Full Third-Party Cookie Blocking | Hacker News Reader

Full Third-Party Cookie Blocking

webkit.org

55 pointsavastel8 comments

Previously: https://news.ycombinator.com/item?id=22677605.

I think the specific thing being highlighted here is that some wording has been changed since the original post; it used to only read "Service Worker registrations" (https://web.archive.org/web/20200324185029/https://webkit.or...) but now is "Service Worker registrations and cache". This section right under it was also added:

> A Note On Web Applications Added to the Home Screen

> As mentioned, the seven-day cap on script-writable storage is gated on “after seven days of Safari use without user interaction on the site.” That is the case in Safari. Web applications added to the home screen are not part of Safari and thus have their own counter of days of use. Their days of use will match actual use of the web application which resets the timer. We do not expect the first-party in such a web application to have its website data deleted.

> If your web application does experience website data deletion, please let us know since we would consider it a serious bug. It is not the intention of Intelligent Tracking Prevention to delete website data for first parties in web applications.

This was discussed previously at https://news.ycombinator.com/item?id=22677605

How could browsers go further?

How about true opt-in? If you don't have to sign up for a site, with a login known to the browser, all interaction with that site is forgotten at browser exit or in an hour, and the site can't see any state from other sites.

If you do create an account and sign in, the browser should warn you that tracking has now started.

I am wondering when/if Safari and Chrome are going to address CNAME cloaking. Marketing and tracking companies are just having all their clients setup CNAME records to alias their domains back to the tracking domain and setting it to be a first party cookie to get around the new blocking techniques browsers are using.

I can't imagine you could do much. I know some ad blockers are optimistically resolving these CNAMES to see if they resolve to a tracker then block them. It'd be hard for a browser to generically identify who the first party is because it could anyone you want it to be.

I would argue that's OK.

The problem with third-party cookies is that information gets shared across websites and thus your behavior can be tracked across websites.

If you set a CNAME to point to a third-party, the cookies become in fact first-party and cross-domain tracking no longer works.

No it is not OK.

Cross-domain tracking still works. While every domain has its own cookie, it is extremely simple to use fingerprinting to connect those cookies to a single user.

In an unrelated note, Firefox just had a major screwup. They forced an update to Firefox 75 on users without asking. At least on Linux, the update is broken - right click menus are mostly blank.

There's no going back. Firefox now has "downgrade protection" - if you install an older version, it erases your preferences for "security".[1]

[1] https://support.mozilla.org/en-US/kb/install-older-version-o...

Reply on news.ycombinator.com