Hacker News Reader

> There is basically no way to say to the browser - I am "X" and my friends are "Y" and "Z", they should have permissions to do things that I don't allow "A", "B", and "C" to do.

Isn't that CORS? That sounds like CORS.

CORS can fully stop an origin from accessing an http resource, this discussion is about allowing different origin to reuse the browser local state (like cookies, http cache, local storage).

CORS is a stronger security layer in the browse than cache segregation, some people want to keep the CORS security model but weaken cache segregation.

> The issue is that you're immediately deciding that domain X and domain Y are different entities.

That's... literally what domain means.

"A domain name is an identification string that defines a realm of administrative autonomy, authority or control within the Internet." - Wikipedia

The entire security policy of the Internet is built on this definition. It's not an assumption. It's a core mechanism.

wrong again... It's very clear "*A* realm". Not "The realm". Certainly not "The only realm".

Entities are allowed to control many assets.

Simplest possible case in the wild for you, since you're being obtuse.

I'm company "A". I just bought company "B". Now fucking what?

> but I fundamentally disagree with you ["We actually have a functioning standard for this on mobile"]

I wouldn't expect any less.

https://quoteinvestigator.com/2017/11/30/salary/

> In practice [...]

There's your problem. Try fixing that.

Moving everything under a single domain makes no sense for the use-case of cross-organization sharing though. Domain as as the root identity on the web is just broken and there's no way to make it work.

    mysharedhosting.com/customer1
    mysharedhosting.com/customer2

Two separate identities. Is it even possible to let the browser know that they should be segmented? Nope.

    customer1.mysharedhosting.com
    customer2.mysharedhosting.com

How about this? No again, not without getting yourself on the suffix list which is just a hack.

    mycompany.com
    joinmycompany.com

Can you tell the browser that these are actually the same and shouldn't be segmented? Nope!

This makes more sense and doesn’t dilute your brand, improves SEO, and helps protect against phishing by making your customers and staff look for a single known-good domain:

   https://mycompany.com/join

Your take is wrong.

Having a domain is identical to having a driver's license: This org says I am "X".

It is fundamentally different from uniquely identifying me.

I am still the same person if I give you my library card - a different ID from a different org that says I am "Y".

Nah, the problem is definitely on your end.

> Having a domain is identical to having a driver's license: This org says I am "X".

Nope. You just described two different documents.

http://horsawlarway.example/drivers-license.html

http://horsawlarway.example/library-card.rdf

It's very odd the position you're taking here, given the sentiment in your other tirade about being digital sharecroppers to Facebook and Google <https://news.ycombinator.com/item?id=27369652>. Your proposed solution is dumping more fuel in their engines—which is why it's the kind of solution they prefer themselves—and completely at odds with e.g. Solid and other attempts to do things thing would actually empower and protect individual users. I'm interacting with your digital homestead, why are you so adamant about leaking my activity to another domain?

If you actually search a bit on the internet, you'll find Google actually made a RFC for a standard allowing websites to list other domains that should be considered as same origin. Look for the comments on it by the ietf and you'll understand why this is a terrible idea.

Why don't you search a bit and come back with a link?

Because I can't comment on an RFC I haven't seen, and a quick google search of my own based on your comment turns up nada.

That said - I'm fully aware of the downsides of this approach, but I want my browser to be (to put it crudely) MY FUCKING USER AGENT. I want to be able to allow sharing by default in most cases, and I want a little dropdown menu that shows me the domains a site has listed as friendly/same-entity, and I want a checkbox I can uncheck for each of them.

Then I want an extension API to allow someone else to do the unchecking for me, based on whether the domain is highly correlated with tracking (Google analytics, Segment, Heap, Braze, etc)

-------------

The way I see it, the road to hell is paved with good intentions. If the web was developed in our current climate of security/privacy focus, how likely is it that even a fucking <a href=[3rd party]> would be allowed? Because I see us driving to a spot where this verboten. Which also happens to be the final nail in the coffin for any sort of real open platform.

Welcome to the world where the web is literally subdomains of facebook/google. What a fucking trash place to be.

As somebody directly involved in this space, that's a pretty bad summary. The spec for first party sets (not an RFC, just a draft) isn't in a great state. Google is going to implement it anyway, Microsoft is supporting, Apple basically said the spec was crap but they might be interested in a good version of it, and Firefox said they didn't like it.

Speaking as engineer.. the Firefox folks don't really get it. You can't just break what sites like StackOverflow and Wikipedia have been doing for years (and in some cases decades) and then say "you were doing the wrong thing." Some version of FPS will ship in browsers, probably in the next 2 years.

Quoting Apple's position directly "[...] Given these issues, I don’t think we’d implement the proposal in its current state. That said, we’re very interested in this area, and indeed, John Wilander [Safari lead] proposed a form of this idea before Mike West’s [Google] later re-proposal. If these issues were addressed in a satisfactory way, I think we’d be very interested. [...]"

Also it was a W3C TAG review. The W3C and IETF are different organizations.

> RFC for a standard allowing websites to list other domains that should be considered as same origin

No, they allowed an origin to list other origins whose cookies would be sent back to the serving origin correctly even if they were iframes loaded in the parent origin DOM.

I.e. this is the expected behavior for iframes until Safari decided that there was such a thing as "third party" origins whose web semantics could be broken in their war against advertising.

Google is trying to (partially) restore the expected behavior of iframes so that named origins get their own cookies sent to them, which is how things worked for the first two decades of the web.