4 ms·

I think the concern is more about when Google is able to collect said data, not whether it's shared or not. I don't have location enabled for Google maps in th

I think the concern is more about when Google is able to collect said data, not whether it's shared or not. I don't have location enabled for Google maps in the browser, but if I did, then presumably Google could collect that data also when I'm just searching for a website.

dclowd9901 4y ago
But isn’t collected/shared inherently the same thing here?
- theptip 4y ago
  No, what they are talking about is all Google properties (eg Google search) now being able to collect your location every time you use them, if you granted permission for maps to get your location. So it’s now not possible to block location for search, and grant it to maps (at least using the standard browser domain permissions model). https://support.google.com/chrome/answer/114662?hl=en&co=GENIE.Platform%3DDesktop https://support.google.com/chrome/answer/114662?hl=en&co=GEN...
  - luckylion 4y ago
    But they could've been doing that all along because they control both sites, they would've just needed to use an iFrame. What changed beyond "it's a little easier now"?
    - theptip 4y ago
      Is that how browser permissions work? Naively I’d assume the browser grants only search.google.com permissions on that url, even if maps.google.com is opened as an iframe.
      - luckylion 4y ago
        It's been ages since I've played with iframes, but I'm pretty sure it does (or at least did?). You might have to specify an allow policy [0] but that's no problem if you control both sides. Since iframes are secure, data wouldn't leak unless the iframe explicitly posts it. I don't know if you can request permissions from the iframe (might confuse people), but if you already have them, it ought to be fine. [0] https://github.com/w3c/webappsec-permissions-policy/blob/main/permissions-policy-explainer.md https://github.com/w3c/webappsec-permissions-policy/blob/mai...
        theptip 4y ago
        Thanks for the docs. The examples (2 & 3, https://github.com/w3c/webappsec-permissions-policy/blob/main/permissions-policy-explainer.md#example-2---enable-geolocation-in-a-cross-origin-frame https://github.com/w3c/webappsec-permissions-policy/blob/mai...) seem to me to say that search.google.com can’t grant location permissions to an iframe if the parent was forbidden them, but I didn't find an explicit example for what happens if the iframe domain already got permission previously. As you say the UI for requesting in this case would be weird, and this seems like a big security hole to me, but I can’t see a bit of the spec that explicitly forbids (though I only scanned the doc.)

dclowd9901 4y ago

But isn’t collected/shared inherently the same thing here?

theptip 4y ago
No, what they are talking about is all Google properties (eg Google search) now being able to collect your location every time you use them, if you granted permission for maps to get your location. So it’s now not possible to block location for search, and grant it to maps (at least using the standard browser domain permissions model). https://support.google.com/chrome/answer/114662?hl=en&co=GENIE.Platform%3DDesktop https://support.google.com/chrome/answer/114662?hl=en&co=GEN...
- luckylion 4y ago
  But they could've been doing that all along because they control both sites, they would've just needed to use an iFrame. What changed beyond "it's a little easier now"?
  - theptip 4y ago
    Is that how browser permissions work? Naively I’d assume the browser grants only search.google.com permissions on that url, even if maps.google.com is opened as an iframe.
    - luckylion 4y ago
      It's been ages since I've played with iframes, but I'm pretty sure it does (or at least did?). You might have to specify an allow policy [0] but that's no problem if you control both sides. Since iframes are secure, data wouldn't leak unless the iframe explicitly posts it. I don't know if you can request permissions from the iframe (might confuse people), but if you already have them, it ought to be fine. [0] https://github.com/w3c/webappsec-permissions-policy/blob/main/permissions-policy-explainer.md https://github.com/w3c/webappsec-permissions-policy/blob/mai...
      - theptip 4y ago
        Thanks for the docs. The examples (2 & 3, https://github.com/w3c/webappsec-permissions-policy/blob/main/permissions-policy-explainer.md#example-2---enable-geolocation-in-a-cross-origin-frame https://github.com/w3c/webappsec-permissions-policy/blob/mai...) seem to me to say that search.google.com can’t grant location permissions to an iframe if the parent was forbidden them, but I didn't find an explicit example for what happens if the iframe domain already got permission previously. As you say the UI for requesting in this case would be weird, and this seems like a big security hole to me, but I can’t see a bit of the spec that explicitly forbids (though I only scanned the doc.)