Hacker News Reader

Comment by sodality2 | Hacker News Reader

Disabling cross site cookies breaks many sites.

No it does not. I've had 3rd party cookies disabled for as long as I can remember. I've found less than five sites that had issues.

It's going to break all 3rd party social layer providers. Most news sites don't have native comments and rely on a 3rd party like a Disqus. Login in state is stored as a cookie. It also going to break all the openID stuff that is heavily used in organizations like Walmart. OpenID is all based around cookies. I remember having to rebuild our provider when Safari released an update that you can't set 3rd party cookies without user interaction.

>> It's going to break all 3rd party social layer providers

Good. Disqus had it too easy.

>> It also going to break [..]

Good. They had it too easy.

I'm absolutely loving the fact that my switch to Firefox is paying off. Finally!

That type of attitude toward the millions of users that use discus just shows why Firefox is a dying browser with ever decreasing install base. Funding will keep decreasing as it is tied to search engine deals which is based in active users.

Anything that shields me to some extent from the "grab money fast, before anyone notices we're fucking them over" companies out there is a champion, as far as I'm concerned.

> Funding will keep decreasing as it is tied to search engine deals

Good. They had it too easy. I'd pay $20 for clean version of FFX on Mac/iOS App Store.

No Firefox is dying because browsers aren't a product anymore they're a feature of the OS.

Thank Microsoft, Google and Apple for that.

there are valid criticisms of firefox but breaking disqus is a bizarre one. when is the last time you used it? my impressions is that these days the literal majority of content produced on it is spam and it's been this way for the better part of the last decade

What did you do instead? Redirects?

Same. I've always had 3rd party cookies disabled for as long as the option has existed (which is a long, long time). Never noticed any problem to me.

I guess we use different sites then. I should specify I mean it doesn't keep me logged in. I consider this breaking because if I click a link to that site, it loses the original context once logged in.

It's a shame because local storage and friends aren't quite as secure (no way to block all JS from accessing it like you can with cookies).

What would be the point of localstorage if JS couldn't access it? Cookies can be set and get via http headers, but is localstorage available by other means than JS?

No, it is only accessible from JS. Parent comment does not make sense.

By that logic, we should turn off our computers to improve security.

Is this really an issue? If the attacker has XSS on your site you're already screwed because they can manipulate the DOM to simulate user actions.

It means they can't exfiltrate the cookie, which I think is a pretty nice win, even if they can still perform requests to the domain with that cookie.

For one thing it means they're locked to my session.

How would they steal HTTP-only cookies this way?

They wouldn’t steal the cookie, they’d just have the script send the requests as the user directly.

sounds like a desirable feature to me

Agreed, that's why I use it!

The only sites that really break are organizational websites, which you can whitelist anyway.

why?

Good question. third party login sites mostly don't keep me logged in, kick me out, doesn't let me log in, etc.

Give us some real concrete examples. This does not match my experience at all so I'm dubious.

I have trouble with google login (url must be copied into a google tab) and oracle cloud loses my tenancy home region every few minutes (https://i.imgur.com/ZCsepq3.png). Several other examples like LMS's that use O365 to log in must be manually logged in every time

I use both Google and O365 at the educational institutions I work at and both platforms works fine across a wide variety of applications. Strange that you are experiencing these issues.

My settings: https://i.imgur.com/8X1a7gs.png

Reply on news.ycombinator.com