Comment by bluepnume | Hacker News Reader

Comment by bluepnume | Hacker News Reader

The point where this becomes annoying is, when you're building a third party app or experience that is designed to be embedded in an iframe. Not a hidden iframe to track users, or for advertizing, but as a first-class experience, which can be embedded and displayed on a page on a different domain, and interacted with by users.

I wish the latest round of privacy restrictions (which I think are overall a decent idea) would take these use cases into account, or at least allow a mechanism to request the user's permission to use third party cookies for sites they trust.

Native apps have pretty robust permissioning systems. Why shouldn't websites?

(For context, these are some of the things we use at PayPal to build embeddable cross-domain components: https://medium.com/@bluepnume/introducing-paypals-open-sourc...)

> Native apps have pretty robust permissioning systems.

They really don't, though. No better than websites. I was astounded when I first used Little Snitch and saw how often random apps were making network requests. For example, Translate Tab (a simple language translation app) sends every translation to Google Analytics. And you need a relatively sophisticated tool / expertise just to see this.

It made me rethink the superiority of native apps since all this is so hidden. I prefer websites over native apps because I can run uBlock/uMatrix. Native apps can do whatever they want when it comes to tracking. People aren't even talking about it.

Not only do native apps get off scot free, HN glamorizes them as superior with no questions asked.

That's a fair point. I wonder if 'make network calls' was ever considered as an app permission, or if it was just considered so ubiquitous that it would be granted by default. Or if there was any thought made around 'same domain' and 'cross domain' restrictions for apps.

> or at least allow a mechanism to request the user's permission to use third party cookies for sites they trust.

Isn’t that what the Storage Access API is for?

Yes. But according to MDN it's largely unimplemented.

Reply on news.ycombinator.com