3 ms·

From my understanding of how these decisions were made inside Google, it's very likely to be one of: * Security: as described above * Efficiency: the method u

by jefftk 4y ago

From my understanding of how these decisions were made inside Google, it's very likely to be one of: * Security: as described above * Efficiency: the method used for Safari requires more server resources * Performance: the method used for Safari is slower What is the reason that seems obvious to you?

dataflow 4y ago
> What is the reason that seems obvious to you? The reason he's thinking of is that they want to annoy people into enabling 3rd party cookies for tracking purposes, with security/performance/etc. as the excuse.
- horsawlarway 4y ago
  Except their instructions are specific to whitelisting the exact subdomains in question - they aren't telling you "Enable 3rd party cookies".
  - dataflow 4y ago
    Yeah I'm not agreeing with it, just think that's what he was thinking of.
  - Nextgrid 4y ago
    Can you whitelist third-party cookies for a specific set of domains in any mainstream browser? To the best of my knowledge you can’t.
    - jefftk 4y ago
      The article we're commenting on has specific instructions for how to do this in Chrome: https://support.google.com/drive/answer/2423534 https://support.google.com/drive/answer/2423534
    - horsawlarway 4y ago
      You can absolutely do this in any Chromium based browser. Go to settings, check "block 3rd party cookies" scroll down to customized behaviors, click "Add" next to "sites that can always use cookies" Enter the domain you want. Before saving, make sure to check "Including third-party cookies on this site". -- Or, ya know, read the instructions in the link on this post telling you to do exactly this for drive.google.com :P
api 4y ago
The assumption is that every single thing Google does is a dark pattern to track you. In this case you are probably right, but surveillance is Google's business model.
rndgermandude 4y ago
I saw the efficiency/performance claim a bunch of times now. How is using a cookie over say the same data embedded in the requested URL or transmitted as form-data supposedly more efficient? The server still has to check the auth, no matter what part of the request it extracted the auth data from. Or am I missing something here? As for security, yeah, there are some good reasons for not embedding auth info in the link (tho one could still POST the same data instead without a third party cookie, etc), as well as for having a dedicated domain for user content.

by jefftk 4y ago

dataflow 4y ago

> What is the reason that seems obvious to you? The reason he's thinking of is that they want to annoy people into enabling 3rd party cookies for tracking purposes, with security/performance/etc. as the excuse.

horsawlarway 4y ago
Except their instructions are specific to whitelisting the exact subdomains in question - they aren't telling you "Enable 3rd party cookies".
- dataflow 4y ago
  Yeah I'm not agreeing with it, just think that's what he was thinking of.
- Nextgrid 4y ago
  Can you whitelist third-party cookies for a specific set of domains in any mainstream browser? To the best of my knowledge you can’t.
  - jefftk 4y ago
    The article we're commenting on has specific instructions for how to do this in Chrome: https://support.google.com/drive/answer/2423534 https://support.google.com/drive/answer/2423534
  - horsawlarway 4y ago
    You can absolutely do this in any Chromium based browser. Go to settings, check "block 3rd party cookies" scroll down to customized behaviors, click "Add" next to "sites that can always use cookies" Enter the domain you want. Before saving, make sure to check "Including third-party cookies on this site". -- Or, ya know, read the instructions in the link on this post telling you to do exactly this for drive.google.com :P

api 4y ago

The assumption is that every single thing Google does is a dark pattern to track you. In this case you are probably right, but surveillance is Google's business model.

rndgermandude 4y ago

I saw the efficiency/performance claim a bunch of times now. How is using a cookie over say the same data embedded in the requested URL or transmitted as form-data supposedly more efficient? The server still has to check the auth, no matter what part of the request it extracted the auth data from. Or am I missing something here? As for security, yeah, there are some good reasons for not embedding auth info in the link (tho one could still POST the same data instead without a third party cookie, etc), as well as for having a dedicated domain for user content.