5 ms·

Third Party Cookies Must Be Removed from the Web Platform

67 points by Vinnl 2y ago

deleted 2y ago
[deleted]
jsheard 2y ago
They're being diplomatic by vaugely gesturing that "not all browsers" have dropped third party cookies, but isn't this squarely directed at Google? The only other two browser engines that matter have already done it.
- afavour 2y ago
  Yes. This comes very shortly after Google announced (in very “our incredible journey” style) that they’re dropping their plans to deprecate third party cookies: https://privacysandbox.com/news/privacy-sandbox-update https://privacysandbox.com/news/privacy-sandbox-update I’m very happy to see this being called out. Reading between the lines it would seem Google’s ad arm has seen the effects of other browsers banning third party cookies and said “no way you’re doing this, Chrome”. I’m sure the Chrome engineers are livid about it (but that’s the deal they make by working there, I suppose)
  - plorkyeran 2y ago
    There's been a lot of speculation that it's the other way around; removing third party cookies doesn't hurt Google's ad tracking but it does hurt the other advertisers who don't control the dominant browser, so they got spooked on antitrust grounds.
- maroonblazer 2y ago
  They link to Google's recent statement so I'd say they're not being vague at all :-)
- namdnay 2y ago
  to be fair, google knew that if they continued, edge would immediately announce that they're not going to do it (at least when in an enterprise setting) and immediately gobble up all the ground they have lost to google on corporate deployments
- namdnay 2y ago
  no one is running enterprise software on safari or firefox. it's chrome/edge or IE
maroonblazer 2y ago
> Some recent good examples of the designed-for-purpose approach include: > FedCM. Third-party cookies have been used to support single sign-on. FedCM is a set of technologies built to support identity federation, without replicating all functionality of third-party cookies. >CHIPS. The goal of CHIPS is to allow state, without supporting correlation or tracking between web sites which don't know they are collaborating, for example, when embedding third-party services like customer service webchat. I've not heard of these two approaches. Can anyone vouch for their efficacy?
- namdnay 2y ago
  CHIPS is a nice solution, the problem is how it interacts with SSO IDP login pages. 99% of IDPs in an enterprise setting are configured to refuse being framed (for "security" reasons). What does this mean? That any embedded component that needs to log the user in needs to trigger a popup window - but wait, a popup window isn't in the same cookie partition as the iframe! Some clever people at Google did come up with a solution for this, "pop-ins": https://github.com/explainers-by-googlers/partitioned-popins https://github.com/explainers-by-googlers/partitioned-popins , which would have allowed cookie partitioning without breaking every enterprise integration out there
  - mschuster91 2y ago
    "99% of IDPs in an enterprise setting are configured to refuse being framed (for "security" reasons)" No need for the quotation around "security". Clickjacks and other forms of attacks involving iframing authentication providers are a real threat.
    - namdnay 2y ago
      yes, fair enough
- cowsup 2y ago
  To explain CHIPS very simply: In the Internet of yore, if you loaded example.com and it had facebook.com embedded, then facebook.com would be able to access all of the facebook.com cookies. This is fine on paper, but Facebook encouraged well-meaning website owners to add a "Share" button to encourage organic sharing of their website. When users loaded a page with this button, that embed would get access to all of the facebook.com cookies, thus being able to know who you are, and the site you were visiting from. They'd record this and use it for advertisements. With CHIPS, you can login to Facebook.com and your cookies are stored in the "cookie jar" labelled "facebook.com." Then, when you go to example.com, the "cookie jar" that the Facebook embed can use is "example.com->facebook.com." This means that Facebook cannot use cookies to track you across every website. Unlike outright blocking cookies, however, CHIPS still allow well-behaved embeds to function. This allows customer service chatrooms to retain history, videos to remember where you last stopped, and so forth, even on subsequent refreshes, since they can read and write to their own "example.com->[embedded site domain]" cookie jar. This compromise perfectly breaks cross-site tracking, while allowing useful third-party embeds to still operate.
daft_pink 2y ago
If the browsers dump third party cookies, isn’t there just going to be some other technology to get around it and use first party cookies the same way we use third party cookies? Is it really the technology that is the problem or is it the fact that companies have entire business models on tracking and surveillance that appears to be very profitable.
- solardev 2y ago
  Yes, they basically move towards server-side integrations and tracking.
- ethbr1 2y ago
  It's that the primary browser vendor is an ad company.
- afavour 2y ago
  Browsers have the ultimate power here. You can’t make something with the tracking power of third party cookies unless browser APIs let you.
  - namdnay 2y ago
    you can but it's several orders of magnitude more expensive. ad networks would have to propose backend integrations to each website, it just wouldn't be profitable unless the sites are huge
    - zuppy 2y ago
      not really. as long as you own the domain, you can put a cname to one of their servers and voila… server side tracking with first party cookies.
- donatzsky 2y ago
  This is already possible with Google Tag Manager. It was here on HN recently.
- lofenfew 2y ago
namdnay 2y ago
The thing is, there are two "webs" As much as third party cookies are dangerous and unnecessary in a personal browsing setting, they are unfortunately a fact of life in the wonderful world of enterprise. that embedded Salesforce widget inside the SAP module of the Atlassian tool runs on a toxic mix of iframes and single-sign-on, and no-one in the company wants to have to go and rewrite it because someone at google wants to make the world a better place
- nottorp 2y ago
  > someone at google wants to make the world a better place Someone at... where?
- afavour 2y ago
  Then let the enterprise world deploy some custom config that allows third party cookies for whatever domains they need. But disable by default.
  - namdnay 2y ago
    it's possible using group policies, but imagine the complexity of getting the IT empires of a megacorp to approve and deploy this kind of stuff - it would be a nightmare. Then microsoft come in and say "hey, just use Edge, we're Enterprisey just like you - we understand you guys. we'll disable this crap by default"
    - afavour 2y ago
      It’s been a long time but IIRC something akin to this already happened. There’s a group policy letting you open specific sites in “IE mode” in Edge, typically for old intranet systems that require IE and aren’t going to be updated: https://learn.microsoft.com/en-us/deployedge/edge-ie-mode-policies https://learn.microsoft.com/en-us/deployedge/edge-ie-mode-po... So yeah, it’s not simple, but it’s been done before and the concept works.
  - calvinmorrison 2y ago
    That's the mystery to me. Cookies are up to the client. I'm always baffled about cookie legislation
deleted 2y ago
[deleted]

67 points by Vinnl 2y ago

deleted 2y ago

[deleted]

They're being diplomatic by vaugely gesturing that "not all browsers" have dropped third party cookies, but isn't this squarely directed at Google? The only other two browser engines that matter have already done it.

afavour 2y ago
Yes. This comes very shortly after Google announced (in very “our incredible journey” style) that they’re dropping their plans to deprecate third party cookies: https://privacysandbox.com/news/privacy-sandbox-update https://privacysandbox.com/news/privacy-sandbox-update I’m very happy to see this being called out. Reading between the lines it would seem Google’s ad arm has seen the effects of other browsers banning third party cookies and said “no way you’re doing this, Chrome”. I’m sure the Chrome engineers are livid about it (but that’s the deal they make by working there, I suppose)
- plorkyeran 2y ago
  There's been a lot of speculation that it's the other way around; removing third party cookies doesn't hurt Google's ad tracking but it does hurt the other advertisers who don't control the dominant browser, so they got spooked on antitrust grounds.
maroonblazer 2y ago
They link to Google's recent statement so I'd say they're not being vague at all :-)
namdnay 2y ago
to be fair, google knew that if they continued, edge would immediately announce that they're not going to do it (at least when in an enterprise setting) and immediately gobble up all the ground they have lost to google on corporate deployments
namdnay 2y ago
no one is running enterprise software on safari or firefox. it's chrome/edge or IE

maroonblazer 2y ago

> Some recent good examples of the designed-for-purpose approach include: > FedCM. Third-party cookies have been used to support single sign-on. FedCM is a set of technologies built to support identity federation, without replicating all functionality of third-party cookies. >CHIPS. The goal of CHIPS is to allow state, without supporting correlation or tracking between web sites which don't know they are collaborating, for example, when embedding third-party services like customer service webchat. I've not heard of these two approaches. Can anyone vouch for their efficacy?

namdnay 2y ago
CHIPS is a nice solution, the problem is how it interacts with SSO IDP login pages. 99% of IDPs in an enterprise setting are configured to refuse being framed (for "security" reasons). What does this mean? That any embedded component that needs to log the user in needs to trigger a popup window - but wait, a popup window isn't in the same cookie partition as the iframe! Some clever people at Google did come up with a solution for this, "pop-ins": https://github.com/explainers-by-googlers/partitioned-popins https://github.com/explainers-by-googlers/partitioned-popins , which would have allowed cookie partitioning without breaking every enterprise integration out there
- mschuster91 2y ago
  "99% of IDPs in an enterprise setting are configured to refuse being framed (for "security" reasons)" No need for the quotation around "security". Clickjacks and other forms of attacks involving iframing authentication providers are a real threat.
  - namdnay 2y ago
    yes, fair enough
cowsup 2y ago
To explain CHIPS very simply: In the Internet of yore, if you loaded example.com and it had facebook.com embedded, then facebook.com would be able to access all of the facebook.com cookies. This is fine on paper, but Facebook encouraged well-meaning website owners to add a "Share" button to encourage organic sharing of their website. When users loaded a page with this button, that embed would get access to all of the facebook.com cookies, thus being able to know who you are, and the site you were visiting from. They'd record this and use it for advertisements. With CHIPS, you can login to Facebook.com and your cookies are stored in the "cookie jar" labelled "facebook.com." Then, when you go to example.com, the "cookie jar" that the Facebook embed can use is "example.com->facebook.com." This means that Facebook cannot use cookies to track you across every website. Unlike outright blocking cookies, however, CHIPS still allow well-behaved embeds to function. This allows customer service chatrooms to retain history, videos to remember where you last stopped, and so forth, even on subsequent refreshes, since they can read and write to their own "example.com->[embedded site domain]" cookie jar. This compromise perfectly breaks cross-site tracking, while allowing useful third-party embeds to still operate.

daft_pink 2y ago

If the browsers dump third party cookies, isn’t there just going to be some other technology to get around it and use first party cookies the same way we use third party cookies? Is it really the technology that is the problem or is it the fact that companies have entire business models on tracking and surveillance that appears to be very profitable.

solardev 2y ago
Yes, they basically move towards server-side integrations and tracking.
ethbr1 2y ago
It's that the primary browser vendor is an ad company.
afavour 2y ago
Browsers have the ultimate power here. You can’t make something with the tracking power of third party cookies unless browser APIs let you.
- namdnay 2y ago
  you can but it's several orders of magnitude more expensive. ad networks would have to propose backend integrations to each website, it just wouldn't be profitable unless the sites are huge
  - zuppy 2y ago
    not really. as long as you own the domain, you can put a cname to one of their servers and voila… server side tracking with first party cookies.
donatzsky 2y ago
This is already possible with Google Tag Manager. It was here on HN recently.
lofenfew 2y ago

namdnay 2y ago

The thing is, there are two "webs" As much as third party cookies are dangerous and unnecessary in a personal browsing setting, they are unfortunately a fact of life in the wonderful world of enterprise. that embedded Salesforce widget inside the SAP module of the Atlassian tool runs on a toxic mix of iframes and single-sign-on, and no-one in the company wants to have to go and rewrite it because someone at google wants to make the world a better place

nottorp 2y ago
> someone at google wants to make the world a better place Someone at... where?
afavour 2y ago
Then let the enterprise world deploy some custom config that allows third party cookies for whatever domains they need. But disable by default.
- namdnay 2y ago
  it's possible using group policies, but imagine the complexity of getting the IT empires of a megacorp to approve and deploy this kind of stuff - it would be a nightmare. Then microsoft come in and say "hey, just use Edge, we're Enterprisey just like you - we understand you guys. we'll disable this crap by default"
  - afavour 2y ago
    It’s been a long time but IIRC something akin to this already happened. There’s a group policy letting you open specific sites in “IE mode” in Edge, typically for old intranet systems that require IE and aren’t going to be updated: https://learn.microsoft.com/en-us/deployedge/edge-ie-mode-policies https://learn.microsoft.com/en-us/deployedge/edge-ie-mode-po... So yeah, it’s not simple, but it’s been done before and the concept works.
- calvinmorrison 2y ago
  That's the mystery to me. Cookies are up to the client. I'm always baffled about cookie legislation

deleted 2y ago

[deleted]