Hacker News Reader

> with a user-controlled local browser setting and a new type of permission request popup.

Settings and pop ups mean that users have to understand them - which can be a huge user education challenge. I'm pretty skeptical of the argument that it's simple to add in a new user facing pop up and have the majority of users use it correctly.

I agree with you, but SSO is also not that seamless in practice and requires user education on which sites they use it with which ID.

I'd see a browser side system that could actually more user friendly and more unified than the current SSO situation.

I made no such argument regarding simplicity.

Nevertheless: even if a solution turns out to be too difficult for users to understand no matter how you present it (at which point you might want to rethink whether this apparently fundamentally flawed idea should even be implemented at all), violating your users' agency by taking the reigns and obfuscating the whole thing to them is morally wrong and in simple terms: an arsehole move.

If the user is perpetually confused using 'show all popups' Chrome, why wouldn't they switch to another browser that does that anyways?

Can't there be a setting to allow that setting / experience?

> self-appointed gatekeeper Judge Google (Judge Dread) takes requests from website owners for lists of domains they control

More specifically, website owners populate /.well-known/first-party-sets.json for their site and Chrome will always allow those cookies.

I don't think so? It looks to me like you also need to follow https://github.com/GoogleChrome/first-party-sets/blob/main/F... and get your sites onto https://github.com/GoogleChrome/first-party-sets/blob/main/f...

The FPS spec as described looks entirely duplicable by others and openly reimplementable by just cloning the FPS repo and following the same spec (which is open). Someone could choose in their browser to use a different set or a different repo or some hierarchical structure.

Because domain owners use /.well-known/first-party-sets.json, others can also scan for that themselves and perhaps build an independent repo from spidering.

Doesn't part of this update also make fingerprinting users even more robust with webGPU? Aka you don't need cookies because we can see who you are without them based on your machines unique specs

> they turned it into an insidious and opaque tool that lets them increase their insight, influence, and control

Sounds like most of the laws passed in my lifetime

Google- we've got your privacy

Literally. Lol.