5 ms·

first party cookies yes But third party cookies are a lot more insidious, because they get sent without any visibility to the user and have generally periphera

by zmmmmm 2y ago

first party cookies yes But third party cookies are a lot more insidious, because they get sent without any visibility to the user and have generally peripheral relevance to the application they are using. It's like if you go to the supermarket and they ask you if you want to sign up for a loyalty card and you say yes, vs you go to the supermarket and they secretly plant trackers on you so that when you go to other shops they can tell who you are. One is a lot worse than the other.

frollogaston 2y ago
Is there a legitimate use case for 3P cookies?
- ferngodfather 2y ago
  Cross domain same identity authentication, but this has been worked around in most cases.
  - djfivyvusn 2y ago
    Only in places where you trust the domains.
- paulryanrogers 2y ago
  Yes. My employer uses them to facilitate a widget that site owners can just drop into place. Some of these folks are using platforms they cannot easily change or customize, and/or they cannot manage sophisticated changes.
  - frollogaston 2y ago
    Ah, and I'm guessing this could instead be done with an iframe but it would be ugly.
    - winrid 2y ago
      It would still require 3P cookies.
- asddubs 2y ago
  seamless comment form iframe embeds. Useful for something like blogger, where *.blogspot.com allows user code and thus cannot host the comment form for logged in users
- AlienRobot 2y ago
  There is an absurd amount of additional complexity that needs to be centralized in order to avoid third-party cookies. Any website can add Google Analytics by copy and pasting 1 line of code. To avoid this cookie, you need to have your own analytics web app. This makes sense for medium-size websites, but if you have a small website your host will probably bill it as a separate website. First-party comments? Now you need your own comment system, which means you have a long list of responsibilities that you simply wouldn't have if you just used Disqus or Facebook comments. All those spam links to virulent sites will be on your servers now. Honestly, the Internet would be a much more awesome place if 3P cookies were the norm and everyone was okay with embedding everything everywhere. In the past hotlinking was a problem due to bandwidth concerns, but nowadays most of the traffic is bots anyway so it would be a drop in the bucket.
  - djfivyvusn 2y ago
    Disqus hasn't needed third party cookies for a long time.
    - frollogaston 2y ago
      This was the example I thought of too. Somehow they got around it, I thought using iframes or whatever is the newer replacement for them.
      - deleted 2y ago
        [deleted]
      - frollogaston 2y ago
        Then again I'm surprised by something broken in iframes every single time I use them, and last time was years ago, so...
  - codedokode 2y ago
    > First-party comments? Now you need your own comment system This is incorrect. Without 3P cookies widgets like Disqus cannot track (and automatically sign-in) user across different websites, but everything else including posting comments or liking them should work, you just need to sign-in on every website instead of doing it once. > Any website can add Google Analytics by copy and pasting 1 line of code. Again incorrect. Google Analytics doesn't need 3P cookies to count the number of visitors. Without 3P cookies it is just harder to correlate visits across different websites, which is what website owners don't really need, why are you supposed to know what competitor sites your users visit? None of your business. And for cross-site authoriation there are standards like OpenID. So we could disable 3P cookies right now and Internet will work just fine.
- bawolff 2y ago
  Lots of the usecases for CORS are also use cases for third party cookies (anytime you set withCredentials = true)
rukuu001 2y ago
Re the supermarkets - I understand this happens in a limited way already with bluetooth scanning :/
- pests 2y ago
  Not anymore since most devices now randomize any Bluetooth identifiers like they do MAC address. Might be a few scenarios it’s possible but it’s been locked down since it made major headlines years ago.
  - rukuu001 2y ago
    Your phone yes, but I believe there's still issues with peripheral BT devices
- meattle 2y ago
  And cameras…

by zmmmmm 2y ago

frollogaston 2y ago

Is there a legitimate use case for 3P cookies?

ferngodfather 2y ago
Cross domain same identity authentication, but this has been worked around in most cases.
- djfivyvusn 2y ago
  Only in places where you trust the domains.
paulryanrogers 2y ago
Yes. My employer uses them to facilitate a widget that site owners can just drop into place. Some of these folks are using platforms they cannot easily change or customize, and/or they cannot manage sophisticated changes.
- frollogaston 2y ago
  Ah, and I'm guessing this could instead be done with an iframe but it would be ugly.
  - winrid 2y ago
    It would still require 3P cookies.
asddubs 2y ago
seamless comment form iframe embeds. Useful for something like blogger, where *.blogspot.com allows user code and thus cannot host the comment form for logged in users
AlienRobot 2y ago
There is an absurd amount of additional complexity that needs to be centralized in order to avoid third-party cookies. Any website can add Google Analytics by copy and pasting 1 line of code. To avoid this cookie, you need to have your own analytics web app. This makes sense for medium-size websites, but if you have a small website your host will probably bill it as a separate website. First-party comments? Now you need your own comment system, which means you have a long list of responsibilities that you simply wouldn't have if you just used Disqus or Facebook comments. All those spam links to virulent sites will be on your servers now. Honestly, the Internet would be a much more awesome place if 3P cookies were the norm and everyone was okay with embedding everything everywhere. In the past hotlinking was a problem due to bandwidth concerns, but nowadays most of the traffic is bots anyway so it would be a drop in the bucket.
- djfivyvusn 2y ago
  Disqus hasn't needed third party cookies for a long time.
  - frollogaston 2y ago
    This was the example I thought of too. Somehow they got around it, I thought using iframes or whatever is the newer replacement for them.
    - deleted 2y ago
      [deleted]
    - frollogaston 2y ago
      Then again I'm surprised by something broken in iframes every single time I use them, and last time was years ago, so...
- codedokode 2y ago
  > First-party comments? Now you need your own comment system This is incorrect. Without 3P cookies widgets like Disqus cannot track (and automatically sign-in) user across different websites, but everything else including posting comments or liking them should work, you just need to sign-in on every website instead of doing it once. > Any website can add Google Analytics by copy and pasting 1 line of code. Again incorrect. Google Analytics doesn't need 3P cookies to count the number of visitors. Without 3P cookies it is just harder to correlate visits across different websites, which is what website owners don't really need, why are you supposed to know what competitor sites your users visit? None of your business. And for cross-site authoriation there are standards like OpenID. So we could disable 3P cookies right now and Internet will work just fine.
bawolff 2y ago
Lots of the usecases for CORS are also use cases for third party cookies (anytime you set withCredentials = true)

rukuu001 2y ago

Re the supermarkets - I understand this happens in a limited way already with bluetooth scanning :/

pests 2y ago
Not anymore since most devices now randomize any Bluetooth identifiers like they do MAC address. Might be a few scenarios it’s possible but it’s been locked down since it made major headlines years ago.
- rukuu001 2y ago
  Your phone yes, but I believe there's still issues with peripheral BT devices
meattle 2y ago
And cameras…