7 ms·

Google delays third-party cookie demise yet again

162 points by Vinnl 3y ago

dotcoma 3y ago
> This is the third time Google has pushed back its original deadline set in January 2020. What a joke!
acbart 3y ago
I spent over a week upgrading a project last January, over what was supposed to be my winter break... Had to rewrite some of the core internals from scratch to prepare for this. I'm not saying they weren't good changes, but the urgency is not nice haha.
- beeboobaa3 3y ago
  That's just poor time management though
  - vargr616 3y ago
    I don't know why you're downvoted, the original deadline was set for January 2020.
deleted 3y ago
[deleted]
jyunwai 3y ago
Previous discussion on an older decision in 2021 to extend the deadline to 2023: https://news.ycombinator.com/item?id=27617620 https://news.ycombinator.com/item?id=27617620
fancyfredbot 3y ago
Google delays third-party cookie demise in the Chrome browser yet again. Nothing is stopping anyone else from turning off third party cookies.
- oblio 3y ago
  Defaults matter. 95% of people don't change defaults.
  - deleted 3y ago
    [deleted]
  - surajrmal 3y ago
    Chrome is not the default on anything other than android and ChromeOS. Yet it's quite popular to use chrome on Mac, Windows, Linux, and iOS.
    - nicce 3y ago
      When I was young and I did not understand much about computers, and Chromium was also young, I was receiving a somewhat local paper magazine about computers. This magazine had their OWN branded browser, based on Chromium and many used that. Now that I think about, what a gigachad magazine.
    - oblio 3y ago
      Chrome is the "default" on Google and Google is the default search engine for most people.
- criddell 3y ago
  I wonder if that's due to marketshare. Chrome is so dominant, maybe it's the only browser that really matters these days?
nerdjon 3y ago
I am not convinced this is ever going to actually happen. Google won't roll this out until they are sure that their new solution basically has the same effect for advertisers as cookies, but with a new fancy name with "privacy" in it (when its anything but). Google needs to be forced to spin out Chrome to someone else, it is a clear conflict of interest when nearly every (or every? are there any that haven't?) other browser has already taken steps for actual privacy instead of dressing up a new tracking system. While we wait for this to never happen, we should be encouraging everyone to use any other browser so google doesn't have the marketshare to strong-arm the web anymore.
- jsnell 3y ago
  This isn't Google strong-arming the web. This is Google desperately wanting to turn off third-party cookies, and being told again and again by regulators that they aren't allowed to do so.
  - DoubleGlazing 3y ago
    But isn't that a direct by-product of Chrome being owned by Google. If Chrome was made by an independent company regulators couldn't care less if they disabled third party cookies.
    - jsnell 3y ago
      We honestly can't know whether the regulators would care, or whether they would be making different decisions. But that counterfactual seems totally irrelevant to the claims the GP was making?
      - nerdjon 3y ago
        We actually do since other browsers have blocked third party cookies for a several years now.
  - nerdjon 3y ago
    Google has strong armed the web in other situations with Chrome, there are multiple cases of them implementing things that google has proposed to w3c but has not been accepted yet. Regarding this, it's been 4 years. I am not letting google off the hook with this, especially when many other browsers already block third party cookies. I stand by my opinion that an ad company operating a browser is a clear conflict of interest. If they didn't, this "privacy" feature would never have been a thing and this would have been done years ago.
DanielHB 3y ago
the web version of Microsoft Teams doesn't work with 3rd party cookies disabled. I have been eagerly awaiting this change so I can use browser teams, it is the one thing I care about that doesn't work with 3rd party cookies disabled. edit: to my surprise apparently web teams (both "old" and "new") no longer needs 3rd party cookies enabled. Last I checked was a few months ago.
- ethbr1 3y ago
  The only good thing about Teams is the fact that I can use the web version to join meetings and avoid using Teams. It had one @&_+ing job... And they managed to instead product design something with 2 (3?) different chat models, limitations around every corner, an incomplete API for basic use cases (e.g. getting notified of @'s), and an embedded ability to build entire apps inside Teams.
  - SleepilyLimping 3y ago
    One-to-one calls won't work on web Teams for me using Firefox, but group calls will, for some reason.
- akaxaka 3y ago
  You could use Multi-Account Containers in Firefox for MS Browser Teams, to keep their 3rd party cookies contained to themselves (and thus useless).
  - DanielHB 3y ago
    I use Brave, when I want to use browser teams I just open another browser exclusively for that.
- TheJoeMan 3y ago
  Pure speculation, but maybe there's more to this. If Teams refuses to work in Chrome, it might drive run of the mill employees to Edge?
  - 3y ago
ethbr1 3y ago
Meanwhile, in the Chrome MV2 -> MV3 extension saga, it seems like June 2024 is the newest new date in which MV2 may be phased out in pre-stable versions of Chrome. https://developer.chrome.com/blog/resuming-the-transition-to-mv3 https://developer.chrome.com/blog/resuming-the-transition-to... At least, to Google's credit, they're starting to listen to users who give them solid reasons why a surprise migration isn't feasible... tomorrow.
- DamnInteresting 3y ago
  I have a Manifest V2 extension in the Chrome Web Store that has a "featured" badge, and Google has been sending me emails that feel a bit coercive: > To maintain your extension's Featured status, you will need to migrate it to Manifest V3 by June 3rd. [...] Extensions that do not complete this transition will see their Featured badge removed > Manifest Version 3 extensions will be prioritized in the Chrome Web Store, including in search results and recommendations > Beginning June of this year, we will begin to gradually disable extensions running Manifest V2 for Chrome users > Thank you for your cooperation and participation in the Chrome extension ecosystem. I am really dismayed that an advertising company has such a stranglehold on the web. They are not good custodians.
  - surajrmal 3y ago
    Would you rather they deprecate manifest v2 without reaching out to developers to migrate?
    - eviks 3y ago
      Or maybe the alternative to coercion isn't to communicate better but not to deprecate?
    - DamnInteresting 3y ago
      The browser extension I created, and presumably many others, will see no benefit from this forced change. To the contrary, Manifest V3 will hinder the functionality of some extensions, including the widely used and beloved uBlock Origin[1]. Nevertheless, if I wish to keep my extension in the Chrome Web Store, and keep it working in Chrome browsers, I am required to bend to Google's demands and spend a considerable chunk of my time to perform this unnecessary update. And it must be done NOW!, with an artificial sense of urgency. Time is precious, and I'd really rather not donate mine to a multibillion dollar advertising corporation. Google is the primary beneficiary of Manifest V3. They are demonstrating why they abandoned their "Don't be evil" mantra[2]. My browser extension doesn't make money. I made it purely to improve my own browsing experience, and shared it for free with others. It's working fine on Manifest V2, and has done so for years. I have no desire to learn Google's crappy new implementation. [1] https://www.androidauthority.com/google-chrome-manifest-v3-changes-3386506/ https://www.androidauthority.com/google-chrome-manifest-v3-c... [2] https://gizmodo.com/google-removes-nearly-all-mentions-of-dont-be-evil-from-1826153393 https://gizmodo.com/google-removes-nearly-all-mentions-of-do...
deleted 3y ago
[deleted]
nolist_policy 3y ago
Dear CMA, Can you please let Google do the right thing and disable third party cookies like every other browser vendor.
- taf2 3y ago
  Dear Internet user, third party cookies are also used be embedded web applications in services such as salesforce. Cookies are not only used for tracking, but also as an example, secure session allowing the bank to secure your login and also the person on the phone when call in helping you via their login. There are decades worth of applications created that likely will not be fixed…
  - barnabee 3y ago
    Why should all of Society pay so that Saleforce, a profit-making company, doesn't have to maintain its software? I have 3rd party cookies as well as all ads and trackers blocked and have no major issues. On the odd occasion a site doesn't work, it doesn't get my business/attention. Non-technical people should be afforded the same protections.
    - freedomben 3y ago
      I agree with you, but I do think it's fallacious to zero in on Salesforce in the example. That wasn't (likely) intended as a defense of Salesforce, it was just an example showing that there is a long historical usage of third party cookies that aren't purely for ads and tracking. It's impossible to predict how many things might break for people. For me (a uMatrix user and Firefox user) it will be zero. But for people who work and compute inside a corporate office using internal software that was "optimized for IE 6" but they still need to do their job, and the customers they serve (I have no doubt there would be plenty of government offices that will have to tell citizens who need government services to go pound sand), it will be highly disruptive. Dismissing all of those people and use cases with "who cares about Salesforce" is myopic and (for anyone with decision making ability) deeply irresponsible. That said, this has been on the table now for years so it's time for the operators of these old apps to feel the heat. The Times They Are A-Changin'
denton-scratch 3y ago
It looks to me that the only reason Google is pursuing "Privacy Sandbox" is because Chrome dominates the browser marketplace. (I put it in quotes because it neither preserves privacy, nor is it a sandbox). If I don't want 3rd-party cookies (I don't!) then I just toggle them off in Firefox. Sandbox is opaque in the sense that ordinary users can't hope to understand it; and a privacy guarantee is useless, if the user can't understand it. WTF is k-anonymity? I looked it up on Wikipedia, and I still don't understand it. I guess that's why the Competition and Markets Authority is involved.
- jampekka 3y ago
  k-anonymity means there must be at least k persons (or similar) that have identical data in the dataset. E.g. with k=5 there has to be at least 5 rows for each unique set of column values. It's easily broken if multiple such datasets are combined. And that's probably exactly what the commercial surveillance industry does.
- Nifty3929 3y ago
  K-anonymity is where you determine that you need at least K individuals in a group with a certain number of shared personal information such that you can't identify individuals within that group. For example, people >2m tall with January birthdays who's favorite color is red. If there was only one person in that group then you could identify them, so you shouldn't use that grouping. But if there are 1000 people in that group (in your dataset), then you can't ID them, so it's okay.
bluejekyll 3y ago
It would be good to stabilize and have widespread support for CHIPS before disable 3rd party cookies entirely, there are use cases beyond advertising for these. https://developer.mozilla.org/en-US/docs/Web/Privacy/Privacy_sandbox/Partitioned_cookies https://developer.mozilla.org/en-US/docs/Web/Privacy/Privacy...
- p4bl0 3y ago
  What are the use cases beyond tracking that make the tradeoff worth having 3rd party cookies?
  - bluejekyll 3y ago
    Embedding content from one site to another like with an iframe, that requires cookie based credentialed login. As far as I’m aware, Cookies are still the safest way to use session tokens and require the browser to keep those hidden from JS environments with http-only, reducing the risk of XSS attacks.
grishka 3y ago
Why don't they just unilaterally disable third-party cookies by default without providing any replacement? The only slightly valuable functionality that would be lost would be authentication in comment widgets like Disqus. Ah, right, the makers of the world's most popular web browser are also the world's most profitable online advertising company, that's why.
- SquareWheel 3y ago
  >Why don't they just unilaterally disable third-party cookies by default without providing any replacement? It's explained in the article, and below in this thread. They legally cannot due to intervention from the CMA.
  - freedomben 3y ago
    I do love when rhetorical questions actually have a simple answer. I'll admit I had a similar thought as GP (though I wouldn't have posted that thought as a comment without at least taking a look to verify my assumptions). I'm glad to see that it isn't a simple conflict-of-interest with their business that is holding it up. A great pro-tip I try to follow (but sometimes fail since this is human nature): don't make assumptions, and don't be over-confident if you don't know. It can be especially embarrassing if TFA is quite short and well covered
    - surajrmal 3y ago
      I think the CMA does think it's a conflict of interest which is why they are stepping in. It seems like they think it's in Google's favor to remove third party cookies without a replacement.
      - freedomben 3y ago
        Thanks that is interesting. To be clear though I meant a conflict-of-interest inside of Google. E.g. the ad division influencing the browser division to slow the roll to avoid damaging revenues/sales. But I hadn't even considered that this might benefit Google, but that certainly makes sense! I'm grateful for good old British skepticism :-) Looking forward to their findings.
deleted 3y ago
[deleted]
broast 3y ago
Good enough for me. Chrome's implementation of partitioned cookies does not work for our use-case, though Firefox's implementation works well. Google has still got some work to do before they go ahead and break everyone's web apps, in my opinion: https://github.com/privacycg/CHIPS/issues/82 https://github.com/privacycg/CHIPS/issues/82
- shkkmo 3y ago
  One additonal security mechanism you might suggest: The opener specifically whitelists the embeder's domain in a response header.
- deleted 3y ago
  [deleted]
delish 3y ago
I pay for Youtube Premium, which uses third-party cookies to not show ads on embedded videos. https://privacysandbox.com https://privacysandbox.com talks about advertising, but not "logged in elsewhere" functionality. Does Youtube or Google have something ready, or will all Youtube Premium subscribers see ads on embedded videos?
- janpieterz 3y ago
  There is also a Federated Credential Management (FedCN) API coming in, that should help somewhat. https://developer.mozilla.org/en-US/docs/Web/API/FedCM_API https://developer.mozilla.org/en-US/docs/Web/API/FedCM_API
  - delish 3y ago
    Thank you! Will look!
- wlll 3y ago
  Perhaps they should switch to first party cookies?
  - bitvoid 3y ago
    How would that work on embedded videos on sites outside of YouTube/Google, which is what the parent comment is talking about?
    - deleted 3y ago
      [deleted]
    - 93po 3y ago
      Aren't those just iframes, which is effectively just youtube loading inside an existing web page instead of its own tab. I would assume first party cookies would work just fine for this.
      - 3y ago
daft_pink 3y ago
Die a hero or live to see yourself become a villain.
deleted 3y ago
[deleted]
olliej 3y ago
All Google had to do was not enable 3rd party cookies in chrome. Safari and WebKit by default have always blocked 3rd party cookies by default - literally from day 1 - but google added support for them and enabled them by default because their business model requires spying on users. If they had just not added this tracking vector in the first place this would not be something to debate.
- lern_too_spel 3y ago
  Literally from day 6,286: https://webkit.org/blog/10218/full-third-party-cookie-blocking-and-more/ https://webkit.org/blog/10218/full-third-party-cookie-blocki... Did Safari also originally enable third party cookies by default for the purpose of enabling spying on its users?
  - olliej 3y ago
    I was going to make a snarky comment, but I realized it's possible you just don't know how cookies, 3rd party or otherwise, work. 3rd party cookies are the original way advertising companies spied on users, and the only way the vast majority of companies can spy on you. What they do is make is so that when you request a resource you can attach cookies to the request that are not from the domain making the request, so that if you have multiple unrelated sites requesting https://advertiser.com/resource https://advertiser.com/resource they will share the same cookies and allow the operator of advertiser.com to uniquely identify the same user regardless of the site actually being visited. Wikipedia has a big page on this specific technical concept: https://en.wikipedia.org/wiki/Third-party_cookies https://en.wikipedia.org/wiki/Third-party_cookies This is what a "3rd party cookie" is in the context of blocking "3rd party cookies", and this is what more or less every browser other than chrome now does (except maybe edge?). Safari has had blocking 3rd party cookies be the default behavior since the very first betas. It was the first browser to do this by years, to this day I'm not sure why Firefox didn't immediately follow suit, but that's something best answered by someone from Mozilla of the era. The article you're pointing to is discussing a further hardening of the restrictions, ITP, and origin based cookie segregation. These are all increases in the degree to which cookies are blocked, and these are necessary specifically to deal with privacy invasive tracking that companies like google and Facebook are able to do. For the overwhelming majority of tracking networks simply blocking 3rd party cookies is sufficient. But over the last decade or so companies like Google have aggressively introduced new mechanisms to promote their 3rd party cookies into the sets that can be shared. Google has been very aggressive in this by working extremely hard to get as many webdevs as possible to add spyware to their pages to get "metrics". There are numerous steps they take - redirect loops were in vogue for a while, i'm not sure what they're doing now - basically trying to either link a cookie from the domain embedding the tracking code to a cookie on the advertisers domain, or promote the "3rd party" domain into being part of the primary site. Defeating that requires cookie segregation (so that every site you visit has a different cookie vault for every different origin it contacts), and things like "tracking protection" which tries to detect sites that are being pinged from many different origins (implying they're for tracking rather than site content) and severely curtailing any cookies for those origins. The post you linked to is talking about that, and it sounds like an end game step which is that loads to any resource from a different origin gets no cookie state at all, which historically didn't seem possible due to many weird ways sites managed account login and the like but maybe things have changed since then. This world of cookie segregation and tracking prevention is _significantly_ stricter and more powerful protection, and is far beyond the "3rd party cookie blocking" that google is still delaying to this day, and has been something safari and Firefox have been doing for years, but it came after, and in response to, companies like google trying to circumvent the privacy provided by 3rd party cookie blocking. This is also why google is now talking about blocking 3rd party cookies - they've spent more than a decade come up with ways to track people in spite of 3rd party cookie blocking, and they have no implemented any of the privacy protections Firefox and safari have been shipping for years (nor is chrome likely to implement anything of the kind). Google (and FB, etc) are in a position where they can do this, but smaller advertising networks can't (google has tracking code on almost every page as part of their "we'll provide you with analytics/metrics" scam).

162 points by Vinnl 3y ago

> This is the third time Google has pushed back its original deadline set in January 2020. What a joke!

I spent over a week upgrading a project last January, over what was supposed to be my winter break... Had to rewrite some of the core internals from scratch to prepare for this. I'm not saying they weren't good changes, but the urgency is not nice haha.

beeboobaa3 3y ago
That's just poor time management though
- vargr616 3y ago
  I don't know why you're downvoted, the original deadline was set for January 2020.

deleted 3y ago

[deleted]

jyunwai 3y ago

Previous discussion on an older decision in 2021 to extend the deadline to 2023: https://news.ycombinator.com/item?id=27617620 https://news.ycombinator.com/item?id=27617620

fancyfredbot 3y ago

Google delays third-party cookie demise in the Chrome browser yet again. Nothing is stopping anyone else from turning off third party cookies.

oblio 3y ago
Defaults matter. 95% of people don't change defaults.
- deleted 3y ago
  [deleted]
- surajrmal 3y ago
  Chrome is not the default on anything other than android and ChromeOS. Yet it's quite popular to use chrome on Mac, Windows, Linux, and iOS.
  - nicce 3y ago
    When I was young and I did not understand much about computers, and Chromium was also young, I was receiving a somewhat local paper magazine about computers. This magazine had their OWN branded browser, based on Chromium and many used that. Now that I think about, what a gigachad magazine.
  - oblio 3y ago
    Chrome is the "default" on Google and Google is the default search engine for most people.
criddell 3y ago
I wonder if that's due to marketshare. Chrome is so dominant, maybe it's the only browser that really matters these days?

nerdjon 3y ago

I am not convinced this is ever going to actually happen. Google won't roll this out until they are sure that their new solution basically has the same effect for advertisers as cookies, but with a new fancy name with "privacy" in it (when its anything but). Google needs to be forced to spin out Chrome to someone else, it is a clear conflict of interest when nearly every (or every? are there any that haven't?) other browser has already taken steps for actual privacy instead of dressing up a new tracking system. While we wait for this to never happen, we should be encouraging everyone to use any other browser so google doesn't have the marketshare to strong-arm the web anymore.

jsnell 3y ago
This isn't Google strong-arming the web. This is Google desperately wanting to turn off third-party cookies, and being told again and again by regulators that they aren't allowed to do so.
- DoubleGlazing 3y ago
  But isn't that a direct by-product of Chrome being owned by Google. If Chrome was made by an independent company regulators couldn't care less if they disabled third party cookies.
  - jsnell 3y ago
    We honestly can't know whether the regulators would care, or whether they would be making different decisions. But that counterfactual seems totally irrelevant to the claims the GP was making?
    - nerdjon 3y ago
      We actually do since other browsers have blocked third party cookies for a several years now.
- nerdjon 3y ago
  Google has strong armed the web in other situations with Chrome, there are multiple cases of them implementing things that google has proposed to w3c but has not been accepted yet. Regarding this, it's been 4 years. I am not letting google off the hook with this, especially when many other browsers already block third party cookies. I stand by my opinion that an ad company operating a browser is a clear conflict of interest. If they didn't, this "privacy" feature would never have been a thing and this would have been done years ago.

DanielHB 3y ago

the web version of Microsoft Teams doesn't work with 3rd party cookies disabled. I have been eagerly awaiting this change so I can use browser teams, it is the one thing I care about that doesn't work with 3rd party cookies disabled. edit: to my surprise apparently web teams (both "old" and "new") no longer needs 3rd party cookies enabled. Last I checked was a few months ago.

ethbr1 3y ago
The only good thing about Teams is the fact that I can use the web version to join meetings and avoid using Teams. It had one @&_+ing job... And they managed to instead product design something with 2 (3?) different chat models, limitations around every corner, an incomplete API for basic use cases (e.g. getting notified of @'s), and an embedded ability to build entire apps inside Teams.
- SleepilyLimping 3y ago
  One-to-one calls won't work on web Teams for me using Firefox, but group calls will, for some reason.
akaxaka 3y ago
You could use Multi-Account Containers in Firefox for MS Browser Teams, to keep their 3rd party cookies contained to themselves (and thus useless).
- DanielHB 3y ago
  I use Brave, when I want to use browser teams I just open another browser exclusively for that.
TheJoeMan 3y ago
Pure speculation, but maybe there's more to this. If Teams refuses to work in Chrome, it might drive run of the mill employees to Edge?
- 3y ago

ethbr1 3y ago

Meanwhile, in the Chrome MV2 -> MV3 extension saga, it seems like June 2024 is the newest new date in which MV2 may be phased out in pre-stable versions of Chrome. https://developer.chrome.com/blog/resuming-the-transition-to-mv3 https://developer.chrome.com/blog/resuming-the-transition-to... At least, to Google's credit, they're starting to listen to users who give them solid reasons why a surprise migration isn't feasible... tomorrow.

DamnInteresting 3y ago
I have a Manifest V2 extension in the Chrome Web Store that has a "featured" badge, and Google has been sending me emails that feel a bit coercive: > To maintain your extension's Featured status, you will need to migrate it to Manifest V3 by June 3rd. [...] Extensions that do not complete this transition will see their Featured badge removed > Manifest Version 3 extensions will be prioritized in the Chrome Web Store, including in search results and recommendations > Beginning June of this year, we will begin to gradually disable extensions running Manifest V2 for Chrome users > Thank you for your cooperation and participation in the Chrome extension ecosystem. I am really dismayed that an advertising company has such a stranglehold on the web. They are not good custodians.
- surajrmal 3y ago
  Would you rather they deprecate manifest v2 without reaching out to developers to migrate?
  - eviks 3y ago
    Or maybe the alternative to coercion isn't to communicate better but not to deprecate?
  - DamnInteresting 3y ago
    The browser extension I created, and presumably many others, will see no benefit from this forced change. To the contrary, Manifest V3 will hinder the functionality of some extensions, including the widely used and beloved uBlock Origin[1]. Nevertheless, if I wish to keep my extension in the Chrome Web Store, and keep it working in Chrome browsers, I am required to bend to Google's demands and spend a considerable chunk of my time to perform this unnecessary update. And it must be done NOW!, with an artificial sense of urgency. Time is precious, and I'd really rather not donate mine to a multibillion dollar advertising corporation. Google is the primary beneficiary of Manifest V3. They are demonstrating why they abandoned their "Don't be evil" mantra[2]. My browser extension doesn't make money. I made it purely to improve my own browsing experience, and shared it for free with others. It's working fine on Manifest V2, and has done so for years. I have no desire to learn Google's crappy new implementation. [1] https://www.androidauthority.com/google-chrome-manifest-v3-changes-3386506/ https://www.androidauthority.com/google-chrome-manifest-v3-c... [2] https://gizmodo.com/google-removes-nearly-all-mentions-of-dont-be-evil-from-1826153393 https://gizmodo.com/google-removes-nearly-all-mentions-of-do...

deleted 3y ago

[deleted]

nolist_policy 3y ago

Dear CMA, Can you please let Google do the right thing and disable third party cookies like every other browser vendor.

taf2 3y ago
Dear Internet user, third party cookies are also used be embedded web applications in services such as salesforce. Cookies are not only used for tracking, but also as an example, secure session allowing the bank to secure your login and also the person on the phone when call in helping you via their login. There are decades worth of applications created that likely will not be fixed…
- barnabee 3y ago
  Why should all of Society pay so that Saleforce, a profit-making company, doesn't have to maintain its software? I have 3rd party cookies as well as all ads and trackers blocked and have no major issues. On the odd occasion a site doesn't work, it doesn't get my business/attention. Non-technical people should be afforded the same protections.
  - freedomben 3y ago
    I agree with you, but I do think it's fallacious to zero in on Salesforce in the example. That wasn't (likely) intended as a defense of Salesforce, it was just an example showing that there is a long historical usage of third party cookies that aren't purely for ads and tracking. It's impossible to predict how many things might break for people. For me (a uMatrix user and Firefox user) it will be zero. But for people who work and compute inside a corporate office using internal software that was "optimized for IE 6" but they still need to do their job, and the customers they serve (I have no doubt there would be plenty of government offices that will have to tell citizens who need government services to go pound sand), it will be highly disruptive. Dismissing all of those people and use cases with "who cares about Salesforce" is myopic and (for anyone with decision making ability) deeply irresponsible. That said, this has been on the table now for years so it's time for the operators of these old apps to feel the heat. The Times They Are A-Changin'

denton-scratch 3y ago

It looks to me that the only reason Google is pursuing "Privacy Sandbox" is because Chrome dominates the browser marketplace. (I put it in quotes because it neither preserves privacy, nor is it a sandbox). If I don't want 3rd-party cookies (I don't!) then I just toggle them off in Firefox. Sandbox is opaque in the sense that ordinary users can't hope to understand it; and a privacy guarantee is useless, if the user can't understand it. WTF is k-anonymity? I looked it up on Wikipedia, and I still don't understand it. I guess that's why the Competition and Markets Authority is involved.

jampekka 3y ago
k-anonymity means there must be at least k persons (or similar) that have identical data in the dataset. E.g. with k=5 there has to be at least 5 rows for each unique set of column values. It's easily broken if multiple such datasets are combined. And that's probably exactly what the commercial surveillance industry does.
Nifty3929 3y ago
K-anonymity is where you determine that you need at least K individuals in a group with a certain number of shared personal information such that you can't identify individuals within that group. For example, people >2m tall with January birthdays who's favorite color is red. If there was only one person in that group then you could identify them, so you shouldn't use that grouping. But if there are 1000 people in that group (in your dataset), then you can't ID them, so it's okay.

bluejekyll 3y ago

It would be good to stabilize and have widespread support for CHIPS before disable 3rd party cookies entirely, there are use cases beyond advertising for these. https://developer.mozilla.org/en-US/docs/Web/Privacy/Privacy_sandbox/Partitioned_cookies https://developer.mozilla.org/en-US/docs/Web/Privacy/Privacy...

p4bl0 3y ago
What are the use cases beyond tracking that make the tradeoff worth having 3rd party cookies?
- bluejekyll 3y ago
  Embedding content from one site to another like with an iframe, that requires cookie based credentialed login. As far as I’m aware, Cookies are still the safest way to use session tokens and require the browser to keep those hidden from JS environments with http-only, reducing the risk of XSS attacks.

grishka 3y ago

Why don't they just unilaterally disable third-party cookies by default without providing any replacement? The only slightly valuable functionality that would be lost would be authentication in comment widgets like Disqus. Ah, right, the makers of the world's most popular web browser are also the world's most profitable online advertising company, that's why.

SquareWheel 3y ago
>Why don't they just unilaterally disable third-party cookies by default without providing any replacement? It's explained in the article, and below in this thread. They legally cannot due to intervention from the CMA.
- freedomben 3y ago
  I do love when rhetorical questions actually have a simple answer. I'll admit I had a similar thought as GP (though I wouldn't have posted that thought as a comment without at least taking a look to verify my assumptions). I'm glad to see that it isn't a simple conflict-of-interest with their business that is holding it up. A great pro-tip I try to follow (but sometimes fail since this is human nature): don't make assumptions, and don't be over-confident if you don't know. It can be especially embarrassing if TFA is quite short and well covered
  - surajrmal 3y ago
    I think the CMA does think it's a conflict of interest which is why they are stepping in. It seems like they think it's in Google's favor to remove third party cookies without a replacement.
    - freedomben 3y ago
      Thanks that is interesting. To be clear though I meant a conflict-of-interest inside of Google. E.g. the ad division influencing the browser division to slow the roll to avoid damaging revenues/sales. But I hadn't even considered that this might benefit Google, but that certainly makes sense! I'm grateful for good old British skepticism :-) Looking forward to their findings.

deleted 3y ago

[deleted]

broast 3y ago

Good enough for me. Chrome's implementation of partitioned cookies does not work for our use-case, though Firefox's implementation works well. Google has still got some work to do before they go ahead and break everyone's web apps, in my opinion: https://github.com/privacycg/CHIPS/issues/82 https://github.com/privacycg/CHIPS/issues/82

shkkmo 3y ago
One additonal security mechanism you might suggest: The opener specifically whitelists the embeder's domain in a response header.
deleted 3y ago
[deleted]

delish 3y ago

I pay for Youtube Premium, which uses third-party cookies to not show ads on embedded videos. https://privacysandbox.com https://privacysandbox.com talks about advertising, but not "logged in elsewhere" functionality. Does Youtube or Google have something ready, or will all Youtube Premium subscribers see ads on embedded videos?

janpieterz 3y ago
There is also a Federated Credential Management (FedCN) API coming in, that should help somewhat. https://developer.mozilla.org/en-US/docs/Web/API/FedCM_API https://developer.mozilla.org/en-US/docs/Web/API/FedCM_API
- delish 3y ago
  Thank you! Will look!
wlll 3y ago
Perhaps they should switch to first party cookies?
- bitvoid 3y ago
  How would that work on embedded videos on sites outside of YouTube/Google, which is what the parent comment is talking about?
  - deleted 3y ago
    [deleted]
  - 93po 3y ago
    Aren't those just iframes, which is effectively just youtube loading inside an existing web page instead of its own tab. I would assume first party cookies would work just fine for this.
    - 3y ago

daft_pink 3y ago

Die a hero or live to see yourself become a villain.

deleted 3y ago

[deleted]

olliej 3y ago

All Google had to do was not enable 3rd party cookies in chrome. Safari and WebKit by default have always blocked 3rd party cookies by default - literally from day 1 - but google added support for them and enabled them by default because their business model requires spying on users. If they had just not added this tracking vector in the first place this would not be something to debate.

lern_too_spel 3y ago
Literally from day 6,286: https://webkit.org/blog/10218/full-third-party-cookie-blocking-and-more/ https://webkit.org/blog/10218/full-third-party-cookie-blocki... Did Safari also originally enable third party cookies by default for the purpose of enabling spying on its users?
- olliej 3y ago
  I was going to make a snarky comment, but I realized it's possible you just don't know how cookies, 3rd party or otherwise, work. 3rd party cookies are the original way advertising companies spied on users, and the only way the vast majority of companies can spy on you. What they do is make is so that when you request a resource you can attach cookies to the request that are not from the domain making the request, so that if you have multiple unrelated sites requesting https://advertiser.com/resource https://advertiser.com/resource they will share the same cookies and allow the operator of advertiser.com to uniquely identify the same user regardless of the site actually being visited. Wikipedia has a big page on this specific technical concept: https://en.wikipedia.org/wiki/Third-party_cookies https://en.wikipedia.org/wiki/Third-party_cookies This is what a "3rd party cookie" is in the context of blocking "3rd party cookies", and this is what more or less every browser other than chrome now does (except maybe edge?). Safari has had blocking 3rd party cookies be the default behavior since the very first betas. It was the first browser to do this by years, to this day I'm not sure why Firefox didn't immediately follow suit, but that's something best answered by someone from Mozilla of the era. The article you're pointing to is discussing a further hardening of the restrictions, ITP, and origin based cookie segregation. These are all increases in the degree to which cookies are blocked, and these are necessary specifically to deal with privacy invasive tracking that companies like google and Facebook are able to do. For the overwhelming majority of tracking networks simply blocking 3rd party cookies is sufficient. But over the last decade or so companies like Google have aggressively introduced new mechanisms to promote their 3rd party cookies into the sets that can be shared. Google has been very aggressive in this by working extremely hard to get as many webdevs as possible to add spyware to their pages to get "metrics". There are numerous steps they take - redirect loops were in vogue for a while, i'm not sure what they're doing now - basically trying to either link a cookie from the domain embedding the tracking code to a cookie on the advertisers domain, or promote the "3rd party" domain into being part of the primary site. Defeating that requires cookie segregation (so that every site you visit has a different cookie vault for every different origin it contacts), and things like "tracking protection" which tries to detect sites that are being pinged from many different origins (implying they're for tracking rather than site content) and severely curtailing any cookies for those origins. The post you linked to is talking about that, and it sounds like an end game step which is that loads to any resource from a different origin gets no cookie state at all, which historically didn't seem possible due to many weird ways sites managed account login and the like but maybe things have changed since then. This world of cookie segregation and tracking prevention is _significantly_ stricter and more powerful protection, and is far beyond the "3rd party cookie blocking" that google is still delaying to this day, and has been something safari and Firefox have been doing for years, but it came after, and in response to, companies like google trying to circumvent the privacy provided by 3rd party cookie blocking. This is also why google is now talking about blocking 3rd party cookies - they've spent more than a decade come up with ways to track people in spite of 3rd party cookie blocking, and they have no implemented any of the privacy protections Firefox and safari have been shipping for years (nor is chrome likely to implement anything of the kind). Google (and FB, etc) are in a position where they can do this, but smaller advertising networks can't (google has tracking code on almost every page as part of their "we'll provide you with analytics/metrics" scam).