3 ms·

>First-Party Sets (FPS) is starting to roll out to stable. First Party Sets is part of the Privacy Sandbox. It is a way for organizations to declare relationshi

>First-Party Sets (FPS) is starting to roll out to stable. First Party Sets is part of the Privacy Sandbox. It is a way for organizations to declare relationships among sites, so that browsers allow limited third-party cookie access for specific purposes. Am I correct in my understanding that this basically undermines a user's choice to block third party cookies? Because a third party cookie is a third party cookie no matter how much icing you dump on it. I hope this is an option that can be disabled or is separate from the current blocking of all third party cookies.

shadowgovt 4y ago
First party sets are a centralized list of sites that act as one logical site. The list is gated by the browser vendor. Details here (https://github.com/GoogleChrome/first-party-sets/blob/main/FPS-Submission_Guidelines.md https://github.com/GoogleChrome/first-party-sets/blob/main/F...). This is intended to deal with several technical challenges (https://github.com/WICG/first-party-sets#use-cases https://github.com/WICG/first-party-sets#use-cases), such as the technical challenge that when company A buys company B, the process of fusing the auth rules so that being logged into A implies a login to B is a colossal nightmare project under first-party-only rules. So, for example, this lets Facebook declare that instagram.com is in the same FPS as facebook.com to simplify the auth story. What it should not allow is for joe-random-domain.com to declare that the DoubleClick ad endpoints are first-party to them.
- GauntletWizard 4y ago
  There are already reasonable ways to proactively or unproactively copy session-cookies from one domain to another one that shares a backend. What does this solve except saving a roundtrip when you visit google.co.kr?
- maccard 4y ago
  > What it should not allow is for joe-random-domain.com to declare that the DoubleClick ad endpoints are first-party to them. But it lets Google declare that doubleclick is part of them.
  - ikiris 4y ago
    You mean the company that's been part of Google for near 20 years? Like I don't like tracking either, but this is kind of the point of the first party thing. They're clearly the same party.
    - maccard 4y ago
      I do. This now means that double-click can treat my google.com cookies as first party cookies whwther I as a user want them to or not. I know that's the intention, and I'm not ok with that.
      - shadowgovt 4y ago
        What tracking capability do you think treating DoubleClick cookies as first party on Google sites gives Google that they don't already have by just combining the logs from visits to google.com, youtube.com, etc., since all of those logs are stored in the same data warehouse and can be cross-compared?
  - ahahahahah 4y ago
    doubleclick is part of them.
deleted 4y ago
[deleted]
joshuamorton 4y ago
[I work at Google, not on chrome, I don't have any particular insight into this feature]. From poking at https://github.com/GoogleChrome/first-party-sets/blob/main/FPS-Submission_Guidelines.md https://github.com/GoogleChrome/first-party-sets/blob/main/F..., it looks like at a minimum, a given domain can only belong to one FPS, and needs to be preregistered publicly. That makes the opportunities for abuse much more limited. And the "service-domains" (intended for things like auth or CDN that want to be isolated) have some reasonably strict automated checks (github.com/GoogleChrome/first-party-sets/blob/main/FPS-Submission_Guidelines.md#subset-level-technical-validation), while you're limited to 3 "associated" domains.
- kokanee 4y ago
  Abuse is subjective. Outside of Google, the general sentiment is that Chrome treating doubleclick.com as a first party to anything other than doubleclick.com is abusive.
  - Wowfunhappy 4y ago
    Couldn't Google easily achieve the same by just moving their ads to doubleclick.google.com?
    - kokanee 4y ago
      That would allow them to share doubleclick cookies across all subdomains of google.com. This FPS feature will allow them to share doubleclick cookies (or whichever cookies) across any domains that they choose to group into a "set." So regardless of whether you selected the "block third party cookies" setting, Chrome now ships with an internal list of domain groups for which it will ignore that setting.
      - deleted 4y ago
        [deleted]
      - joshuamorton 4y ago
        Right as the parent mentions, it only allows grouping among sites that are logically owned by the same entity anyway, if someone wanted to make this work with first-party cookies, they could redirect from myapplication.com to myapplication.owning-party.com (which is what google does with gmail.com -> mail.google.com today) This just allows you to do that while maintaining security boundaries around things like user generated content (e.g. facebook.com vs. fbcdn.net). This doesn't allow some random site that uses third party ads to allow doubleclick cookie access, or vice versa.

shadowgovt 4y ago

First party sets are a centralized list of sites that act as one logical site. The list is gated by the browser vendor. Details here (https://github.com/GoogleChrome/first-party-sets/blob/main/FPS-Submission_Guidelines.md https://github.com/GoogleChrome/first-party-sets/blob/main/F...). This is intended to deal with several technical challenges (https://github.com/WICG/first-party-sets#use-cases https://github.com/WICG/first-party-sets#use-cases), such as the technical challenge that when company A buys company B, the process of fusing the auth rules so that being logged into A implies a login to B is a colossal nightmare project under first-party-only rules. So, for example, this lets Facebook declare that instagram.com is in the same FPS as facebook.com to simplify the auth story. What it should not allow is for joe-random-domain.com to declare that the DoubleClick ad endpoints are first-party to them.

GauntletWizard 4y ago
There are already reasonable ways to proactively or unproactively copy session-cookies from one domain to another one that shares a backend. What does this solve except saving a roundtrip when you visit google.co.kr?
maccard 4y ago
> What it should not allow is for joe-random-domain.com to declare that the DoubleClick ad endpoints are first-party to them. But it lets Google declare that doubleclick is part of them.
- ikiris 4y ago
  You mean the company that's been part of Google for near 20 years? Like I don't like tracking either, but this is kind of the point of the first party thing. They're clearly the same party.
  - maccard 4y ago
    I do. This now means that double-click can treat my google.com cookies as first party cookies whwther I as a user want them to or not. I know that's the intention, and I'm not ok with that.
    - shadowgovt 4y ago
      What tracking capability do you think treating DoubleClick cookies as first party on Google sites gives Google that they don't already have by just combining the logs from visits to google.com, youtube.com, etc., since all of those logs are stored in the same data warehouse and can be cross-compared?
- ahahahahah 4y ago
  doubleclick is part of them.

deleted 4y ago

[deleted]

joshuamorton 4y ago

[I work at Google, not on chrome, I don't have any particular insight into this feature]. From poking at https://github.com/GoogleChrome/first-party-sets/blob/main/FPS-Submission_Guidelines.md https://github.com/GoogleChrome/first-party-sets/blob/main/F..., it looks like at a minimum, a given domain can only belong to one FPS, and needs to be preregistered publicly. That makes the opportunities for abuse much more limited. And the "service-domains" (intended for things like auth or CDN that want to be isolated) have some reasonably strict automated checks (github.com/GoogleChrome/first-party-sets/blob/main/FPS-Submission_Guidelines.md#subset-level-technical-validation), while you're limited to 3 "associated" domains.

kokanee 4y ago
Abuse is subjective. Outside of Google, the general sentiment is that Chrome treating doubleclick.com as a first party to anything other than doubleclick.com is abusive.
- Wowfunhappy 4y ago
  Couldn't Google easily achieve the same by just moving their ads to doubleclick.google.com?
  - kokanee 4y ago
    That would allow them to share doubleclick cookies across all subdomains of google.com. This FPS feature will allow them to share doubleclick cookies (or whichever cookies) across any domains that they choose to group into a "set." So regardless of whether you selected the "block third party cookies" setting, Chrome now ships with an internal list of domain groups for which it will ignore that setting.
    - deleted 4y ago
      [deleted]
    - joshuamorton 4y ago
      Right as the parent mentions, it only allows grouping among sites that are logically owned by the same entity anyway, if someone wanted to make this work with first-party cookies, they could redirect from myapplication.com to myapplication.owning-party.com (which is what google does with gmail.com -> mail.google.com today) This just allows you to do that while maintaining security boundaries around things like user generated content (e.g. facebook.com vs. fbcdn.net). This doesn't allow some random site that uses third party ads to allow doubleclick cookie access, or vice versa.