6 ms·

Can anyone explain to me why this is worse than third-party cookies? If this lets chrome remove third-party cookies, doesn't it effectively increase your pri

by esteth 3y ago

Can anyone explain to me why this is worse than third-party cookies? *If* this lets chrome remove third-party cookies, doesn't it effectively increase your privacy by putting that tracking data on the user's machine instead of having random third-parties involved in every page load to harvest that tracking info? I understand that you can currently turn off third-party cookies, but a bunch of the internet breaks if you do that. If chrome is able to turn off third-party cookies for a large swathe of people, I expect that most sites will be forced to make themselves work without third-party cookies. I don't know a huge amount about it, but naively I'd rather have my machine present this kind of data than have a network of unknown third-parties collaborate by sharing bits about me to build a profile.

ShowalkKama 3y ago
>but a bunch of the internet breaks if you do that. not really, no. From my experience most stuff works fine (the thing that breaks websites the most is webgl and even then, only the few websites that really need it use it)
- dbbk 3y ago
  You would be surprised at what breaks. It also prevents local storage (not just cookies) from working at all when inside an iframe. That took me a long time at work to debug. https://stackoverflow.com/questions/67645164/cross-domain-local-storage-using-iframes-block-third-party-cookies https://stackoverflow.com/questions/67645164/cross-domain-lo...
  - sneak 3y ago
    More importantly, instead of silently failing like localStorage should, the attribute on the window object is missing, causing page scripts that don't catch the exception (ie all of them) to crash and usually break the page. I'm pretty sure Google is making disabling cookies as painful and breakage-inducing as possible to make sure people don't flip the switch.
madeofpalk 3y ago
Other browsers have shown this is a false dichotomy. You can disable third party cookies + surveillance AND not have this data still harvested by your browser. Is this better than third-party cookies? Yes, probably. Does Firefox and Safari go better without surveilling your browsing history to serve you ads? Also yes!
- exitheone 3y ago
  Not saying that you are wrong, just mentioning that Safari has the attribution API, which serves a similar goal: https://searchads.apple.com/help/reporting/0028-apple-ads-attribution-api https://searchads.apple.com/help/reporting/0028-apple-ads-at...
HeckFeck 3y ago
The third party tracking was dependent on someone else's processing power and system, this is sinisterly making the user's own software work against his best interest and instead work for a morbid advertiser's interest. Since it is all done in the browser and locally using much more of my data, that data being even more 'relevant' to advertisers, with its results presented as an API to every bloody page I visit, this will only make the tracking problem worse. A related reason is my bookmarks are very much a private affair and this method feels much more intrusive. I dread to think of the security implications. The only upside is that third party cookies will be less of a problem in other browsers, if this new API kills them.
latexr 3y ago
> I'd rather have my machine present this kind of data than have a network of unknown third-parties collaborate by sharing bits about me to build a profile. That’s a bit like saying you’d rather have cameras inside your house streaming your every move than have paparazzi at your door. In the current model, the third parties have to fight and spend resources to get an imperfect profile of you, while you can make their life harder every step of the way. But your browser has access to information those third-parties could never have; it can make a profile from real data without you having the chance to block it. Both are bad for privacy, but the new method is way worse and has the potential to become even more invasive. What if Chrome decides to share your bookmarks? Or settings from your extensions? Or specific pages you visit, including private GitHub repositories for your company? Or full URLs with sensitive keys in them?
- esteth 3y ago
  I don't think it's fair to compare what might happen in the future. In my mind the metaphor is more like "instead of having paparazzi at your door following around, you show everyone a card saying that you like dogs and video games and the steelers, and you tend to shop at big box stores out of town". I'd rather know exactly what I'm presenting, which is possible in this model, than have the paparazzi all over me figuring most of it out imperfectly anyway.
  - lemper 3y ago
    > I'd rather know exactly what I'm presenting, well, do you trust this company to only give those advertisers what you think you're presenting?
jorams 3y ago
There are a few (not that many) things that break on the internet if you turn off third-party cookies, but "I'm no longer being tracked without consent" is not one of them. It's one of the big reasons to get rid of third-party cookies, not an unfortunate side-effect.
Someone 3y ago
This means that your browser starts spying on you, whereas currently, ‘only’ sites do. If you use Chrome, it will use information about all pages you visit, even ones without tracking cookies to categorize you for advertisers. Google says that will happen locally, but even if you trust them, I don’t think that makes much of a difference. You could even see it as “now I pay the bill for getting myself categorized for Google’s ad business”. Soon, Chrome also will start blocking third-party cookies to protect you from evil Meta and its ilk (all because Google wants to protect you from them, not because Meta competes with Google in the advertising space, of course) So, as before, Google won’t be able to see what users do inside Meta’s apps (Facebook, WhatsApp, etc.), but now Meta won’t be able to see what Chrome users do outside them. > but naively I'd rather have my machine present this kind of data It won’t all stay on your machine; a summary of it will be sent to Google so that they can sell targeted ads to advertisers. I expect they’ll have quite a few different tags, including age, gender, and location, and shopping preferences.
dspillett 3y ago
> Can anyone explain to me why this is worse than third-party cookies? How about thinking the other way around: Can you, or anyone else for that matter, explain to me why this is better than commercial interests not following us around at all? > turn off third-party cookies, but a bunch of the internet breaks if you do that Most of what breaks is just tracking for ad serving purposes. I'm fine with that breaking. Some authentication services have trouble, but there are other ways of implementing that, so they could be fixed without needing to keep 3rd party cookies enabled. > I expect that most sites will be forced to make themselves work without third-party cookies As they should, if competently designed. > … but naively I'd rather … Call me dogmatic, but I'd rather not be followed around at all, even as a group. I don't trust that the data cannot be de-anonymised in any way, and I don't trust a company that would gain from that to do its best to make sure it can't happen.
- esteth 3y ago
  I totally appreciate the desire not to want an advertising profile build for you at all! I think that in practice, interest-based-advertising is going to happen, and I think if chrome can provide a way for it to be done without involving so many sketchy third-parties then I'm for that. I don't know a huge amount about the wider ecosystem here, but I can imagine that if chrome were to disable third-party cookies without providing an alternative, then advertisers will go to fairly great lengths to fingerprint you to build a profile. Right now my guess is that Firefox users benefit from the fact that it's probably not worth investing all that much in alternative tracking techniques since you capture the vast majority of people with techniques which work in chromium browsers. Again, I really don't know that much about all this, but my feeling is that this is moving in the right direction, even if it's not the solution I'd ultimately prefer as an individual user.
  - kjkjadksj 3y ago
    I think a big flaw of interest based ads is that my interests rarely line up with what I am in the market for. Say I am interested in some hobby. I probably have all my gear already, and if I buy new gear it means doing enough research to breach through the fog of marketing to see it for what it is. I might spend all my days reading about hobby x online, when I really ought to be advertised the differences of some other products y and z that I actually will buy, which I only see when I visit a physical store and see them together on a shelf.
dbbk 3y ago
You're correct, it is objectively better than third-party cookies.
denton-scratch 3y ago
> but a bunch of the internet breaks if you do that. I hadn't noticed, although I've heard this many times. I mean, I notice some broken pages, but nothing so important that I'd bother working out what's wrong with them. If it's really that the site is checking that the 3d-party cookie they set really got set, and failing to load otherwise, that's an abusive site that I don't want to use anyway.
cm277 3y ago
It's MUCH worse, because if this catches on in any significant way, it makes Google the main (eventually only?) provider of demographic data for audiences/tracking. Google already owns the browser market and almost owns the advertising market, but if you want to try to play outside with your own SEO/direct marketing strategy you may be able to make it work. But in a world where cookies/independent tracking is dead and the only provider is Google? you'll have to go through AdSense. Google needs to be broken up and ground to dust --well, judiciously regulated by a democratically-elected legislature, but in the absence of that, I would take anything. I can't believe this is the "Don't do evil" company.
- toddmorey 3y ago
  This is a really good point. And I think the specific lists of interests will basically be used as a fingerprint.
- jsnell 3y ago
  But the only provider isn't "Google". The browser will provide this data equally to any site asking for it, i.e. all the ad networks that the site is using. Not just to Google. If anything, it is leveling the playing field. All ad networks will get the same interest data, rather than the ones with a higher reach 3rd party cookie having more information.
  - datavirtue 3y ago
    Wow, you are spinning this as a universal good? "Leveling the playing field." Ridiculous. Nothing to see here folks, move on, Google is protecting you.
    - jsnell 3y ago
      No, "universal good" is something you made up. I'm saying that the specific complaint you had was obviously false.
indymike 3y ago
> I don't know a huge amount about it, but naively I'd rather have my machine present this kind of data than have a network of unknown third-parties collaborate by sharing bits about me to build a profile. I don't want either.
Phemist 3y ago
Remember when the :visited modifier on an <a> tag was a thing? https://developer.mozilla.org/en-US/docs/Web/CSS/:visited https://developer.mozilla.org/en-US/docs/Web/CSS/:visited And third-party tracking websites would load their websites up with a bunch of hidden anchors and then through JS read the visited state of these websites to get an accurate fix on a person's identity, or at least of their (relevant) browser history? And how this modifier was removed ASAP once people realised its abuse potential? Basically Google thought this was a good idea after all, and is bringing a "coarse-grained" version of it back.
paholg 3y ago
I've had third party cookies disabled for years. I can't remember the last time a website broke as a result.

Can anyone explain to me why this is worse than third-party cookies? *If* this lets chrome remove third-party cookies, doesn't it effectively increase your pri

by esteth 3y ago

ShowalkKama 3y ago

>but a bunch of the internet breaks if you do that. not really, no. From my experience most stuff works fine (the thing that breaks websites the most is webgl and even then, only the few websites that really need it use it)

dbbk 3y ago
You would be surprised at what breaks. It also prevents local storage (not just cookies) from working at all when inside an iframe. That took me a long time at work to debug. https://stackoverflow.com/questions/67645164/cross-domain-local-storage-using-iframes-block-third-party-cookies https://stackoverflow.com/questions/67645164/cross-domain-lo...
- sneak 3y ago
  More importantly, instead of silently failing like localStorage should, the attribute on the window object is missing, causing page scripts that don't catch the exception (ie all of them) to crash and usually break the page. I'm pretty sure Google is making disabling cookies as painful and breakage-inducing as possible to make sure people don't flip the switch.

madeofpalk 3y ago

Other browsers have shown this is a false dichotomy. You can disable third party cookies + surveillance AND not have this data still harvested by your browser. Is this better than third-party cookies? Yes, probably. Does Firefox and Safari go better without surveilling your browsing history to serve you ads? Also yes!

exitheone 3y ago
Not saying that you are wrong, just mentioning that Safari has the attribution API, which serves a similar goal: https://searchads.apple.com/help/reporting/0028-apple-ads-attribution-api https://searchads.apple.com/help/reporting/0028-apple-ads-at...

HeckFeck 3y ago

The third party tracking was dependent on someone else's processing power and system, this is sinisterly making the user's own software work against his best interest and instead work for a morbid advertiser's interest. Since it is all done in the browser and locally using much more of my data, that data being even more 'relevant' to advertisers, with its results presented as an API to every bloody page I visit, this will only make the tracking problem worse. A related reason is my bookmarks are very much a private affair and this method feels much more intrusive. I dread to think of the security implications. The only upside is that third party cookies will be less of a problem in other browsers, if this new API kills them.

latexr 3y ago

> I'd rather have my machine present this kind of data than have a network of unknown third-parties collaborate by sharing bits about me to build a profile. That’s a bit like saying you’d rather have cameras inside your house streaming your every move than have paparazzi at your door. In the current model, the third parties have to fight and spend resources to get an imperfect profile of you, while you can make their life harder every step of the way. But your browser has access to information those third-parties could never have; it can make a profile from real data without you having the chance to block it. Both are bad for privacy, but the new method is way worse and has the potential to become even more invasive. What if Chrome decides to share your bookmarks? Or settings from your extensions? Or specific pages you visit, including private GitHub repositories for your company? Or full URLs with sensitive keys in them?

esteth 3y ago
I don't think it's fair to compare what might happen in the future. In my mind the metaphor is more like "instead of having paparazzi at your door following around, you show everyone a card saying that you like dogs and video games and the steelers, and you tend to shop at big box stores out of town". I'd rather know exactly what I'm presenting, which is possible in this model, than have the paparazzi all over me figuring most of it out imperfectly anyway.
- lemper 3y ago
  > I'd rather know exactly what I'm presenting, well, do you trust this company to only give those advertisers what you think you're presenting?

jorams 3y ago

There are a few (not that many) things that break on the internet if you turn off third-party cookies, but "I'm no longer being tracked without consent" is not one of them. It's one of the big reasons to get rid of third-party cookies, not an unfortunate side-effect.

Someone 3y ago

This means that your browser starts spying on you, whereas currently, ‘only’ sites do. If you use Chrome, it will use information about all pages you visit, even ones without tracking cookies to categorize you for advertisers. Google says that will happen locally, but even if you trust them, I don’t think that makes much of a difference. You could even see it as “now I pay the bill for getting myself categorized for Google’s ad business”. Soon, Chrome also will start blocking third-party cookies to protect you from evil Meta and its ilk (all because Google wants to protect you from them, not because Meta competes with Google in the advertising space, of course) So, as before, Google won’t be able to see what users do inside Meta’s apps (Facebook, WhatsApp, etc.), but now Meta won’t be able to see what Chrome users do outside them. > but naively I'd rather have my machine present this kind of data It won’t all stay on your machine; a summary of it will be sent to Google so that they can sell targeted ads to advertisers. I expect they’ll have quite a few different tags, including age, gender, and location, and shopping preferences.

dspillett 3y ago

> Can anyone explain to me why this is worse than third-party cookies? How about thinking the other way around: Can you, or anyone else for that matter, explain to me why this is better than commercial interests not following us around at all? > turn off third-party cookies, but a bunch of the internet breaks if you do that Most of what breaks is just tracking for ad serving purposes. I'm fine with that breaking. Some authentication services have trouble, but there are other ways of implementing that, so they could be fixed without needing to keep 3rd party cookies enabled. > I expect that most sites will be forced to make themselves work without third-party cookies As they should, if competently designed. > … but naively I'd rather … Call me dogmatic, but I'd rather not be followed around at all, even as a group. I don't trust that the data cannot be de-anonymised in any way, and I don't trust a company that would gain from that to do its best to make sure it can't happen.

esteth 3y ago
I totally appreciate the desire not to want an advertising profile build for you at all! I think that in practice, interest-based-advertising is going to happen, and I think if chrome can provide a way for it to be done without involving so many sketchy third-parties then I'm for that. I don't know a huge amount about the wider ecosystem here, but I can imagine that if chrome were to disable third-party cookies without providing an alternative, then advertisers will go to fairly great lengths to fingerprint you to build a profile. Right now my guess is that Firefox users benefit from the fact that it's probably not worth investing all that much in alternative tracking techniques since you capture the vast majority of people with techniques which work in chromium browsers. Again, I really don't know that much about all this, but my feeling is that this is moving in the right direction, even if it's not the solution I'd ultimately prefer as an individual user.
- kjkjadksj 3y ago
  I think a big flaw of interest based ads is that my interests rarely line up with what I am in the market for. Say I am interested in some hobby. I probably have all my gear already, and if I buy new gear it means doing enough research to breach through the fog of marketing to see it for what it is. I might spend all my days reading about hobby x online, when I really ought to be advertised the differences of some other products y and z that I actually will buy, which I only see when I visit a physical store and see them together on a shelf.

dbbk 3y ago

You're correct, it is objectively better than third-party cookies.

denton-scratch 3y ago

> but a bunch of the internet breaks if you do that. I hadn't noticed, although I've heard this many times. I mean, I notice some broken pages, but nothing so important that I'd bother working out what's wrong with them. If it's really that the site is checking that the 3d-party cookie they set really got set, and failing to load otherwise, that's an abusive site that I don't want to use anyway.

cm277 3y ago

It's MUCH worse, because if this catches on in any significant way, it makes Google the main (eventually only?) provider of demographic data for audiences/tracking. Google already owns the browser market and almost owns the advertising market, but if you want to try to play outside with your own SEO/direct marketing strategy you may be able to make it work. But in a world where cookies/independent tracking is dead and the only provider is Google? you'll have to go through AdSense. Google needs to be broken up and ground to dust --well, judiciously regulated by a democratically-elected legislature, but in the absence of that, I would take anything. I can't believe this is the "Don't do evil" company.

toddmorey 3y ago
This is a really good point. And I think the specific lists of interests will basically be used as a fingerprint.
jsnell 3y ago
But the only provider isn't "Google". The browser will provide this data equally to any site asking for it, i.e. all the ad networks that the site is using. Not just to Google. If anything, it is leveling the playing field. All ad networks will get the same interest data, rather than the ones with a higher reach 3rd party cookie having more information.
- datavirtue 3y ago
  Wow, you are spinning this as a universal good? "Leveling the playing field." Ridiculous. Nothing to see here folks, move on, Google is protecting you.
  - jsnell 3y ago
    No, "universal good" is something you made up. I'm saying that the specific complaint you had was obviously false.

indymike 3y ago

> I don't know a huge amount about it, but naively I'd rather have my machine present this kind of data than have a network of unknown third-parties collaborate by sharing bits about me to build a profile. I don't want either.

Phemist 3y ago

Remember when the :visited modifier on an <a> tag was a thing? https://developer.mozilla.org/en-US/docs/Web/CSS/:visited https://developer.mozilla.org/en-US/docs/Web/CSS/:visited And third-party tracking websites would load their websites up with a bunch of hidden anchors and then through JS read the visited state of these websites to get an accurate fix on a person's identity, or at least of their (relevant) browser history? And how this modifier was removed ASAP once people realised its abuse potential? Basically Google thought this was a good idea after all, and is bringing a "coarse-grained" version of it back.

paholg 3y ago

I've had third party cookies disabled for years. I can't remember the last time a website broke as a result.