Hacker News Reader

Comment by zaroth | Hacker News Reader

Safari's default behavior is to Accept Cookies: 'From visited'. This prevents 3rd party iframes from saving cookies without a workaround. However, Chrome, Firefox, Opera, and IE (with proper P3P) all allow 3rd party iframes to save cookies by DEFAULT.

This leaves us with the choice of either using the workaround, or not providing a consistent experience that users expect.

If Safari worked like every other major browser in this regard-- allowing users to OPT-IN to the stricter cookie policy--then WSJ would be right in nailing Google for working around it.

I think Google did nothing wrong. They worked around a browser's non-standard default behavior, which is something we all do multiple times a day. Only when non-standard behavior is OPT-IN is there willful disregard for the user's intent in employing a work-around.

View on HN

Exploiting a browser flaw to track users who had reason to believe they weren't being tracked is pretty clearly wrong in my book... Arguments like yours would seem to be analogous to condoning stealing from cars or houses if their owners had trusted weak/faulty locks.

Are you saying that you actually think my argument is analogous to condoning stealing from cars or houses if their owners had trusted weak/faulty locks?

If so, I strongly disagree. Cars have a "locked" and "unlocked" state. They provide a button, which anyone can locate, for the owner to toggle the state. When you try to open the door, and it won't budge, it's immediately obvious that the door is locked. This is nothing at all like what happens when Safari disables 3rd party cookies by default.

But if you want a CAR analogy... It's like making a car that ships without windshield wipers pre-installed. You justify this by saying it makes it harder for passers-by to put ads on your car. And 90% of the people who drive the car can't figure out WHY they can't see the fracking road when it's raining!

So "a consistent experience that users expect" == user tracking for ads?? I don't think so. That's quite some spin on Google exploiting a bug to track me.

I opted-in to Safari's default policies when I chose to use Safari. I have also toggled that setting back and forth and now am quite satisfied with the default. Unless Google has information to the contrary, it should not circumvent the setting.

Should it start ignoring robots.txt files because some people may have inadvertently cut&pasted stricter ones than they might really want?

OK, so how do I opt out of their hacky workarounds?

This is worse because I turn off third party cookies in Firefox. On an iPhone, I would have no way to turn off third party cookies (the ones that are submitted using the hack).

1) Apple should make the default be the more permissive policy that all other major browsers have adopted. 2) They should lock down their implementation of the 'Sites I visit' policy to prevent the workaround 3) Users who opt-in for the stricter policy actually get it, but they should realize when their CHOICE breaks any features which rely on 3rd party cookies.

Ads are features?

Ask Apple to patch their browser to not treat iframes the way they do now? And hope that weird things don't break, as that's how probably many different things operate.

Some Google engineers on the Chromium team already patched webkit to fix this loophole back in August:

http://trac.webkit.org/changeset/92142

Reply on news.ycombinator.com