3 ms·

This should be solved by disabling third-party cookies, right?

by andor 12y ago

marcosdumay 12y ago
Wrong. The requests are made to the sites the attacker wants to test. There is no third party sending cookies to you.
- fryguy 12y ago
  Isn't the whole point of blocking third party cookies so that you don't send cookies to tracking sites? For instance, if you're on example.com, and it loads a resource on ads.shadytracker.com, that it sends no information to the ad site (in addition to not accepting them)? If it's not this way, then all the ad site needs is for you to visit them one time and they'll track you from then on.
- andor 12y ago
  Wrong. :-P It's not about receiving, but about sending cookies to a third party. Let's say I visit marcosdumay.com, where you include some images and scripts from other hosts on your page, and you want to know whether your visitors are logged into Facebook. Since marcosdumay.com != facebook.com, all content from Facebook on your page is third-party content. How does Facebook track sessions again? Right, through cookies. If third-party cookies are disabled, and an img src tag on marcosdumay.com triggers a request to facebook.com, this request will not contain my Facebook session cookie, and I'll appear to be logged out, even when I'm not.
  - marcosdumay 12y ago
    Take another look at the article. The attaker makes the browser send the Facebook authentication cookies to only Facebook.
    - andor 12y ago
      Yes of course, that's how cookies work. And disabling third-party cookies will stop the browser from receiving and sending to any third parties. In your browser, you have several options to deal with cookies: allow all of them, allow none, or disable third-party cookies only. Let's say I visit attacker-site.com, which includes both local content and stuff from other domains: attacker-site.com |`-- tracking-script.js |`-- tracking-image.gif |`-- facebook.com/me `--- twitter.com/tweet-button.png Content from other domains is third-party content by definition, and leads to third-party requests, in this case to facebook.com and twitter.com. If third-party cookies are disabled, those requests will will not include any cookies. Even if I'm logged in to Facebook, to attacker-site.com it will appear as if I'm not.

This should be solved by disabling third-party cookies, right?

by andor 12y ago

This should be solved by disabling third-party cookies, right?

marcosdumay 12y ago

Wrong. The requests are made to the sites the attacker wants to test. There is no third party sending cookies to you.

fryguy 12y ago
Isn't the whole point of blocking third party cookies so that you don't send cookies to tracking sites? For instance, if you're on example.com, and it loads a resource on ads.shadytracker.com, that it sends no information to the ad site (in addition to not accepting them)? If it's not this way, then all the ad site needs is for you to visit them one time and they'll track you from then on.
andor 12y ago
Wrong. :-P It's not about receiving, but about sending cookies to a third party. Let's say I visit marcosdumay.com, where you include some images and scripts from other hosts on your page, and you want to know whether your visitors are logged into Facebook. Since marcosdumay.com != facebook.com, all content from Facebook on your page is third-party content. How does Facebook track sessions again? Right, through cookies. If third-party cookies are disabled, and an img src tag on marcosdumay.com triggers a request to facebook.com, this request will not contain my Facebook session cookie, and I'll appear to be logged out, even when I'm not.
- marcosdumay 12y ago
  Take another look at the article. The attaker makes the browser send the Facebook authentication cookies to only Facebook.
  - andor 12y ago
    Yes of course, that's how cookies work. And disabling third-party cookies will stop the browser from receiving and sending to any third parties. In your browser, you have several options to deal with cookies: allow all of them, allow none, or disable third-party cookies only. Let's say I visit attacker-site.com, which includes both local content and stuff from other domains: attacker-site.com |`-- tracking-script.js |`-- tracking-image.gif |`-- facebook.com/me `--- twitter.com/tweet-button.png Content from other domains is third-party content by definition, and leads to third-party requests, in this case to facebook.com and twitter.com. If third-party cookies are disabled, those requests will will not include any cookies. Even if I'm logged in to Facebook, to attacker-site.com it will appear as if I'm not.