still the case, but a while back google docs complained that because I wasn't using chrome some features weren't supported. After changing my UA to chrome, the banner dissapeared and as far as I remember the features it said were "unsupported" worked fine.

by jefftk 4y ago

deleted 4y ago

[deleted]

nottorp 4y ago

Or Safari has an exception for google cookies.

jefftk 4y ago
If you open developer tools you can see cookies aren't being sent.
- ruoranwang 4y ago
  Good to know, thanks!

Nextgrid 4y ago

Oh wow - so while there was a non-malicious explanation in another comment (https://news.ycombinator.com/item?id=32149130 https://news.ycombinator.com/item?id=32149130), this clearly looks like malicious behavior. They're relying on the fact that most browsers lack per-domain cookie controls to force Google Drive users to allow third-party cookies knowing full well the majority won't remember (or bother) to disable them after.

jefftk 4y ago
The explanation in the other comment is also correct. When you go from drive.google.com to googleusercontent.com to download a file, this historically worked by using third-party cookies to verify that you were authorized to download the file. When Safari dropped support for third-party cookies they added a new flow which uses link decoration instead, but only use this flow when they think the browser doesn't support third-party cookies. Their "does this browser do third-party cookies" logic isn't very good, and doesn't handle Chrome without third-party cookies. I'm not sure why they don't use the new flow for everyone. My guess is that it's less secure? Maybe that if the link they generate is shared it gives access beyond what the original owner chose to share?
- workingon 4y ago
  It seems obvious to me why they don't use that for everyone, and it has nothing to do with security.
  - jefftk 4y ago
    From my understanding of how these decisions were made inside Google, it's very likely to be one of: * Security: as described above * Efficiency: the method used for Safari requires more server resources * Performance: the method used for Safari is slower What is the reason that seems obvious to you?
    - dataflow 4y ago
      > What is the reason that seems obvious to you? The reason he's thinking of is that they want to annoy people into enabling 3rd party cookies for tracking purposes, with security/performance/etc. as the excuse.
      - horsawlarway 4y ago
        Except their instructions are specific to whitelisting the exact subdomains in question - they aren't telling you "Enable 3rd party cookies".
        dataflow 4y ago
        Yeah I'm not agreeing with it, just think that's what he was thinking of.
        Nextgrid 4y ago
        Can you whitelist third-party cookies for a specific set of domains in any mainstream browser? To the best of my knowledge you can’t.
        jefftk 4y ago
deleted 4y ago
[deleted]
kretor 4y ago
What browsers lack per-domain cookie controls?

II2II 4y ago

I'm not sure if blocking third party cookies is the cause, but I have had difficulty downloading files under Firefox. Disabling third party cookies is one of the first settings I enable after installing Firefox. I would not be surprised if Apple makes an exception for Google.

jefftk 4y ago
> I would not be surprised if Apple makes an exception for Google. Apple doesn't, which you can verify with developer tools in Safari.
ajvs 4y ago
No point disabling them now due to Total Cookie Protection by the way. All 3rd-party cookies are isolated to the 1st-party domain they're obtained from.

mynameismon 4y ago

I don't think this is the issue. I use Vivaldi, blocking third party cookies by default, and I was unable to download before I disabled third party cookies temporarily.

jefftk 4y ago
Vivaldi pretends to be Chrome: https://vivaldi.com/blog/user-agent-changes/ https://vivaldi.com/blog/user-agent-changes/ Ideally they would be using feature detection to check whether third-party cookies are supported, but I think it's UA sniffing (possibly because this is a slow feature to check through behavior?)

lelandfe 4y ago

If you mock your UA string in Chrome, does downloading work like Safari?

seydor 4y ago

How is it wrong? And if safari does it without cookies, why not chrome? Chrome is used by 65% of people, safari ~15% (<10% on desktop)

Quarrelsome 4y ago
I believe they're suggesting some code is executed based on the user agent. So Safari gets treated differently. Safari is defacto zero 3rd party cookies but Chrome isn't which is possibly why that site is treating them different.

dheera 4y ago

Yeah, so all you need to do is ask Chrome to report a Safari User-Agent.

deleted 4y ago

[deleted]

jmprspret 4y ago

Not sure if it's still the case, but a while back google docs complained that because I wasn't using chrome some features weren't supported. After changing my UA to chrome, the banner dissapeared and as far as I remember the features it said were "unsupported" worked fine.