4 ms·

What's to do with cookies? I understand the comment to refer to ads being by far their main revenue making business, and shaping users browswer preference to ke

by hirako2000 4y ago

What's to do with cookies? I understand the comment to refer to ads being by far their main revenue making business, and shaping users browswer preference to keep cookies helps Google make more money via ads. I didn't even know 3PC was used by google drive. Not sure what could be non cpincidental otuer than a technical reason for it given the very collaborative nature of this tool.

kevin_thibedeau 4y ago
The downloads are served from a different domain. It needs 3PC to retrieve the Google auth token. No other service with downloads works that way.
- shadowgovt 4y ago
  So that's the reason they're required: to preserve the credentials story between the static resource provider and the non-static layer. Nothing nefarious; just an implementation detail.
  - kevin_thibedeau 4y ago
    That's how all dark patterns are constructed. Present a plausible cover story. Keep the underlings in the dark about the true reason for the system architecture. Don't write anything down.
    - shadowgovt 4y ago
      That's also how all patterns are constructed: present a plausible cover story (because it is true). Keep the underlings in the dark about the true reason for the system architecture (because the delta between the true reason and apparent reason is null). Don't write anything down (because there's nothing else to write down). Suspicion of dark pattern is not proof of dark pattern. (ETA: at Google in particular, the dark-pattern-conspiracy you're describing between two unrelated teams, in this case Drive and static storage, is hard to pull off because coordinating those teams requires documenting design, and it turns out a lot of folks working at Google are Hacker News-type personalities who will ask inconvenient questions if they come up. But what they have that we lack is observation of the larger security picture and the ways failure to, for example, 3PC-guard your static files can result in failure modes).

kevin_thibedeau 4y ago

The downloads are served from a different domain. It needs 3PC to retrieve the Google auth token. No other service with downloads works that way.

shadowgovt 4y ago
So that's the reason they're required: to preserve the credentials story between the static resource provider and the non-static layer. Nothing nefarious; just an implementation detail.
- kevin_thibedeau 4y ago
  That's how all dark patterns are constructed. Present a plausible cover story. Keep the underlings in the dark about the true reason for the system architecture. Don't write anything down.
  - shadowgovt 4y ago
    That's also how all patterns are constructed: present a plausible cover story (because it is true). Keep the underlings in the dark about the true reason for the system architecture (because the delta between the true reason and apparent reason is null). Don't write anything down (because there's nothing else to write down). Suspicion of dark pattern is not proof of dark pattern. (ETA: at Google in particular, the dark-pattern-conspiracy you're describing between two unrelated teams, in this case Drive and static storage, is hard to pull off because coordinating those teams requires documenting design, and it turns out a lot of folks working at Google are Hacker News-type personalities who will ask inconvenient questions if they come up. But what they have that we lack is observation of the larger security picture and the ways failure to, for example, 3PC-guard your static files can result in failure modes).