4 ms·

Google pretend-playing "building a more private web" again. Blocking third party cookies is great, but with these "Third-Party Sets", self-appointed gatekeeper

by krono 3y ago

Google pretend-playing "building a more private web" again. Blocking third party cookies is great, but with these "Third-Party Sets", self-appointed gatekeeper Judge Google (Judge Dread) takes requests from website owners for lists of domains they control to be partially exempted from these third party cookie restrictions. Instead of making third-party cookies obsolete as is one of the exclaimed goals of the broader initiative, they turned it into an insidious and opaque tool that lets them increase their insight, influence, and control over the web and all its users even further. This is bad for both advertisers and their prey alike. Addendum: Getting rid of third-party cookies whilst not breaking Single Sign-On and similar such features could also have been achieved with a user-controlled local browser setting and a new type of permission request popup. The need for Google to be in control of this is non-existent and the people working there are more than smart enough to understand this. They are playing us all here.

ozaark 3y ago
Doesn't part of this update also make fingerprinting users even more robust with webGPU? Aka you don't need cookies because we can see who you are without them based on your machines unique specs
Xeoncross 3y ago
> they turned it into an insidious and opaque tool that lets them increase their insight, influence, and control Sounds like most of the laws passed in my lifetime
renewiltord 3y ago
The FPS spec as described looks entirely duplicable by others and openly reimplementable by just cloning the FPS repo and following the same spec (which is open). Someone could choose in their browser to use a different set or a different repo or some hierarchical structure. Because domain owners use /.well-known/first-party-sets.json, others can also scan for that themselves and perhaps build an independent repo from spidering.
paulddraper 3y ago
> self-appointed gatekeeper Judge Google (Judge Dread) takes requests from website owners for lists of domains they control More specifically, website owners populate /.well-known/first-party-sets.json for their site and Chrome will always allow those cookies.
- jefftk 3y ago
  I don't think so? It looks to me like you also need to follow https://github.com/GoogleChrome/first-party-sets/blob/main/FPS-Submission_Guidelines.md https://github.com/GoogleChrome/first-party-sets/blob/main/F... and get your sites onto https://github.com/GoogleChrome/first-party-sets/blob/main/first_party_sets.JSON https://github.com/GoogleChrome/first-party-sets/blob/main/f...
dagenix 3y ago
> with a user-controlled local browser setting and a new type of permission request popup. Settings and pop ups mean that users have to understand them - which can be a huge user education challenge. I'm pretty skeptical of the argument that it's simple to add in a new user facing pop up and have the majority of users use it correctly.
- makeitdouble 3y ago
  I agree with you, but SSO is also not that seamless in practice and requires user education on which sites they use it with which ID. I'd see a browser side system that could actually more user friendly and more unified than the current SSO situation.
- krono 3y ago
  I made no such argument regarding simplicity. Nevertheless: even if a solution turns out to be too difficult for users to understand no matter how you present it (at which point you might want to rethink whether this apparently fundamentally flawed idea should even be implemented at all), violating your users' agency by taking the reigns and obfuscating the whole thing to them is morally wrong and in simple terms: an arsehole move.
  - MichaelZuo 3y ago
    If the user is perpetually confused using 'show all popups' Chrome, why wouldn't they switch to another browser that does that anyways?
- chiefalchemist 3y ago
  Can't there be a setting to allow that setting / experience?
deleted 3y ago
[deleted]
princevegeta89 3y ago
Google- we've got your privacy Literally. Lol.
deleted 3y ago
[deleted]

by krono 3y ago

ozaark 3y ago

Doesn't part of this update also make fingerprinting users even more robust with webGPU? Aka you don't need cookies because we can see who you are without them based on your machines unique specs

Xeoncross 3y ago

> they turned it into an insidious and opaque tool that lets them increase their insight, influence, and control Sounds like most of the laws passed in my lifetime

renewiltord 3y ago

The FPS spec as described looks entirely duplicable by others and openly reimplementable by just cloning the FPS repo and following the same spec (which is open). Someone could choose in their browser to use a different set or a different repo or some hierarchical structure. Because domain owners use /.well-known/first-party-sets.json, others can also scan for that themselves and perhaps build an independent repo from spidering.

paulddraper 3y ago

> self-appointed gatekeeper Judge Google (Judge Dread) takes requests from website owners for lists of domains they control More specifically, website owners populate /.well-known/first-party-sets.json for their site and Chrome will always allow those cookies.

jefftk 3y ago
I don't think so? It looks to me like you also need to follow https://github.com/GoogleChrome/first-party-sets/blob/main/FPS-Submission_Guidelines.md https://github.com/GoogleChrome/first-party-sets/blob/main/F... and get your sites onto https://github.com/GoogleChrome/first-party-sets/blob/main/first_party_sets.JSON https://github.com/GoogleChrome/first-party-sets/blob/main/f...

dagenix 3y ago

> with a user-controlled local browser setting and a new type of permission request popup. Settings and pop ups mean that users have to understand them - which can be a huge user education challenge. I'm pretty skeptical of the argument that it's simple to add in a new user facing pop up and have the majority of users use it correctly.

makeitdouble 3y ago
I agree with you, but SSO is also not that seamless in practice and requires user education on which sites they use it with which ID. I'd see a browser side system that could actually more user friendly and more unified than the current SSO situation.
krono 3y ago
I made no such argument regarding simplicity. Nevertheless: even if a solution turns out to be too difficult for users to understand no matter how you present it (at which point you might want to rethink whether this apparently fundamentally flawed idea should even be implemented at all), violating your users' agency by taking the reigns and obfuscating the whole thing to them is morally wrong and in simple terms: an arsehole move.
- MichaelZuo 3y ago
  If the user is perpetually confused using 'show all popups' Chrome, why wouldn't they switch to another browser that does that anyways?
chiefalchemist 3y ago
Can't there be a setting to allow that setting / experience?

deleted 3y ago

[deleted]

princevegeta89 3y ago

Google- we've got your privacy Literally. Lol.

deleted 3y ago

[deleted]