7 ms·
"never allowed" seems to be a stretch, as I remember when Safari disabled them. ITP wasn't that long ago, was it?
by hirsin 3y ago
"never allowed" seems to be a stretch, as I remember when Safari disabled them. ITP wasn't that long ago, was it?
- olliej 3y agoLiterally from the first beta release of safari more than a decade ago 3rd party cookies were not allowed by default. ITP is not about 3rd party cookies, ITP is first and second party cookies where people use indirect load mechanisms to circumvent 3rd party cookie blocking. e.g when people load Facebook buttons and such like directly into a page the 3rd party cookie isn't available in JS but the resource load for the Facebook button allows Facebook (or whoever) to return the tracking identifier directly to the host page so that it can update its own tracking information. ITP (and similar in Firefox) prevents that by saying some variation of "if I see requests to domain X from lots of different domains, we should assume that's being used for tracking purposes, and so not every request to domain X from a domain Y should be completely isolated from queries to domain X from any other domain" so now once you decide the domain X is used for tracking purposes you don't have a "cookies for X" database you have "cookies for X when loaded from Y", "cookies for X when loaded from Z", etc. What google is talking about is not anything approaching ITP, they're literally talking about something even more basic: JS on domain A can't directly interact with cookie information on domain B, which is the 3rd party blocking that is what Safari and WebKit have always done by default.
- hirsin 3y agoWild, I sat in meetings for months with JohnW and the Chrome team to discuss exactly these things but go off.