7 ms·

Third party cookies must be removed

452 points by pabs3 2y ago

nolroz 2y ago
Here we go again!
johnmiroki 2y ago
Replacement solutions must be provided before it's mandatory to remove third party cookies. Otherwise, it's doomed to fail.
- driverdan 2y ago
  We don't need a replacement, they're not needed today. I've been blocking them for years and I can't remember the last time it caused a problem.
- kgwxd 2y ago
  I've have them turned off since Firefox added the feature. Looks like that was around 2018, though I could have sworn it was much earlier than that. I've never had an issue where I had to make an exception for a site. Is there still some environment where it's common for them to be needed?
  - g-b-r 2y ago
    I don't recall a browser that didn't let you disable third-party cookies; given how long ago cookies were introduced, I could have forgotten about it, but I'm at least sure that Mozilla always supported it. Firefox, especially in the first versions, permitted much less control on cookies than Mozilla did, but I think it still always allowed disabling third party cookies.
- recursive 2y ago
  Replacement for what use case? The whole point is to eliminate the behavior, not provide another feature that has the same problems. What does failure mean? It's a problem for ad networks, not for regular humans.
  - petesergeant 2y ago
    The article explicitly calls out that there are valid use cases (although doesn’t enumerate them). Federated sign-on and embedded videos seem like obvious examples
  - svieira 2y ago
    The use case of not having to log in to system A which is being embedded within system B because you already logged in to system A? Without needing to introduce a third party SSO C? That's pretty "regular human", even if it's "medium sized corporation" instead of "Joe Regular" (but even Joe likes it if he doesn't have to log into the comment box on every site that uses THE_COMMENT_SYSTEM_HE_LIKES.)
    - koolba 2y ago
      This exists already. You can have cookies at higher level of the same domain. So foo.example.com and bar.example.com can share cookies at example.com. You can also use CORS to interact with a truly third party site. None of these require third party cookies.
      - nwalters512 2y ago
        A use case this doesn't address is embedding across two completely different domains, which is pretty common in the education space with LMS platforms like Canvas (https://www.instructure.com/canvas https://www.instructure.com/canvas) embedding other tools for things like quizzes, textbooks, or grading. I ended up in a Chrome trial that disabled third-party cookies which broke a lot of these embeds because they can no longer set identity cookies that they rely on from within their iframe.
      - svieira 2y ago
        As nwalters also points out, this isn't the same at all. System A and System A' both from Source Α are not the same as System A (Source Α) and System B (Source Β). Which you know, because you say "you can also use CORS to interact with a truly third party site". But now, I invite you to go the rest of the way - what if the third party site isn't Project Gutenburg but `goodreads.com/my-reading-lists`? That is, what if the information that you want to pull into System A from System B should only be available to you and not to anyone on the net?
- hiccuphippo 2y ago
  Do not worry, the ad networks will come up with ways to circumvent it as soon as it becomes mandatory.
- p_ing 2y ago
  Google/Chrome just declared that they won't be moving forward with removing 3rd party cookie support. https://privacysandbox.com/news/privacy-sandbox-next-steps/ https://privacysandbox.com/news/privacy-sandbox-next-steps/ > Taking all of these factors into consideration, we’ve made the decision to maintain our current approach to offering users third-party cookie choice in Chrome, and will not be rolling out a new standalone prompt for third-party cookies.
  - Nevermark 2y ago
    Company whose market cap reflects pervasive surveillance non-requested announces that after serious consideration they won’t be removing technologies that enable pervasive non-requested surreptitious surveillance.” It is going to be interesting to see if anti-trust enforcement's manages to separate Google from its financial and practical hold on web standards/browsers. The opportunity to increase ethical norms of web browsing would be welcome to me.
    - pests 2y ago
      Google wants to remove third party cookies but they can't as the government sees it as anticompetitive to their competition. They dont need third party cookies, everyone else does.
      - svieira 2y ago
        Precisely - removing third-party cookies doesn't stop Google from tracking anyone. It just prevents anyone who doesn't own a browser and have one of the three major email providers from tracking everyone. Well, it doesn't prevent them, but it does make it a little bit harder ...
        pests 2y ago
        I personally think this decision hurts users more than anything else. We must let Google's competitors continue tracking us or else it won't be fair to them? I don't even understand how being forced to divest Chrome will even help. Once another company owns Chrome and can remove third party cookies, Google gets the same benefit.
- tejtm 2y ago
  done. third parties can be replaced with legally culpable first parties.
- jeroenhd 2y ago
  Google has set up a replacement that puts the user in control of their ad interest tracking. It has its upsides and downsides, but I think it's pretty balanced. Anti-tracking features are embedded into the API so the API can't be abused by advertisers. Of course, ad companies scream bloody murder, and the UK market watchdog had to step in so Google wouldn't turn off third party cookies by default.
AdmiralAsshat 2y ago
Fine. All that will happen is we'll see more sites switching to requiring a login to do anything on their website, so that they can track you with first-party cookies, and sell your information that way. Nothing will meaningfully change. The only distinction is that I can do a decent job of blocking third-party cookies today with my existing solutions like uBlock Origin, but I will probably have a much more difficult time getting around login/paywalls.
- recursive 2y ago
  First party cookies can't build a profile on you across multiple origins.
  - hiccuphippo 2y ago
    All they need to do is redirect you through a central hub after login.
    - quectophoton 2y ago
      On first visit: * "Please wait while we verify that you're not a bot, for which we'll need to associate a unique identifier with your browsing session." (logged in or not) * The validation needs to do a quick redirection to an external centralized service, because if they can already identify that you're not a bot, you save CPU cycles, and you care a lot about carbon footprint after all. * Redirect back to the original website, passing the "proof of not-a-bot" somewhere in the URL. This is just a string. * The website absolutely needs to load the external script `https://proof-validation.example.com/that-unique-string.js https://proof-validation.example.com/that-unique-string.js` for totally legit purposes obviously related to detecting bot behavior, "somehow". Half-joking because I don't think this would fly. Or maybe it would, since it's currently trendy to have that PoW on first visit, and users are already used to multiple quick redirections[1] (I don't think they even pay attention to what happens in the URL bar). But I'm sure we'd get some creative workarounds anyway. [1]: Easy example: A post on Xitter (original domain) -> Shortened link (different domain) -> Final domain (another different domain). If the person who posted the original link also used a link shortener for tracking clicks, then that's one more redirection.
deleted 2y ago
[deleted]
Svoka 2y ago
So, the web Ad marked is being monopolized on platforms. Google and Facebook make overwhelming revenue from their own websites. Now, down with the rest.
- candiddevmike 2y ago
  Facebook pixel works just fine without third party cookies.
codeqihan 2y ago
I have always blocked third-party cookies. The only problem I've encountered (there may be others, but I haven't come across them) is that some embedded videos on certain web pages won't play and prompt me to enable cookies.
xnx 2y ago
Careful what you wish for. Removing third party cookies without a replacement will make aggressive fingerprinting ubiquitous.
- xenator 2y ago
  I have feeling that it is all related. When use see request to accept cookies with list of over 9000 trackers it doesn't mean that this page will have zillions of javasripts included on the page. It just means that site owners fingerprint user and process user interactions to third parties server side. Only reason why we see this movement is because advertisers feels confident about removing third party cookies.
- bennettnate5 2y ago
  ...thus raising the bar for privacy-preserving techniques in client side browsing. Aggressive fingerprinting arrived years ago; if we can move beyond cookies altogether and focus on it as the next issue to tackle, I would think that's a net win. Saying that we should keep 3rd part cookies alive and healthy because it will keep websites using them against users rather than fingerprinting is just throwing the majority of users who don't know to block them under the bus. Plus it still leaves the door open for even privacy-conscious users to be defeated by fingerprinting anyways if a server is keen on tracking particular individuals.
  - Terr_ 2y ago
    Yeah, the only way third-party cookies will block creepier fingerprinting crap is if the creepy stuff is prohibitively more expensive. But once anyone gets a creepy fingerprinting system working, the barriers drop, and it becomes cheaper to resell the capability as a library or service. It may offer some minor benefits in terms of enabling companies that "want to be more ethical than the competition", but that too seems like a long-shot. :p
  - xnx 2y ago
    Fingerprinting defeating technology is just the kind of thing that I wish Firefox spent its effort developing instead of reimplementing features form Chrome like tab groups.
growthwtf 2y ago
What a weird piece of writing. Is this like just chicken scratch? Or is this seriously some kind of part of the W3C working process? Section 2: Third party cookies have gotten bad. Ok. Section 3: There are legitimate use cases that third party cookies currently cover. Also ok. Then they throw in, "Be aware that a set of new technologies which carry minimal risk individually, could be used in combination for tracking or profiling of web users." Yes? Huge scope increase in the document though and all of a sudden we're now talking about tons of tracking technologies in aggregate? The authors move on without further comment. Section 4: I think the first half is essentially saying that new technology coming online in the web platform will make the third party cookie problem worse, so we should fix it soon. OK, I'm with back with you. Then the document suddenly pivots to proposing general standards for web privacy again, saying that the burden of proof is on the people originating the proposal to, before concluding by saying (apparently without irony?) that justifying the removal of third-party cookies' impact on business is outside of the scope of the document. I'm missing a ton of cultural context here about how W3C works, so I'm guessing this probably amounts to rough notes that somebody intends to clean up later that I'm being overly critical of, and they didn't expect it to get any traction on hacker news.
- bilekas 2y ago
  It's W3c... They've never been the most coherent with standards ironically.
- deleted 2y ago
  [deleted]
- deleted 2y ago
  [deleted]
- motorest 2y ago
  ...or it's a design by committee thing, and some people in the room are doing their best to preserve current and future tracking technology.
  - bilekas 2y ago
    It's exactly this, there is a group who come together and never agree on rules, but when they do, they never enforce them. It's I believe the definition of a paper tiger, sadly. A great idea executed horribly.
freeamz 2y ago
Feel like all this cookies thing is just white wash, when if you enable JS then they can track you no matter if you have cookies or not! Nothing is private: https://nothingprivate.gkr.pw https://nothingprivate.gkr.pw More effort ought to be put into how to make web spec to NOT be able track user even if JS is turned on. Browser vendor Brave, Firefox suppose to privacy browser are NOT doing anything about it. At this point, do we need to using JS disabled browser to really get privacy on the web?
- brookst 2y ago
  It’s an interesting question: is it possible for JavaScript to be turing complete, able to read/write the DOM, and somehow prevent fingerprinting / tracking? My gut says no, not possible. Maybe we need a much lighter way to express logic for UI interactions. Declarative is nice, so maybe CSS grows? But I don’t see how executing server-controlled JS could ever protect privacy.
  - Enginerrrd 2y ago
    I've always thought there should be a way to use the browser like a condom. It should obfuscate all the things that make a user uniquely identifiable. Mouse movement/clicks/typing cadence should be randomized and sanitized a bit. And no website should have any authority whatsoever to identify your extensions or other tabs, or even whether or not your tab is open. And it certainly shouldn't allow a website to overrule your right click functionality, or zoom, or other accessibility features.
    - JSteph22 2y ago
      The obfuscation makes you more easily identifiable.
      - teo_zero 2y ago
        How so?
badmonster 2y ago
third-party cookies have done more harm than good, and it's time to fully remove them from the web platform. It is refreshing that their acknowledgment that replacements must not just be privacy-washed clones of the old model — purpose-built alternatives need to prove they don’t recreate the same surveillance infrastructure.
sedatk 2y ago
If third-party cookies are removed, the tracking parties will just ask web sites to include the script on their web server, so their cookies become "first party" again. I don't understand how this helps the web unless protections against tracking itself, not the methods used, are established.
- Dwedit 2y ago
  It's about trust, the third-party ad companies don't trust that the first party will be honest with them, not generating fake impressions or clicks.
  - sedatk 2y ago
    I doubt that. Their script could as well be "fetch that script from that URL and run it". They would have fraud detections already in place on their side regardless of which script runs on the client.
    - chii 2y ago
      > "fetch that script from that URL and run it" but if you cannot have a third party cookie, the remote site from the tracker cannot be sure that the script was actually downloaded, nor executed.
      - littlecranky67 2y ago
        sure you can, if their script is making a 3rd party xhr request to that tracker.
        chii 2y ago
        but this request could be faked, if the first party wanted to fake the traffic (for example, to make ad revenue). This third party cookie is what prevents this faking at this moment.
      - kevin_thibedeau 2y ago
dbushell 2y ago
The "replacement" is already being penned: https://www.w3.org/TR/privacy-preserving-attribution/ https://www.w3.org/TR/privacy-preserving-attribution/ Which is just going to be in additional to 3rd-party cookies. Google's own study concluded removing 3rd-party cookies loses revenue and "privacy-preserving" tracking increases revenue: https://support.google.com/admanager/answer/15189422 https://support.google.com/admanager/answer/15189422 So they'll just do both: https://privacysandbox.com/news/privacy-sandbox-next-steps/ https://privacysandbox.com/news/privacy-sandbox-next-steps/
- surajrmal 2y ago
  There are regulatory agencies which have specifically told Google it is not allowed to remove 3rd party cookies without a replacement as while Google would be able to continue to function fine, their competitors would take a major loss.
  - pas 2y ago
    Do you have links for this? I'm curious about which bodies and what was their argument.
    - diogocp 2y ago
      https://www.gov.uk/cma-cases/investigation-into-googles-privacy-sandbox-browser-changes https://www.gov.uk/cma-cases/investigation-into-googles-priv...
      - dbushell 2y ago
        Seems like the CMA are concerned for other advertisers who profit from 3rd-party cookies, no concern for user's privacy. That poor billion dollar industry, how will it cope?
        blibble 2y ago
        their mandate is to regulate competition not privacy
dankwizard 2y ago
Using a custom-built interception layer, I decouple session tokens from identifiable browser states, rotating my signature footprint every few requests via controlled entropy injection. “No more third-party cookies” sounds like a big shift, but it’s functionally irrelevant if your presence is already undetectable.
Animats 2y ago
I haven't allowed third party cookies in a decade. No problem.
- kstrauser 2y ago
  I had a little trouble when Safari rolled out ITP a while back. SSO providers scrambled to figure out how to fix federated logins, and because it affected every iPhone, they managed to do it with a quickness. I haven't had a single problem since.
nurettin 2y ago
Sounds like a diversion. Websites can use local storage and fingerprinting to do anything they want at this point.
j16sdiz 2y ago
> Some of the use cases that are important enough to justify the creation of purpose-specific solutions include federated identity, authorizing access to cross-site resources, and fraud mitigation. Unpopular opinion: There are no privacy-preserving way for "fraud mitigation". Either you accept fraud as cost to run business, or do away the privacy. Most business owner don't want the fraudulent user to come back, ever. If we value the privacy of user, we need to harm some business.
- omeid2 2y ago
  In theory it is by possible by "blind attestations" by a 3rd party, in an indirect way, that is what you get by Cloudflare, where they monitor traffic from an "agent" using their own heuristics for identity, without sharing that identity with you.
kazinator 2y ago
> Some features of the web that people have come to expect, and which greatly improve user experience, currently depend on third-party cookies. Idea: domains should be able to publish a text record in their DNS (similarly to SPF record for mail domains) designating other domains which are allowed to peek at their cookies. Suppose I operate www.example.com. My cookie record could say that foo.com and bar.com may ask for example.com cookies (in addition to example.com, of course). A website from any other domain may not. As the operator of example.com, I can revoke that at any time. Whenever a page asks for a cookie outside of its domain, the browser will perform a special DNS query for that cookie's domain. If that query fails, or returns data indicating that the page does not have access, then it is denied.
- j16sdiz 2y ago
  Not a bad idea, TBH. Just feeling uncomfortable putting more data into DNS. DNS is not encrypted. DNSSEC is easy to bypass (or break way too often that nobody want to enforce it). -- but these are not w3c's problem.
  - kazinator 2y ago
    Yes; if someone hijacks example.com's main A record, that gets caught at the SSL level. If someone hijacks example.com's cookie record, that won't be caught; they just write themselves permission to have their page access example.com's cookies. The same info could just be hosted by example.com (at some /.well-known path or whatever). The web could generate a lot of hits against that. The DNS records could be (optionally?) signed. You'd need the SSL key of the domain to check the signature.
  - tptacek 2y ago
    DNSSEC isn't encrypted either.
  - pabs3 2y ago
    When you say bypass, do you mean disable DNSSEC on your own computer? Or are there known vulnerabilities in DNSSEC cryptography or software?
RainyDayTmrw 2y ago
This is kinda hollow while Google controls Chrome, and Chrome has majority market share[1]. And, if regulators get their way, and Google divests Chrome[2], I'm not expecting that the new highest bidder would do any better with it. [1] The exact figure may depend on which source you use, and there is some indication that ad and tracker blocking may artificially deflate Firefox and friends. https://gs.statcounter.com/browser-market-share https://gs.statcounter.com/browser-market-share [2] https://www.wired.com/story/the-doj-still-wants-google-to-divest-chrome/ https://www.wired.com/story/the-doj-still-wants-google-to-di...
- JoshTriplett 2y ago
  As long as the new steward of Chrome is not an advertising company, they will no longer be restricted from removing third-party cookies.
anothernewdude 2y ago
UMatrix blocks those by default. Blocking third party cookies very rarely breaks anything. I can only think of one instance in the past five years, and that wasn't really a third party cookie, but one website using two different domains.
- jeroenhd 2y ago
  You even don't need uMatrix for that. Every major website has a toggle for it in the settings.
  - anothernewdude 1y ago
    Cool if you want to trust every major website and find the settings for each website. I'll just live my life.
aligundogdu 2y ago
This is actually a somewhat inconvenient wish, because the alternative would increase the fingerprint investments required for all browsers to recognise us.
noduerme 2y ago
I block almost all 3rd party cookies, but at this point isn't it kind of nice to just have your google login follow you around, so you don't constantly have to login on other sites? Sure, it sucks for privacy, which is why your google account should never be tied to your phone number or your actual identity, but it's super convenient. Oh wait. It's tied to your real identity? Go back to square one and start a fake identity with all the root info. Buy a burner with a prepaid card, use it to set up a yahoo mail account, use that to set up a mail server you pay for in bitcoin, use that to verify a gmail account, and never let down your VPN. You're going to be tracked; the right move isn't to waste time worrying about that, it's to be someone invisible and untethered in the real world.
jeroenhd 2y ago
Google won't implement this spec. Currently, they're legally not allowed to, because advertisers called in the industry watchdog, asserting that without third party cookies to stalk users, they could not compete. Google extended their privacy sandbox, opened and closed it, talked about it, and eventually backed down from their plan to block third party cookies ASAP. Maybe Chrome can get away with "the spec says it, sorry advertisers" but I doubt the courts will accept that.
- nine_k 2y ago
  That is, Firefox can reject third-party cookies because it's not made by a company that deals in online advertising, but Chrome cannot, because Google is the biggest online ads dealer and thus would have an unfair advantage over other ads dealers, correct?
ordu 2y ago
How about third party js? The site doesn't render properly without third party js from www.w3.org.
oliwarner 2y ago
Sure but this neither makes an attempt to list the valid uses of third party cookies, nor a suggestion of what magic definitely not a third-party cookie unicorn is going to ride in and offer us the safety we need. Pretty fluffy through and through. I suggest that we do just need to keep third-party cookies but they're explicitly opt-in. That could just be allowing (once) a third party to be present everywhere (like a SSO) and browsers making it known when a third party is accessing data.
lofaszvanitt 2y ago
Has anyone noticed this pattern that for some pulled out of my arse explanation, these standards groups and google suddenly remove features that would be useful to people, but they decided it's now not ok in the future. Like http referers now only show the domain, not the full url, because insert complete bs explanation. And now 3rd party cookies too...
Funes- 2y ago
Adopting javascript universally, and consequentially making it a de facto standard, was a terrible mistake. I think the only way out of this nightmarish privacy-less state of things (in this regard) might be something like the EU putting out an extremely severe law banning all these bad practices. Banning all practices that undermine privacy is the only morally valid option; it's not only about 3rd-party cookies. It'd be an incontrovertible measure for everyone but bad actors, just like USB-C or user-removable batteries (February 2027).
samyar 2y ago
what about iframes?
andrewla 2y ago
What are the legitimate use cases for third-party cookies? The only one I can think of is if there is a single logical site spread across multiple domains, and you want to be able to maintain a single session across both domains, but are not willing (for aesthetic reasons or technical reasons) to encode this information in the links while moving between domains. Are there others? As far as I'm concerned I don't even want first-party cookies to be available when accessed through a third-party context (i.e. if I have a cookie on a.com, and b.com fetches an image from a.com, I don't want that image request to send my a.com cookie). My preference for this entire discussion is that we eliminate cookies entirely, but use self-signed client certificates very aggressively. When you navigate to a url the user agents sends a client certificate specific to that domain. Any subsidiary fetches use a (deterministic) scoped client certificate specific to the subsidiary domain. All other state tracking is required to be server-side and linked to the certificate. The user can instruct their user agent to reset any of these.
- dietr1ch 2y ago
  > Single logical site spread across multiple domains. Is there really need for this? I get subdomains can help routing, but beyond that sites spreading over multiple domains are chaotic and phishing-prone. People get used to jump from foo.com to foo.net or scammyfoo.tk and enter their credentials if they look similar. I think that a big part of how password managers help is by keeping passwords from their users and not sharing them with any random domain that may read similar or misleading.
  - horsawlarway 2y ago
    A common need for this is during an acquisition or merger. It's fine and all to assume that domain is identity, but that doesn't actually map too well to relatively complex organizational hierarchies. Ex - Bank A and Bank B merge. There is going to be a period where they have to navigate that two domains represent a single organization. It's often a fairly high level of effort to move to a completely new domain, and it won't be done overnight. Yes - eventually you want to be back on a single domain, and I think there is definitely a world where this leads to some very bad patterns (HR and healthcare are two examples - if you've ever seen a login need to bounce between like 5 different domains because they've refused to actually do the technical work to consolidate back on a single domain, and treat the domain as marketing). But it's a really valid spot to end up in, and is the most common cause of having a single entity spread out over multiple domains in my experience.
econ 2y ago
It would be nice to be able to delete all cookies not associated with a saved password or login.

452 points by pabs3 2y ago

Here we go again!

Replacement solutions must be provided before it's mandatory to remove third party cookies. Otherwise, it's doomed to fail.

driverdan 2y ago
We don't need a replacement, they're not needed today. I've been blocking them for years and I can't remember the last time it caused a problem.
kgwxd 2y ago
I've have them turned off since Firefox added the feature. Looks like that was around 2018, though I could have sworn it was much earlier than that. I've never had an issue where I had to make an exception for a site. Is there still some environment where it's common for them to be needed?
- g-b-r 2y ago
  I don't recall a browser that didn't let you disable third-party cookies; given how long ago cookies were introduced, I could have forgotten about it, but I'm at least sure that Mozilla always supported it. Firefox, especially in the first versions, permitted much less control on cookies than Mozilla did, but I think it still always allowed disabling third party cookies.
recursive 2y ago
Replacement for what use case? The whole point is to eliminate the behavior, not provide another feature that has the same problems. What does failure mean? It's a problem for ad networks, not for regular humans.
- petesergeant 2y ago
  The article explicitly calls out that there are valid use cases (although doesn’t enumerate them). Federated sign-on and embedded videos seem like obvious examples
- svieira 2y ago
  The use case of not having to log in to system A which is being embedded within system B because you already logged in to system A? Without needing to introduce a third party SSO C? That's pretty "regular human", even if it's "medium sized corporation" instead of "Joe Regular" (but even Joe likes it if he doesn't have to log into the comment box on every site that uses THE_COMMENT_SYSTEM_HE_LIKES.)
  - koolba 2y ago
    This exists already. You can have cookies at higher level of the same domain. So foo.example.com and bar.example.com can share cookies at example.com. You can also use CORS to interact with a truly third party site. None of these require third party cookies.
    - nwalters512 2y ago
      A use case this doesn't address is embedding across two completely different domains, which is pretty common in the education space with LMS platforms like Canvas (https://www.instructure.com/canvas https://www.instructure.com/canvas) embedding other tools for things like quizzes, textbooks, or grading. I ended up in a Chrome trial that disabled third-party cookies which broke a lot of these embeds because they can no longer set identity cookies that they rely on from within their iframe.
    - svieira 2y ago
      As nwalters also points out, this isn't the same at all. System A and System A' both from Source Α are not the same as System A (Source Α) and System B (Source Β). Which you know, because you say "you can also use CORS to interact with a truly third party site". But now, I invite you to go the rest of the way - what if the third party site isn't Project Gutenburg but `goodreads.com/my-reading-lists`? That is, what if the information that you want to pull into System A from System B should only be available to you and not to anyone on the net?
hiccuphippo 2y ago
Do not worry, the ad networks will come up with ways to circumvent it as soon as it becomes mandatory.
p_ing 2y ago
Google/Chrome just declared that they won't be moving forward with removing 3rd party cookie support. https://privacysandbox.com/news/privacy-sandbox-next-steps/ https://privacysandbox.com/news/privacy-sandbox-next-steps/ > Taking all of these factors into consideration, we’ve made the decision to maintain our current approach to offering users third-party cookie choice in Chrome, and will not be rolling out a new standalone prompt for third-party cookies.
- Nevermark 2y ago
  Company whose market cap reflects pervasive surveillance non-requested announces that after serious consideration they won’t be removing technologies that enable pervasive non-requested surreptitious surveillance.” It is going to be interesting to see if anti-trust enforcement's manages to separate Google from its financial and practical hold on web standards/browsers. The opportunity to increase ethical norms of web browsing would be welcome to me.
  - pests 2y ago
    Google wants to remove third party cookies but they can't as the government sees it as anticompetitive to their competition. They dont need third party cookies, everyone else does.
    - svieira 2y ago
      Precisely - removing third-party cookies doesn't stop Google from tracking anyone. It just prevents anyone who doesn't own a browser and have one of the three major email providers from tracking everyone. Well, it doesn't prevent them, but it does make it a little bit harder ...
      - pests 2y ago
        I personally think this decision hurts users more than anything else. We must let Google's competitors continue tracking us or else it won't be fair to them? I don't even understand how being forced to divest Chrome will even help. Once another company owns Chrome and can remove third party cookies, Google gets the same benefit.
tejtm 2y ago
done. third parties can be replaced with legally culpable first parties.
jeroenhd 2y ago
Google has set up a replacement that puts the user in control of their ad interest tracking. It has its upsides and downsides, but I think it's pretty balanced. Anti-tracking features are embedded into the API so the API can't be abused by advertisers. Of course, ad companies scream bloody murder, and the UK market watchdog had to step in so Google wouldn't turn off third party cookies by default.

AdmiralAsshat 2y ago

Fine. All that will happen is we'll see more sites switching to requiring a login to do anything on their website, so that they can track you with first-party cookies, and sell your information that way. Nothing will meaningfully change. The only distinction is that I can do a decent job of blocking third-party cookies today with my existing solutions like uBlock Origin, but I will probably have a much more difficult time getting around login/paywalls.

recursive 2y ago
First party cookies can't build a profile on you across multiple origins.
- hiccuphippo 2y ago
  All they need to do is redirect you through a central hub after login.
  - quectophoton 2y ago
    On first visit: * "Please wait while we verify that you're not a bot, for which we'll need to associate a unique identifier with your browsing session." (logged in or not) * The validation needs to do a quick redirection to an external centralized service, because if they can already identify that you're not a bot, you save CPU cycles, and you care a lot about carbon footprint after all. * Redirect back to the original website, passing the "proof of not-a-bot" somewhere in the URL. This is just a string. * The website absolutely needs to load the external script `https://proof-validation.example.com/that-unique-string.js https://proof-validation.example.com/that-unique-string.js` for totally legit purposes obviously related to detecting bot behavior, "somehow". Half-joking because I don't think this would fly. Or maybe it would, since it's currently trendy to have that PoW on first visit, and users are already used to multiple quick redirections[1] (I don't think they even pay attention to what happens in the URL bar). But I'm sure we'd get some creative workarounds anyway. [1]: Easy example: A post on Xitter (original domain) -> Shortened link (different domain) -> Final domain (another different domain). If the person who posted the original link also used a link shortener for tracking clicks, then that's one more redirection.

deleted 2y ago

[deleted]

Svoka 2y ago

So, the web Ad marked is being monopolized on platforms. Google and Facebook make overwhelming revenue from their own websites. Now, down with the rest.

candiddevmike 2y ago
Facebook pixel works just fine without third party cookies.

codeqihan 2y ago

I have always blocked third-party cookies. The only problem I've encountered (there may be others, but I haven't come across them) is that some embedded videos on certain web pages won't play and prompt me to enable cookies.

xnx 2y ago

Careful what you wish for. Removing third party cookies without a replacement will make aggressive fingerprinting ubiquitous.

xenator 2y ago
I have feeling that it is all related. When use see request to accept cookies with list of over 9000 trackers it doesn't mean that this page will have zillions of javasripts included on the page. It just means that site owners fingerprint user and process user interactions to third parties server side. Only reason why we see this movement is because advertisers feels confident about removing third party cookies.
bennettnate5 2y ago
...thus raising the bar for privacy-preserving techniques in client side browsing. Aggressive fingerprinting arrived years ago; if we can move beyond cookies altogether and focus on it as the next issue to tackle, I would think that's a net win. Saying that we should keep 3rd part cookies alive and healthy because it will keep websites using them against users rather than fingerprinting is just throwing the majority of users who don't know to block them under the bus. Plus it still leaves the door open for even privacy-conscious users to be defeated by fingerprinting anyways if a server is keen on tracking particular individuals.
- Terr_ 2y ago
  Yeah, the only way third-party cookies will block creepier fingerprinting crap is if the creepy stuff is prohibitively more expensive. But once anyone gets a creepy fingerprinting system working, the barriers drop, and it becomes cheaper to resell the capability as a library or service. It may offer some minor benefits in terms of enabling companies that "want to be more ethical than the competition", but that too seems like a long-shot. :p
- xnx 2y ago
  Fingerprinting defeating technology is just the kind of thing that I wish Firefox spent its effort developing instead of reimplementing features form Chrome like tab groups.

growthwtf 2y ago

What a weird piece of writing. Is this like just chicken scratch? Or is this seriously some kind of part of the W3C working process? Section 2: Third party cookies have gotten bad. Ok. Section 3: There are legitimate use cases that third party cookies currently cover. Also ok. Then they throw in, "Be aware that a set of new technologies which carry minimal risk individually, could be used in combination for tracking or profiling of web users." Yes? Huge scope increase in the document though and all of a sudden we're now talking about tons of tracking technologies in aggregate? The authors move on without further comment. Section 4: I think the first half is essentially saying that new technology coming online in the web platform will make the third party cookie problem worse, so we should fix it soon. OK, I'm with back with you. Then the document suddenly pivots to proposing general standards for web privacy again, saying that the burden of proof is on the people originating the proposal to, before concluding by saying (apparently without irony?) that justifying the removal of third-party cookies' impact on business is outside of the scope of the document. I'm missing a ton of cultural context here about how W3C works, so I'm guessing this probably amounts to rough notes that somebody intends to clean up later that I'm being overly critical of, and they didn't expect it to get any traction on hacker news.

bilekas 2y ago
It's W3c... They've never been the most coherent with standards ironically.
deleted 2y ago
[deleted]
deleted 2y ago
[deleted]
motorest 2y ago
...or it's a design by committee thing, and some people in the room are doing their best to preserve current and future tracking technology.
- bilekas 2y ago
  It's exactly this, there is a group who come together and never agree on rules, but when they do, they never enforce them. It's I believe the definition of a paper tiger, sadly. A great idea executed horribly.

freeamz 2y ago

Feel like all this cookies thing is just white wash, when if you enable JS then they can track you no matter if you have cookies or not! Nothing is private: https://nothingprivate.gkr.pw https://nothingprivate.gkr.pw More effort ought to be put into how to make web spec to NOT be able track user even if JS is turned on. Browser vendor Brave, Firefox suppose to privacy browser are NOT doing anything about it. At this point, do we need to using JS disabled browser to really get privacy on the web?

brookst 2y ago
It’s an interesting question: is it possible for JavaScript to be turing complete, able to read/write the DOM, and somehow prevent fingerprinting / tracking? My gut says no, not possible. Maybe we need a much lighter way to express logic for UI interactions. Declarative is nice, so maybe CSS grows? But I don’t see how executing server-controlled JS could ever protect privacy.
- Enginerrrd 2y ago
  I've always thought there should be a way to use the browser like a condom. It should obfuscate all the things that make a user uniquely identifiable. Mouse movement/clicks/typing cadence should be randomized and sanitized a bit. And no website should have any authority whatsoever to identify your extensions or other tabs, or even whether or not your tab is open. And it certainly shouldn't allow a website to overrule your right click functionality, or zoom, or other accessibility features.
  - JSteph22 2y ago
    The obfuscation makes you more easily identifiable.
    - teo_zero 2y ago
      How so?

badmonster 2y ago

third-party cookies have done more harm than good, and it's time to fully remove them from the web platform. It is refreshing that their acknowledgment that replacements must not just be privacy-washed clones of the old model — purpose-built alternatives need to prove they don’t recreate the same surveillance infrastructure.

sedatk 2y ago

If third-party cookies are removed, the tracking parties will just ask web sites to include the script on their web server, so their cookies become "first party" again. I don't understand how this helps the web unless protections against tracking itself, not the methods used, are established.

Dwedit 2y ago
It's about trust, the third-party ad companies don't trust that the first party will be honest with them, not generating fake impressions or clicks.
- sedatk 2y ago
  I doubt that. Their script could as well be "fetch that script from that URL and run it". They would have fraud detections already in place on their side regardless of which script runs on the client.
  - chii 2y ago
    > "fetch that script from that URL and run it" but if you cannot have a third party cookie, the remote site from the tracker cannot be sure that the script was actually downloaded, nor executed.
    - littlecranky67 2y ago
      sure you can, if their script is making a 3rd party xhr request to that tracker.
      - chii 2y ago
        but this request could be faked, if the first party wanted to fake the traffic (for example, to make ad revenue). This third party cookie is what prevents this faking at this moment.
    - kevin_thibedeau 2y ago

dbushell 2y ago

The "replacement" is already being penned: https://www.w3.org/TR/privacy-preserving-attribution/ https://www.w3.org/TR/privacy-preserving-attribution/ Which is just going to be in additional to 3rd-party cookies. Google's own study concluded removing 3rd-party cookies loses revenue and "privacy-preserving" tracking increases revenue: https://support.google.com/admanager/answer/15189422 https://support.google.com/admanager/answer/15189422 So they'll just do both: https://privacysandbox.com/news/privacy-sandbox-next-steps/ https://privacysandbox.com/news/privacy-sandbox-next-steps/

surajrmal 2y ago
There are regulatory agencies which have specifically told Google it is not allowed to remove 3rd party cookies without a replacement as while Google would be able to continue to function fine, their competitors would take a major loss.
- pas 2y ago
  Do you have links for this? I'm curious about which bodies and what was their argument.
  - diogocp 2y ago
    https://www.gov.uk/cma-cases/investigation-into-googles-privacy-sandbox-browser-changes https://www.gov.uk/cma-cases/investigation-into-googles-priv...
    - dbushell 2y ago
      Seems like the CMA are concerned for other advertisers who profit from 3rd-party cookies, no concern for user's privacy. That poor billion dollar industry, how will it cope?
      - blibble 2y ago
        their mandate is to regulate competition not privacy

dankwizard 2y ago

Using a custom-built interception layer, I decouple session tokens from identifiable browser states, rotating my signature footprint every few requests via controlled entropy injection. “No more third-party cookies” sounds like a big shift, but it’s functionally irrelevant if your presence is already undetectable.

Animats 2y ago

I haven't allowed third party cookies in a decade. No problem.

kstrauser 2y ago
I had a little trouble when Safari rolled out ITP a while back. SSO providers scrambled to figure out how to fix federated logins, and because it affected every iPhone, they managed to do it with a quickness. I haven't had a single problem since.

nurettin 2y ago

Sounds like a diversion. Websites can use local storage and fingerprinting to do anything they want at this point.

j16sdiz 2y ago

> Some of the use cases that are important enough to justify the creation of purpose-specific solutions include federated identity, authorizing access to cross-site resources, and fraud mitigation. Unpopular opinion: There are no privacy-preserving way for "fraud mitigation". Either you accept fraud as cost to run business, or do away the privacy. Most business owner don't want the fraudulent user to come back, ever. If we value the privacy of user, we need to harm some business.

omeid2 2y ago
In theory it is by possible by "blind attestations" by a 3rd party, in an indirect way, that is what you get by Cloudflare, where they monitor traffic from an "agent" using their own heuristics for identity, without sharing that identity with you.

kazinator 2y ago

> Some features of the web that people have come to expect, and which greatly improve user experience, currently depend on third-party cookies. Idea: domains should be able to publish a text record in their DNS (similarly to SPF record for mail domains) designating other domains which are allowed to peek at their cookies. Suppose I operate www.example.com. My cookie record could say that foo.com and bar.com may ask for example.com cookies (in addition to example.com, of course). A website from any other domain may not. As the operator of example.com, I can revoke that at any time. Whenever a page asks for a cookie outside of its domain, the browser will perform a special DNS query for that cookie's domain. If that query fails, or returns data indicating that the page does not have access, then it is denied.

j16sdiz 2y ago
Not a bad idea, TBH. Just feeling uncomfortable putting more data into DNS. DNS is not encrypted. DNSSEC is easy to bypass (or break way too often that nobody want to enforce it). -- but these are not w3c's problem.
- kazinator 2y ago
  Yes; if someone hijacks example.com's main A record, that gets caught at the SSL level. If someone hijacks example.com's cookie record, that won't be caught; they just write themselves permission to have their page access example.com's cookies. The same info could just be hosted by example.com (at some /.well-known path or whatever). The web could generate a lot of hits against that. The DNS records could be (optionally?) signed. You'd need the SSL key of the domain to check the signature.
- tptacek 2y ago
  DNSSEC isn't encrypted either.
- pabs3 2y ago
  When you say bypass, do you mean disable DNSSEC on your own computer? Or are there known vulnerabilities in DNSSEC cryptography or software?

RainyDayTmrw 2y ago

This is kinda hollow while Google controls Chrome, and Chrome has majority market share[1]. And, if regulators get their way, and Google divests Chrome[2], I'm not expecting that the new highest bidder would do any better with it. [1] The exact figure may depend on which source you use, and there is some indication that ad and tracker blocking may artificially deflate Firefox and friends. https://gs.statcounter.com/browser-market-share https://gs.statcounter.com/browser-market-share [2] https://www.wired.com/story/the-doj-still-wants-google-to-divest-chrome/ https://www.wired.com/story/the-doj-still-wants-google-to-di...

JoshTriplett 2y ago
As long as the new steward of Chrome is not an advertising company, they will no longer be restricted from removing third-party cookies.

anothernewdude 2y ago

UMatrix blocks those by default. Blocking third party cookies very rarely breaks anything. I can only think of one instance in the past five years, and that wasn't really a third party cookie, but one website using two different domains.

jeroenhd 2y ago
You even don't need uMatrix for that. Every major website has a toggle for it in the settings.
- anothernewdude 1y ago
  Cool if you want to trust every major website and find the settings for each website. I'll just live my life.

aligundogdu 2y ago

This is actually a somewhat inconvenient wish, because the alternative would increase the fingerprint investments required for all browsers to recognise us.

noduerme 2y ago

I block almost all 3rd party cookies, but at this point isn't it kind of nice to just have your google login follow you around, so you don't constantly have to login on other sites? Sure, it sucks for privacy, which is why your google account should never be tied to your phone number or your actual identity, but it's super convenient. Oh wait. It's tied to your real identity? Go back to square one and start a fake identity with all the root info. Buy a burner with a prepaid card, use it to set up a yahoo mail account, use that to set up a mail server you pay for in bitcoin, use that to verify a gmail account, and never let down your VPN. You're going to be tracked; the right move isn't to waste time worrying about that, it's to be someone invisible and untethered in the real world.

jeroenhd 2y ago

Google won't implement this spec. Currently, they're legally not allowed to, because advertisers called in the industry watchdog, asserting that without third party cookies to stalk users, they could not compete. Google extended their privacy sandbox, opened and closed it, talked about it, and eventually backed down from their plan to block third party cookies ASAP. Maybe Chrome can get away with "the spec says it, sorry advertisers" but I doubt the courts will accept that.

nine_k 2y ago
That is, Firefox can reject third-party cookies because it's not made by a company that deals in online advertising, but Chrome cannot, because Google is the biggest online ads dealer and thus would have an unfair advantage over other ads dealers, correct?

ordu 2y ago

How about third party js? The site doesn't render properly without third party js from www.w3.org.

oliwarner 2y ago

Sure but this neither makes an attempt to list the valid uses of third party cookies, nor a suggestion of what magic definitely not a third-party cookie unicorn is going to ride in and offer us the safety we need. Pretty fluffy through and through. I suggest that we do just need to keep third-party cookies but they're explicitly opt-in. That could just be allowing (once) a third party to be present everywhere (like a SSO) and browsers making it known when a third party is accessing data.

lofaszvanitt 2y ago

Has anyone noticed this pattern that for some pulled out of my arse explanation, these standards groups and google suddenly remove features that would be useful to people, but they decided it's now not ok in the future. Like http referers now only show the domain, not the full url, because insert complete bs explanation. And now 3rd party cookies too...

Funes- 2y ago

Adopting javascript universally, and consequentially making it a de facto standard, was a terrible mistake. I think the only way out of this nightmarish privacy-less state of things (in this regard) might be something like the EU putting out an extremely severe law banning all these bad practices. Banning all practices that undermine privacy is the only morally valid option; it's not only about 3rd-party cookies. It'd be an incontrovertible measure for everyone but bad actors, just like USB-C or user-removable batteries (February 2027).

samyar 2y ago

what about iframes?

andrewla 2y ago

What are the legitimate use cases for third-party cookies? The only one I can think of is if there is a single logical site spread across multiple domains, and you want to be able to maintain a single session across both domains, but are not willing (for aesthetic reasons or technical reasons) to encode this information in the links while moving between domains. Are there others? As far as I'm concerned I don't even want first-party cookies to be available when accessed through a third-party context (i.e. if I have a cookie on a.com, and b.com fetches an image from a.com, I don't want that image request to send my a.com cookie). My preference for this entire discussion is that we eliminate cookies entirely, but use self-signed client certificates very aggressively. When you navigate to a url the user agents sends a client certificate specific to that domain. Any subsidiary fetches use a (deterministic) scoped client certificate specific to the subsidiary domain. All other state tracking is required to be server-side and linked to the certificate. The user can instruct their user agent to reset any of these.

dietr1ch 2y ago
> Single logical site spread across multiple domains. Is there really need for this? I get subdomains can help routing, but beyond that sites spreading over multiple domains are chaotic and phishing-prone. People get used to jump from foo.com to foo.net or scammyfoo.tk and enter their credentials if they look similar. I think that a big part of how password managers help is by keeping passwords from their users and not sharing them with any random domain that may read similar or misleading.
- horsawlarway 2y ago
  A common need for this is during an acquisition or merger. It's fine and all to assume that domain is identity, but that doesn't actually map too well to relatively complex organizational hierarchies. Ex - Bank A and Bank B merge. There is going to be a period where they have to navigate that two domains represent a single organization. It's often a fairly high level of effort to move to a completely new domain, and it won't be done overnight. Yes - eventually you want to be back on a single domain, and I think there is definitely a world where this leads to some very bad patterns (HR and healthcare are two examples - if you've ever seen a login need to bounce between like 5 different domains because they've refused to actually do the technical work to consolidate back on a single domain, and treat the domain as marketing). But it's a really valid spot to end up in, and is the most common cause of having a single entity spread out over multiple domains in my experience.

econ 2y ago

It would be nice to be able to delete all cookies not associated with a saved password or login.