3 ms·

Is there a legitimate use case for 3P cookies?

by frollogaston 2y ago

ferngodfather 2y ago
Cross domain same identity authentication, but this has been worked around in most cases.
- djfivyvusn 2y ago
  Only in places where you trust the domains.
paulryanrogers 2y ago
Yes. My employer uses them to facilitate a widget that site owners can just drop into place. Some of these folks are using platforms they cannot easily change or customize, and/or they cannot manage sophisticated changes.
- frollogaston 2y ago
  Ah, and I'm guessing this could instead be done with an iframe but it would be ugly.
  - winrid 2y ago
    It would still require 3P cookies.
asddubs 2y ago
seamless comment form iframe embeds. Useful for something like blogger, where *.blogspot.com allows user code and thus cannot host the comment form for logged in users
AlienRobot 2y ago
There is an absurd amount of additional complexity that needs to be centralized in order to avoid third-party cookies. Any website can add Google Analytics by copy and pasting 1 line of code. To avoid this cookie, you need to have your own analytics web app. This makes sense for medium-size websites, but if you have a small website your host will probably bill it as a separate website. First-party comments? Now you need your own comment system, which means you have a long list of responsibilities that you simply wouldn't have if you just used Disqus or Facebook comments. All those spam links to virulent sites will be on your servers now. Honestly, the Internet would be a much more awesome place if 3P cookies were the norm and everyone was okay with embedding everything everywhere. In the past hotlinking was a problem due to bandwidth concerns, but nowadays most of the traffic is bots anyway so it would be a drop in the bucket.
- djfivyvusn 2y ago
  Disqus hasn't needed third party cookies for a long time.
  - frollogaston 2y ago
    This was the example I thought of too. Somehow they got around it, I thought using iframes or whatever is the newer replacement for them.
    - deleted 2y ago
      [deleted]
    - frollogaston 2y ago
      Then again I'm surprised by something broken in iframes every single time I use them, and last time was years ago, so...
- codedokode 2y ago
  > First-party comments? Now you need your own comment system This is incorrect. Without 3P cookies widgets like Disqus cannot track (and automatically sign-in) user across different websites, but everything else including posting comments or liking them should work, you just need to sign-in on every website instead of doing it once. > Any website can add Google Analytics by copy and pasting 1 line of code. Again incorrect. Google Analytics doesn't need 3P cookies to count the number of visitors. Without 3P cookies it is just harder to correlate visits across different websites, which is what website owners don't really need, why are you supposed to know what competitor sites your users visit? None of your business. And for cross-site authoriation there are standards like OpenID. So we could disable 3P cookies right now and Internet will work just fine.
  - AlienRobot 2y ago
    >Without 3P cookies widgets like Disqus cannot track (and automatically sign-in) user across different websites, but everything else including posting comments or liking them should work, you just need to sign-in on every website instead of doing it once. I feel like I don't understand what a 3P cookie is, then. Isn't Disqus a third-party service? Doesn't it use a cookie to know you have signed in? If you put a Disqus comment form or Google Analytics in your website, wouldn't you need a cookie popup to comply with GDPR and similar regulations that regulate sending user data to third-parties? Is 3P cookie supposed to be about the domain of the cookie? But then can a script from one domain like GA set a cookie in a different domain like of a website that uses GA? That doesn't sound right, considering you can't do this server side. Can you help me understand how would it work for it not to be a 3P cookie?
bawolff 2y ago
Lots of the usecases for CORS are also use cases for third party cookies (anytime you set withCredentials = true)

Is there a legitimate use case for 3P cookies?

ferngodfather 2y ago

Cross domain same identity authentication, but this has been worked around in most cases.

djfivyvusn 2y ago
Only in places where you trust the domains.

paulryanrogers 2y ago

Yes. My employer uses them to facilitate a widget that site owners can just drop into place. Some of these folks are using platforms they cannot easily change or customize, and/or they cannot manage sophisticated changes.

frollogaston 2y ago
Ah, and I'm guessing this could instead be done with an iframe but it would be ugly.
- winrid 2y ago
  It would still require 3P cookies.

asddubs 2y ago

seamless comment form iframe embeds. Useful for something like blogger, where *.blogspot.com allows user code and thus cannot host the comment form for logged in users

AlienRobot 2y ago

There is an absurd amount of additional complexity that needs to be centralized in order to avoid third-party cookies. Any website can add Google Analytics by copy and pasting 1 line of code. To avoid this cookie, you need to have your own analytics web app. This makes sense for medium-size websites, but if you have a small website your host will probably bill it as a separate website. First-party comments? Now you need your own comment system, which means you have a long list of responsibilities that you simply wouldn't have if you just used Disqus or Facebook comments. All those spam links to virulent sites will be on your servers now. Honestly, the Internet would be a much more awesome place if 3P cookies were the norm and everyone was okay with embedding everything everywhere. In the past hotlinking was a problem due to bandwidth concerns, but nowadays most of the traffic is bots anyway so it would be a drop in the bucket.

djfivyvusn 2y ago
Disqus hasn't needed third party cookies for a long time.
- frollogaston 2y ago
  This was the example I thought of too. Somehow they got around it, I thought using iframes or whatever is the newer replacement for them.
  - deleted 2y ago
    [deleted]
  - frollogaston 2y ago
    Then again I'm surprised by something broken in iframes every single time I use them, and last time was years ago, so...
codedokode 2y ago
> First-party comments? Now you need your own comment system This is incorrect. Without 3P cookies widgets like Disqus cannot track (and automatically sign-in) user across different websites, but everything else including posting comments or liking them should work, you just need to sign-in on every website instead of doing it once. > Any website can add Google Analytics by copy and pasting 1 line of code. Again incorrect. Google Analytics doesn't need 3P cookies to count the number of visitors. Without 3P cookies it is just harder to correlate visits across different websites, which is what website owners don't really need, why are you supposed to know what competitor sites your users visit? None of your business. And for cross-site authoriation there are standards like OpenID. So we could disable 3P cookies right now and Internet will work just fine.
- AlienRobot 2y ago
  >Without 3P cookies widgets like Disqus cannot track (and automatically sign-in) user across different websites, but everything else including posting comments or liking them should work, you just need to sign-in on every website instead of doing it once. I feel like I don't understand what a 3P cookie is, then. Isn't Disqus a third-party service? Doesn't it use a cookie to know you have signed in? If you put a Disqus comment form or Google Analytics in your website, wouldn't you need a cookie popup to comply with GDPR and similar regulations that regulate sending user data to third-parties? Is 3P cookie supposed to be about the domain of the cookie? But then can a script from one domain like GA set a cookie in a different domain like of a website that uses GA? That doesn't sound right, considering you can't do this server side. Can you help me understand how would it work for it not to be a 3P cookie?

bawolff 2y ago

Lots of the usecases for CORS are also use cases for third party cookies (anytime you set withCredentials = true)