4 ms·

As if this would change anything. The idea of third party cookies being bad is a reflection of the current state, not a methodology. What happens if third par

As if this would change anything. The idea of third party cookies being bad is a reflection of the current state, not a methodology. What happens if third party cookies are blocked? Websites will just add a CNAME entry that points to whatever service they were using before. Then it's a second party (subdomain) cookie. We need a different methodology how to keep cookies but limit their lifetime, reach, and damage they can do for its users, and a better unified authentication method that can also be spoofed/faked if websites become hostile. They need to be sandboxed, per URL scopes, not per domain. We need to change the way of thinking of trust. Don't trust any website by default, only trust it once the user regularly visits it, or maybe set an allowed cookie lifetime per website after the user logs in. But the current way of thinking about this problem led to the shithole that is XSS, session stealing and everything related to it. Source: attempted to build my own browser that wanted to fix this and eventually had to give up

fph 2y ago
If you replace a cookie for eviladcompany.com with one for eviladcompany.domain1.com, there is still an advantage: that this is not shared with eviladcompany.domain2.com, so eviladcompany cannot know that it's the same person visiting both websites. Sure there are browser fingerprinting techniques, but at least you're making privacy invasion harder.
JoshTriplett 2y ago
> Websites will just add a CNAME entry that points to whatever service they were using before. Then it's a second party (subdomain) cookie. That doesn't cause the same problem as a third-party cookie, because it's not shared with other services that use the same third party. A subdomain doesn't let you get tracked across other sites.
- deleted 2y ago
  [deleted]
vladvasiliu 2y ago
> Websites will just add a CNAME entry that points to whatever service they were using before What do you mean "will"? This is already happening at least for Facebook tracking.
cosmie 2y ago
> Websites will just add a CNAME entry that points to whatever service they were using before. Then it's a second party (subdomain) cookie. A lot of tracking prevention mechanisms have started baking in CNAME uncloaking in the last few years precisely for that reason. Safari/WebKit[1], Brave[2], uBlock Origin (on Firefox only)[3], and NextDNS[4] just to name a few. At this point the industry has moved onto straight up reverse proxying so it's all first party context. In milder instances it's in the form of server-side tagging[5] (which isn't a true reverse proxy, but can easily be used as one). But at least in those instances the website operators are the ones that typically own the server-side tagging process and have oversight/control/visibility into what they're putting in place. But that has a high bar for implementation and relatively few companies have the resources or competence for that sort of thing. So it's much easier to persuade website operators to put a pure, dumb reverse proxy in place that gives them an endpoint under the first party domain to load resources from and send hits through[6]. Including being able to use HTTP set-cookie headers in the responses, while they're at it. Which is coincidentally the only long-lived cookie that still exists in Safari/WebKit, since things like "Keep me logged in" functionality would break if they started auto-purging those too. If it's written in javascript, it's gone in 7 days even if it's first party. And if it's an HTTP header from a CNAME, it's also gone in 7 days. Only cookies set with an HTTP set-cookie header from a first party context are durable anymore. So that's exactly where advertisers are going into as an end-run in the game of cat and mouse - with surprisingly willing adoption from website operators, who are desperate to get their attribution back and don't quite understand the risk profile it exposes them to when they approve letting a third party operator masquarade so deeply as the website operator itself. [1] https://webkit.org/blog/11338/cname-cloaking-and-bounce-tracking-defense/ https://webkit.org/blog/11338/cname-cloaking-and-bounce-trac... [2] https://brave.com/privacy-updates/6-cname-trickery/ https://brave.com/privacy-updates/6-cname-trickery/ [3] https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-best-on-Firefox https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-b... [4] https://medium.com/nextdns/nextdns-added-cname-uncloaking-support-becomes-the-first-cross-platform-solution-to-the-problem-e3f437f84342 https://medium.com/nextdns/nextdns-added-cname-uncloaking-su... [5] https://developers.google.com/tag-platform/tag-manager/server-side https://developers.google.com/tag-platform/tag-manager/serve... [6] https://developers.google.com/tag-platform/tag-manager/first-party/setup-guide https://developers.google.com/tag-platform/tag-manager/first... [7] https://webkit.org/tracking-prevention/ https://webkit.org/tracking-prevention/ (towards the bottom of the page)
dgroshev 2y ago
I agree that we need to change the way of thinking about this, but I disagree with your particular proposal. The change we need is to realise that this is not a technical problem and it can't be solved by technical means. On the one hand, some of the largest US corporations are interested in subverting people's privacy. Some of those corporations directly control our computers and software running on them. They also spend billions to keep ahead of any non-megacorp competition (there's a business reason why Google keeps extending Chrome at breakneck speed). On the other, the underlying problem is a kind of a prisoner dilemma. Spying-driven advertising is ultimately zero (or negative) sum for society [1], but any "defecting" company will be punished by relative sales underperformance. It's a coordination problem and it requires disincentives for defectors, which is not something we can engineer our way out of. The solution has to be well enforced privacy protecting laws. Think GDPR, but with actual teeth and antitrust action, not letting companies get away with malicious compliance like sham "consent" forms directly violating GDPR [2]. Unfortunately, even on this forum there is very little understanding of the necessity of regulation, and I doubt things will change much. It pays very well to destroy privacy and open web (remember AMP?), and there is very little financial gain in going the other way. In fact, it's professionally harmful, since enablers are more likely to gain and hold power over those who object. My only hope is relative outsiders in the EU legislature. [1]: We haven't seen an explosion of productivity attributable to FAANG, so ultimately customers have the same pool of disposable money that businesses are competing for. The businesses haven't shrunk their marketing budgets either, so if you step back and look at the before/after state of the system as a whole, nothing changed except the big shift of ad money from old platforms (including print media) towards FAANG. [2]: GDPR requires consent to be informed and specific. Ask yourself, do you really understand what precisely your data will be used for when you look at a typical "cookie banner"? Have you ever received a notification asking you if you consent to your data being used in a new way, which is absolutely necessary under GDPR if a data controller (i.e., a business collecting your data) decides to onboard a new marketing SaaS? Have you ever heard of a substantial fine for a company collecting consent in a way that is not specific enough?

fph 2y ago

If you replace a cookie for eviladcompany.com with one for eviladcompany.domain1.com, there is still an advantage: that this is not shared with eviladcompany.domain2.com, so eviladcompany cannot know that it's the same person visiting both websites. Sure there are browser fingerprinting techniques, but at least you're making privacy invasion harder.

JoshTriplett 2y ago

> Websites will just add a CNAME entry that points to whatever service they were using before. Then it's a second party (subdomain) cookie. That doesn't cause the same problem as a third-party cookie, because it's not shared with other services that use the same third party. A subdomain doesn't let you get tracked across other sites.

deleted 2y ago
[deleted]

vladvasiliu 2y ago

> Websites will just add a CNAME entry that points to whatever service they were using before What do you mean "will"? This is already happening at least for Facebook tracking.

cosmie 2y ago

> Websites will just add a CNAME entry that points to whatever service they were using before. Then it's a second party (subdomain) cookie. A lot of tracking prevention mechanisms have started baking in CNAME uncloaking in the last few years precisely for that reason. Safari/WebKit[1], Brave[2], uBlock Origin (on Firefox only)[3], and NextDNS[4] just to name a few. At this point the industry has moved onto straight up reverse proxying so it's all first party context. In milder instances it's in the form of server-side tagging[5] (which isn't a true reverse proxy, but can easily be used as one). But at least in those instances the website operators are the ones that typically own the server-side tagging process and have oversight/control/visibility into what they're putting in place. But that has a high bar for implementation and relatively few companies have the resources or competence for that sort of thing. So it's much easier to persuade website operators to put a pure, dumb reverse proxy in place that gives them an endpoint under the first party domain to load resources from and send hits through[6]. Including being able to use HTTP set-cookie headers in the responses, while they're at it. Which is coincidentally the only long-lived cookie that still exists in Safari/WebKit, since things like "Keep me logged in" functionality would break if they started auto-purging those too. If it's written in javascript, it's gone in 7 days even if it's first party. And if it's an HTTP header from a CNAME, it's also gone in 7 days. Only cookies set with an HTTP set-cookie header from a first party context are durable anymore. So that's exactly where advertisers are going into as an end-run in the game of cat and mouse - with surprisingly willing adoption from website operators, who are desperate to get their attribution back and don't quite understand the risk profile it exposes them to when they approve letting a third party operator masquarade so deeply as the website operator itself. [1] https://webkit.org/blog/11338/cname-cloaking-and-bounce-tracking-defense/ https://webkit.org/blog/11338/cname-cloaking-and-bounce-trac... [2] https://brave.com/privacy-updates/6-cname-trickery/ https://brave.com/privacy-updates/6-cname-trickery/ [3] https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-best-on-Firefox https://github.com/gorhill/uBlock/wiki/uBlock-Origin-works-b... [4] https://medium.com/nextdns/nextdns-added-cname-uncloaking-support-becomes-the-first-cross-platform-solution-to-the-problem-e3f437f84342 https://medium.com/nextdns/nextdns-added-cname-uncloaking-su... [5] https://developers.google.com/tag-platform/tag-manager/server-side https://developers.google.com/tag-platform/tag-manager/serve... [6] https://developers.google.com/tag-platform/tag-manager/first-party/setup-guide https://developers.google.com/tag-platform/tag-manager/first... [7] https://webkit.org/tracking-prevention/ https://webkit.org/tracking-prevention/ (towards the bottom of the page)

dgroshev 2y ago

I agree that we need to change the way of thinking about this, but I disagree with your particular proposal. The change we need is to realise that this is not a technical problem and it can't be solved by technical means. On the one hand, some of the largest US corporations are interested in subverting people's privacy. Some of those corporations directly control our computers and software running on them. They also spend billions to keep ahead of any non-megacorp competition (there's a business reason why Google keeps extending Chrome at breakneck speed). On the other, the underlying problem is a kind of a prisoner dilemma. Spying-driven advertising is ultimately zero (or negative) sum for society [1], but any "defecting" company will be punished by relative sales underperformance. It's a coordination problem and it requires disincentives for defectors, which is not something we can engineer our way out of. The solution has to be well enforced privacy protecting laws. Think GDPR, but with actual teeth and antitrust action, not letting companies get away with malicious compliance like sham "consent" forms directly violating GDPR [2]. Unfortunately, even on this forum there is very little understanding of the necessity of regulation, and I doubt things will change much. It pays very well to destroy privacy and open web (remember AMP?), and there is very little financial gain in going the other way. In fact, it's professionally harmful, since enablers are more likely to gain and hold power over those who object. My only hope is relative outsiders in the EU legislature. [1]: We haven't seen an explosion of productivity attributable to FAANG, so ultimately customers have the same pool of disposable money that businesses are competing for. The businesses haven't shrunk their marketing budgets either, so if you step back and look at the before/after state of the system as a whole, nothing changed except the big shift of ad money from old platforms (including print media) towards FAANG. [2]: GDPR requires consent to be informed and specific. Ask yourself, do you really understand what precisely your data will be used for when you look at a typical "cookie banner"? Have you ever received a notification asking you if you consent to your data being used in a new way, which is absolutely necessary under GDPR if a data controller (i.e., a business collecting your data) decides to onboard a new marketing SaaS? Have you ever heard of a substantial fine for a company collecting consent in a way that is not specific enough?