4 ms·

> It is called "third party cookies" not "ad cookies". You can have ads without third party cookies and third party cookies have other purposes than ads. As on

by tomxor 4y ago

> It is called "third party cookies" not "ad cookies". You can have ads without third party cookies and third party cookies have other purposes than ads. As one of the few people who is affected by a legitimate use case of third party cookies that are not ads... this is bullshit, 99% of use cases are for ads, it's an ad cookie.

ilovegorhill 4y ago
Yep. I've been browsing the Internet with third-party cookies blocked by default for several years, and only have three exceptions in my list: Google Drive (to be able to play videos), Mega (the file hosting site), and the official Xbox site (because it wouldn't show the list of games on Xbox Cloud Gaming).
fomine3 4y ago
Enterprise internal sites/SSO tend to rely on third party cookies, because it's enterprise and they can completely control what browser should be used.
- hedora 4y ago
  Sounds like a great data feed for industrial espionage.
iainmerrick 4y ago
Out of interest, what's that legitimate use case?
- tomxor 4y ago
  Embedding paid content from one domain into another (i.e authz is needed to prove rights to access), it's common to store the session data in a cookie for the embedded site, at which point it's a third party cookie. More concretely my particular case is to do with learning management systems which commonly use LTI to embed external content (outside of the US at least). That external content is hosted by some other system (can be another LMS) which usually store their session information in a cookie just because that's how it's always been done - The solution is to not use cookies, it's not needed, each resources can re-auth over the launch protocol (LTI) anyway, and for individual frames to be able to continue navigation/access - the session info can live anywhere else, in the URL for old fashioned navigation, or as part of the initial request body if subsequent requests are done over AJAX.

by tomxor 4y ago

ilovegorhill 4y ago

Yep. I've been browsing the Internet with third-party cookies blocked by default for several years, and only have three exceptions in my list: Google Drive (to be able to play videos), Mega (the file hosting site), and the official Xbox site (because it wouldn't show the list of games on Xbox Cloud Gaming).

fomine3 4y ago

Enterprise internal sites/SSO tend to rely on third party cookies, because it's enterprise and they can completely control what browser should be used.

hedora 4y ago
Sounds like a great data feed for industrial espionage.

iainmerrick 4y ago

Out of interest, what's that legitimate use case?

tomxor 4y ago
Embedding paid content from one domain into another (i.e authz is needed to prove rights to access), it's common to store the session data in a cookie for the embedded site, at which point it's a third party cookie. More concretely my particular case is to do with learning management systems which commonly use LTI to embed external content (outside of the US at least). That external content is hosted by some other system (can be another LMS) which usually store their session information in a cookie just because that's how it's always been done - The solution is to not use cookies, it's not needed, each resources can re-auth over the launch protocol (LTI) anyway, and for individual frames to be able to continue navigation/access - the session info can live anywhere else, in the URL for old fashioned navigation, or as part of the initial request body if subsequent requests are done over AJAX.