4 ms·

okay, I'll bite. Assuming everything you said is true, for the purposes of discussion, I'm curious.... Are third party cookies a good thing? (Context for anyo

okay, I'll bite. Assuming everything you said is true, for the purposes of discussion, I'm curious.... Are third party cookies a good thing? (Context for anyone interested, also note citations 1 and 2) https://en.m.wikipedia.org/wiki/Third-party_cookies https://en.m.wikipedia.org/wiki/Third-party_cookies

jchw 2y ago
My opinion: No, definitely not, regardless of whether or not what they said is true. What they suggest, however, is a strong argument for not allowing the same company to be both an ad-tech leader and the dominant browser vendor, because it gives them severe conflicts of interest in either direction. I don't know what we can or should actually do about this, but it's pretty obvious that it can't really work.
benoau 2y ago
> Are third party cookies a good thing? Theoretically yes, they are intended to hold some piece of state that is relevant to or derived from your usage and that's not bad by itself. Third-parties aren't always ads either, you might embed maps or AI or countless other things that can use this. In practice, they have been abused for tracking very widely and they support all these other uses so much that we expanded this idea to include local storage, session storage, indexed storage etc.
foota 2y ago
It depends on your POV. Privacy advocates would argue no, but basically all the major players (google, websites, and the rest of the ad ecosystem) except for truly independent web browser developers (of which... I don't know if there are any) want them because they're what makes ad targeting work.
nebula8804 2y ago
Lets say you have a corporate app that serves thousands of internal users that has its backend hosted on a separate webserver. This app can implement super simple auth by having the backend query the company's AD server to prove identity, then fetch what is allowed to be viewed and store the session in a third party cookie. An app like this is probably not ideal for outward facing sites but I have seen apps like this serve its purpose very well as an internal app and the simplicity allows it to have less tech overhead.
- mr_toad 2y ago
  This can be accomplished without third party cookies. https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow https://learn.microsoft.com/en-us/entra/identity-platform/v2...
  - simoncion 2y ago
    > This can be accomplished without third party cookies [by using OAuth2]. You seem to have missed these important parts of the statement: > This app can implement super simple auth... > ...the simplicity allows it to have less tech overhead. OAuth is not simple, and for something entirely internal, simple is fine.
foota 2y ago
It depends on your POV. Privacy advocates would argue no, but basically all the major players (google, websites, and the rest of the ad ecosystem) except for truly independent web browser developers (of which... I don't know if there are any) want them because they're what makes ad targeting work. Safari disables third party cookies, but I didn't call them independent because they have their own ad ecosystem (so of course they want to nerf web ads).
- dmvdoug 2y ago
  The interesting part to me is that you did not list consumers/individuals among your list of “all the major players” involved.
  - foota 2y ago
    I would categorize them as either apathetic (almost all of them) or the privacy advocates.
nine_k 2y ago
Third-party cookies are not intrinsically good or bad, much like a hammer, or a knife, or a can of spray paint. is not good or bad. It's a tool. All depends on how people use it. And third-party cookies very certainly have a high potential for abuse, and are being abused heavily.
kevinventullo 2y ago
IMO the fact that any discerning user can easily browse the web without them by using Safari or otherwise disabling 3PC’s makes them pretty benign. I think the intense focus on them is a distraction from the much, much, worse instances of privacy violations being carried out by e.g. ISP’s selling PII-level location data to bounty hunters.
- Terr_ 2y ago
  Also browser fingerprinting, as a way to prevent people from resetting things by clearing cookies and/or maintaining separate profiles. Third-party cookies, as a naive identifier on their own, are comparatively straightforward and controllable. It's all the other tricks around them that make it worrisome.

jchw 2y ago

My opinion: No, definitely not, regardless of whether or not what they said is true. What they suggest, however, is a strong argument for not allowing the same company to be both an ad-tech leader and the dominant browser vendor, because it gives them severe conflicts of interest in either direction. I don't know what we can or should actually do about this, but it's pretty obvious that it can't really work.

benoau 2y ago

> Are third party cookies a good thing? Theoretically yes, they are intended to hold some piece of state that is relevant to or derived from your usage and that's not bad by itself. Third-parties aren't always ads either, you might embed maps or AI or countless other things that can use this. In practice, they have been abused for tracking very widely and they support all these other uses so much that we expanded this idea to include local storage, session storage, indexed storage etc.

foota 2y ago

nebula8804 2y ago

Lets say you have a corporate app that serves thousands of internal users that has its backend hosted on a separate webserver. This app can implement super simple auth by having the backend query the company's AD server to prove identity, then fetch what is allowed to be viewed and store the session in a third party cookie. An app like this is probably not ideal for outward facing sites but I have seen apps like this serve its purpose very well as an internal app and the simplicity allows it to have less tech overhead.

mr_toad 2y ago
This can be accomplished without third party cookies. https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow https://learn.microsoft.com/en-us/entra/identity-platform/v2...
- simoncion 2y ago
  > This can be accomplished without third party cookies [by using OAuth2]. You seem to have missed these important parts of the statement: > This app can implement super simple auth... > ...the simplicity allows it to have less tech overhead. OAuth is not simple, and for something entirely internal, simple is fine.

foota 2y ago

It depends on your POV. Privacy advocates would argue no, but basically all the major players (google, websites, and the rest of the ad ecosystem) except for truly independent web browser developers (of which... I don't know if there are any) want them because they're what makes ad targeting work. Safari disables third party cookies, but I didn't call them independent because they have their own ad ecosystem (so of course they want to nerf web ads).

dmvdoug 2y ago
The interesting part to me is that you did not list consumers/individuals among your list of “all the major players” involved.
- foota 2y ago
  I would categorize them as either apathetic (almost all of them) or the privacy advocates.

nine_k 2y ago

Third-party cookies are not intrinsically good or bad, much like a hammer, or a knife, or a can of spray paint. is not good or bad. It's a tool. All depends on how people use it. And third-party cookies very certainly have a high potential for abuse, and are being abused heavily.

kevinventullo 2y ago

IMO the fact that any discerning user can easily browse the web without them by using Safari or otherwise disabling 3PC’s makes them pretty benign. I think the intense focus on them is a distraction from the much, much, worse instances of privacy violations being carried out by e.g. ISP’s selling PII-level location data to bounty hunters.

Terr_ 2y ago
Also browser fingerprinting, as a way to prevent people from resetting things by clearing cookies and/or maintaining separate profiles. Third-party cookies, as a naive identifier on their own, are comparatively straightforward and controllable. It's all the other tricks around them that make it worrisome.