Hacker News Reader

Hacker News

Comment by adriancr | Hacker News Reader

Parent Full thread

adriancr

> increasingly unethical and invasive fingerprinting techniques to remain competitive.

... or serve cookies via first-party subdomain ...

Also, hasn't Safari already killed third party cookies?

View on HN

I haven't had third party cookies enabled in Firefox for a decade. Google is coming late to this.

I hear this argument a lot. Yes, you can turn off third party cookies, and I have as well, but the power to control the default behavior is very important. What we should be asking ourselves is "Does the average user turn off third party cookies?"

This is the same reason Facebook is throwing such a fit over apple's new prompt. It makes it easy and likely for the average user to disable something without having to dig through settings.

Google's identity signal that they have given themselves access to works across cross-domain and cross-device. First-party cookies do neither.

I would strongly prefer that everyone restrict themselves to the capabilities of first-party cookies. But it's still true that Google is not holding themselves to the same restrictions that they're trying to enforce on other parties.

Yup.

Google is lagging everyone else on this issue because it'll hit their advertising income.

How do advertisers reconcile cloaked first party subdomains? It requires fingerprinting, or the first party to tell the real 3rd party (cloaked as a first party) things like email or real name, that can be cross referenced, no?

Yes, that is generally how they resolve it. Apple has started to reduce the effectiveness of CNAME cloaking.

The goal is that advertisers will eventually be far better off working with a system like Private Click Measurement (in Safari betas now and set to be in next releases) than insecure things like CNAME cloaking.

The things people don't know about third-party Javascript and "first-party" cookies...

How would third party JavaScript fingerprint users? Only if there’s a backend data broker aggregating identities based on a universal token (e.g. email). Or one of those super shady tech wizardry techniques like timing OpenGL calls.

Then the advertisers need to trust the first parties.

or the subdomain goes to an advertiser server.

Yeah... we're all too lazy to relay our data through our own backends. I recommend this to clients but there's always some killer analytics feature that requires the JS integration.

Oh, I didn't realize a subdomain was not considered 3rd party. So soon we'll see adnetwork.mydomain.com and www.mydomain.com.

I think we should just make cookies only work when the domain matches exactly.

You would see mydomain.com/adnetwork then.

Can browsers look up a different server addresses to send requests to that way? I didn't think that's how DNS worked but I'm no expert.

Advertisers can't trust content people to forward requests because it would be too easy to fake them.

No I don’t think so. DNS only works on the domain part of the url.

However a server like nginx can be set up to proxy requests matching a specific url pattern to another server. This would be a bit more work than adding a DNS entry and referencing that though.

Or setup cdn to redirect certain paths to the adserver and mark those paths as nocache

The reason why subdomains work is that you can make the root domain go to your own site, while the subdomain goes to your ad provider. If you use a CNAME it's literally just a matter of publishing another DNS recod and you're done. Moving to a subdirectory requires setting up a reverse proxy on your existing infrastructure, and keeping it up to date every time your ad network switches domains. Hell, on a lot of platforms you don't even have the ability to reconfigure the server in such a way as to proxy through an entire ad network, so you'll have to use a platform or technology specific plugin if available.

That's why the ad industry used third-party domains in the first place, BTW - it's a zero-setup solution. Subdomains are minimal-setup; subdirectories are a huge hassle.

>That's why the ad industry used third-party domains in the first place

Another reason is ad provider doesn't have to trust first party, if ads are served from their server.

I'm not sure which reason is more important.

You wouldn't need to. Let's say they gave you a php script (any server side processing language) you could place it anywhere and it would download new ad content and show it as a first party ad.

Easier than changing a cname.

Reply on news.ycombinator.com