3 ms·
> Some features of the web that people have come to expect, and which greatly improve user experience, currently depend on third-party cookies. Idea: domains s
by kazinator 2y ago
> Some features of the web that people have come to expect, and which greatly improve user experience, currently depend on third-party cookies.
Idea: domains should be able to publish a text record in their DNS (similarly to SPF record for mail domains) designating other domains which are allowed to peek at their cookies.
Suppose I operate www.example.com. My cookie record could say that foo.com and bar.com may ask for example.com cookies (in addition to example.com, of course). A website from any other domain may not. As the operator of example.com, I can revoke that at any time.
Whenever a page asks for a cookie outside of its domain, the browser will perform a special DNS query for that cookie's domain. If that query fails, or returns data indicating that the page does not have access, then it is denied.
- j16sdiz 2y agoNot a bad idea, TBH. Just feeling uncomfortable putting more data into DNS. DNS is not encrypted. DNSSEC is easy to bypass (or break way too often that nobody want to enforce it). -- but these are not w3c's problem.
- kazinator 2y agoYes; if someone hijacks example.com's main A record, that gets caught at the SSL level. If someone hijacks example.com's cookie record, that won't be caught; they just write themselves permission to have their page access example.com's cookies. The same info could just be hosted by example.com (at some /.well-known path or whatever). The web could generate a lot of hits against that. The DNS records could be (optionally?) signed. You'd need the SSL key of the domain to check the signature.
- tptacek 2y agoDNSSEC isn't encrypted either.
- pabs3 2y agoWhen you say bypass, do you mean disable DNSSEC on your own computer? Or are there known vulnerabilities in DNSSEC cryptography or software?
- tptacek 2y agoThe stub resolver on your own computer doesn't actually speak DNSSEC. It speaks normal DNS to a recursing resolver, probably at your ISP or at Google, that itself does DNSSEC validation, and then just sets a bit in the response back to you that says "this is authentic".
- kazinator 2y agoGlibc supposedly has DNSSEC, but does anyone use it: https://sourceware.org/glibc/wiki/DNSSEC https://sourceware.org/glibc/wiki/DNSSEC
- pabs3 2y agoThe recursing resolver is on my local system, anything else is clearly madness.
- tptacek 2y agoAlways fascinating to hear about how the standard configuration for every workstation Linux distro, macOS, and Windows 10 are "clearly madness". Do go on!
- chii 2y agoI dont think DNS should be overloaded to have a security measure.
- deleted 2y ago[deleted]
- kazinator 2y agoIt's already used in a similar way for SPF records, in the context of e-mail. Using a SPF record, a domain indicates hosts that are allowed to deliver mail on its behalf (meaning using an envelope sender address from that domain).
- int_19h 2y agoBut then all the ad-supported websites will whitelist the ad tracking cookies, which is precisely what they are trying to avoid here.
- kazinator 2y agoAh, but in so doing they will have to publish their whitelist, which will exhaustively have to list every single affiliated domain. Browsers and browser extensions will be able to use that info to identify shit sites, turning the whitelist around into blacklisting uses, like ad blocking and whatnot. One simple mechanism would be for the browser to deny the cookie request if the requested domain's cookie DNS record contains more than, say, three affiliated domains. (At the discretion of the browser developer, and user settings.) The proliferation of that sort of config would discourage domains from being overly promiscuous with their tracking cookie access. Plus, existing cookie control mechanisms don't go away.
- fastest963 2y agoThis is already a feature called "Related Websites": https://github.com/WICG/first-party-sets https://github.com/WICG/first-party-sets