Does this affect single-sign-on implementations?
[1] https://blog.mozilla.org/security/2021/02/23/total-cookie-pr...
That feels worrying for competition, does it not entrench the current login providers?
**: Not total
It sounds like the "Full Self Driving"** from Tesla... got to love the new-speak.
**: Not fully self-driving....
(OK, technically tracking is less powerful than SSO, since only the third-party needs to know your "single" identity, the first-party website doesn't actually know it, where in SSO it does)
I mean, to be clear -- I mean the new thing might make you enter your username and password to SSO login on each site, whereas ordinarily if you have an active SSO session you don't need to re-enter username and password to login with SSO on a new site. Will it break SSO even if you are fine re-entering username and password every time you SSO login? I am not sure, but I definitely wouldn't be confident 'no' without more details/testing.
Those work by enbedded into pages (iframe) or popups may.
The biggest offender of this kind of usage is probably facebook comment / disqus comment.
The difference will be (I predict) that when you are redirected to the SSO, you will _always_ have to enter your username/password, or at least once per "first party" site you are logging into.
Whereas right now, sometimes when you get redirected to the SSO/oath, it already knows who you are, and you don't need to log in again -- you just get invisibly redirected back, and/or just have to click a button saying "yeah, it's cool". But with the cookie sandboxes, you'll always have to actually enter username and password to your SSO. Because the cookies that would have told the SSO(/oauth provider) that you have an active auth session, from when you logged in earlier today or whatever -- won't make it.
Or maybe not, depending on how it's implemented -- but if a redirect is enough to defeat it and make it think you're in a different sandbox, then I expect all the trackers will be able to defeat the sandboxing with careful use of redirects. So.
If the site is willing to redirect you directly to another site. I guess they can share data by themselves anyway?
I think sabotage of silent tracking pixel/ajax tracking is enough for most usage without breaking the web.
Implementations may of course vary.
If you're just worried about logging in through sso.coolcorp.com to third-party.corp using any of the normal methods (OAuth, SAML, Kerberos, etc.) then you're probably fine.
If you're worried about composing a page made up of lots of custom embedded components and those components _don't_ use SSO (or if they do, but they authenticate invisibly using an iframe instead of authenticating entirely server-side) then you may have some things to switch up.
Or rather a large logo that says "Please use a supported browser."