4 ms·

The thing is, there are two "webs" As much as third party cookies are dangerous and unnecessary in a personal browsing setting, they are unfortunately a fact o

The thing is, there are two "webs" As much as third party cookies are dangerous and unnecessary in a personal browsing setting, they are unfortunately a fact of life in the wonderful world of enterprise. that embedded Salesforce widget inside the SAP module of the Atlassian tool runs on a toxic mix of iframes and single-sign-on, and no-one in the company wants to have to go and rewrite it because someone at google wants to make the world a better place

nottorp 2y ago
> someone at google wants to make the world a better place Someone at... where?
afavour 2y ago
Then let the enterprise world deploy some custom config that allows third party cookies for whatever domains they need. But disable by default.
- namdnay 2y ago
  it's possible using group policies, but imagine the complexity of getting the IT empires of a megacorp to approve and deploy this kind of stuff - it would be a nightmare. Then microsoft come in and say "hey, just use Edge, we're Enterprisey just like you - we understand you guys. we'll disable this crap by default"
  - afavour 2y ago
    It’s been a long time but IIRC something akin to this already happened. There’s a group policy letting you open specific sites in “IE mode” in Edge, typically for old intranet systems that require IE and aren’t going to be updated: https://learn.microsoft.com/en-us/deployedge/edge-ie-mode-policies https://learn.microsoft.com/en-us/deployedge/edge-ie-mode-po... So yeah, it’s not simple, but it’s been done before and the concept works.
- calvinmorrison 2y ago
  That's the mystery to me. Cookies are up to the client. I'm always baffled about cookie legislation
jrochkind1 2y ago
Google is the one who does not want to drop third-party cookies.
- gipp 2y ago
  Google is the one who has spent years and presumably many millions trying to make it happen, and has only recently thrown in the towel
  - jrochkind1 2y ago
    i don't know if Google was primarily responsible for pushing for it before (after all Firefox has ALREADY gone further than Chrome on this?), but I'm no expert in the history. When w3.org wrote that statement after they threw in the towel, it seems bizarre to me to suggest they wrote that statement only to do Google's bidding?
Terretta 2y ago
> they are unfortunately a fact of life in the wonderful world of enterprise This is not the only way. The SSO framework can be built into the browser or the OS, shifting it from third party to zeroth party. And, in fact, foundational OS framework SSO is now available in current major releases of both Windows and MacOS.
- namdnay 2y ago
  Yes indeed that’s by far the best way out, but it requires orgs to do something. Whereas the existing “just works” (badly)
jauntywundrkind 2y ago
Everyone else just shipped some level of removing 3rd party cookies, but did so in a non specified way, with arbitrary carve outs & limitations & workarounds. Google has been extremely busy trying to find ways to get login flows to keep working adequately well. In a specified, standardized manner. Look at what explainers they have, and note how many deal with 3rd party cookies or storage bucket access, https://github.com/orgs/explainers-by-googlers/repositories?type=all https://github.com/orgs/explainers-by-googlers/repositories?... Also compounding the difficulty is that we added storage isolation to the web, making even more of a fractal maze of problems, before figuring out how we were going to get rid of 3rd party cookies. That's probably fine, it's been a progressive layering of pretty good privacy/security, but it's more specced out complexity that has to be tangled with.

nottorp 2y ago

> someone at google wants to make the world a better place Someone at... where?

afavour 2y ago

Then let the enterprise world deploy some custom config that allows third party cookies for whatever domains they need. But disable by default.

namdnay 2y ago
it's possible using group policies, but imagine the complexity of getting the IT empires of a megacorp to approve and deploy this kind of stuff - it would be a nightmare. Then microsoft come in and say "hey, just use Edge, we're Enterprisey just like you - we understand you guys. we'll disable this crap by default"
- afavour 2y ago
  It’s been a long time but IIRC something akin to this already happened. There’s a group policy letting you open specific sites in “IE mode” in Edge, typically for old intranet systems that require IE and aren’t going to be updated: https://learn.microsoft.com/en-us/deployedge/edge-ie-mode-policies https://learn.microsoft.com/en-us/deployedge/edge-ie-mode-po... So yeah, it’s not simple, but it’s been done before and the concept works.
calvinmorrison 2y ago
That's the mystery to me. Cookies are up to the client. I'm always baffled about cookie legislation

jrochkind1 2y ago

Google is the one who does not want to drop third-party cookies.

gipp 2y ago
Google is the one who has spent years and presumably many millions trying to make it happen, and has only recently thrown in the towel
- jrochkind1 2y ago
  i don't know if Google was primarily responsible for pushing for it before (after all Firefox has ALREADY gone further than Chrome on this?), but I'm no expert in the history. When w3.org wrote that statement after they threw in the towel, it seems bizarre to me to suggest they wrote that statement only to do Google's bidding?

Terretta 2y ago

> they are unfortunately a fact of life in the wonderful world of enterprise This is not the only way. The SSO framework can be built into the browser or the OS, shifting it from third party to zeroth party. And, in fact, foundational OS framework SSO is now available in current major releases of both Windows and MacOS.

namdnay 2y ago
Yes indeed that’s by far the best way out, but it requires orgs to do something. Whereas the existing “just works” (badly)

jauntywundrkind 2y ago

Everyone else just shipped some level of removing 3rd party cookies, but did so in a non specified way, with arbitrary carve outs & limitations & workarounds. Google has been extremely busy trying to find ways to get login flows to keep working adequately well. In a specified, standardized manner. Look at what explainers they have, and note how many deal with 3rd party cookies or storage bucket access, https://github.com/orgs/explainers-by-googlers/repositories?type=all https://github.com/orgs/explainers-by-googlers/repositories?... Also compounding the difficulty is that we added storage isolation to the web, making even more of a fractal maze of problems, before figuring out how we were going to get rid of 3rd party cookies. That's probably fine, it's been a progressive layering of pretty good privacy/security, but it's more specced out complexity that has to be tangled with.