3 ms·

Third party cookie blocking on all modern browsers is a joke. I turn third party cookies off as a start, but sites can play all kinds of games with cookies to c

by x1798DE 12y ago

Third party cookie blocking on all modern browsers is a joke. I turn third party cookies off as a start, but sites can play all kinds of games with cookies to create "first party" relationships you don't know about, and that's not even including things like flash cookies or browser fingerprinting. As a start, consider that if you turn off third party cookies, logging into gmail also logs you into youtube.com. Yes, both are owned by the same company, but they are clearly different domains and so youtube should be a third party in your transactions with gmail.

orf 12y ago
> As a start, consider that if you turn off third party cookies, logging into gmail also logs you into youtube.com. Yes, both are owned by the same company, but they are clearly different domains and so youtube should be a third party in your transactions with gmail. That's because you don't sign into youtube, you go through Google's single sign on stuff which is a different domain.
- x1798DE 12y ago
  Check again. The two sites are on different domains. In order to log into both, at some point someone needs to convey state information to a third party. Gmail logins are managed through accounts.google.com, so either you have a third-party relationship with accounts.google.com when you are on youtube.com, or you have a third party relationship with youtube.com when you are on accounts.google.com. Either way, you pick up a third party cookie. You'll notice that even if you never (deliberately) went to youtube and you have 3rd party cookies turned off, a cookie for "youtube.com" will show up when you sign in. I haven't looked at it carefully, but I think they just put you through a chain of redirects when you click "log in" so that you have a first party relationship with each of the domains they want to sign you in to, and that's when they give you the cookie.

by x1798DE 12y ago

orf 12y ago

> As a start, consider that if you turn off third party cookies, logging into gmail also logs you into youtube.com. Yes, both are owned by the same company, but they are clearly different domains and so youtube should be a third party in your transactions with gmail. That's because you don't sign into youtube, you go through Google's single sign on stuff which is a different domain.

x1798DE 12y ago
Check again. The two sites are on different domains. In order to log into both, at some point someone needs to convey state information to a third party. Gmail logins are managed through accounts.google.com, so either you have a third-party relationship with accounts.google.com when you are on youtube.com, or you have a third party relationship with youtube.com when you are on accounts.google.com. Either way, you pick up a third party cookie. You'll notice that even if you never (deliberately) went to youtube and you have 3rd party cookies turned off, a cookie for "youtube.com" will show up when you sign in. I haven't looked at it carefully, but I think they just put you through a chain of redirects when you click "log in" so that you have a first party relationship with each of the domains they want to sign you in to, and that's when they give you the cookie.