Hacker News Reader

Comment by zmmmmm | Hacker News Reader

first party cookies yes

But third party cookies are a lot more insidious, because they get sent without any visibility to the user and have generally peripheral relevance to the application they are using. It's like if you go to the supermarket and they ask you if you want to sign up for a loyalty card and you say yes, vs you go to the supermarket and they secretly plant trackers on you so that when you go to other shops they can tell who you are. One is a lot worse than the other.

View on HN

Is there a legitimate use case for 3P cookies?

Cross domain same identity authentication, but this has been worked around in most cases.

Only in places where you trust the domains.

Yes. My employer uses them to facilitate a widget that site owners can just drop into place. Some of these folks are using platforms they cannot easily change or customize, and/or they cannot manage sophisticated changes.

Ah, and I'm guessing this could instead be done with an iframe but it would be ugly.

It would still require 3P cookies.

seamless comment form iframe embeds. Useful for something like blogger, where *.blogspot.com allows user code and thus cannot host the comment form for logged in users

There is an absurd amount of additional complexity that needs to be centralized in order to avoid third-party cookies.

Any website can add Google Analytics by copy and pasting 1 line of code. To avoid this cookie, you need to have your own analytics web app. This makes sense for medium-size websites, but if you have a small website your host will probably bill it as a separate website.

First-party comments? Now you need your own comment system, which means you have a long list of responsibilities that you simply wouldn't have if you just used Disqus or Facebook comments. All those spam links to virulent sites will be on your servers now.

Honestly, the Internet would be a much more awesome place if 3P cookies were the norm and everyone was okay with embedding everything everywhere. In the past hotlinking was a problem due to bandwidth concerns, but nowadays most of the traffic is bots anyway so it would be a drop in the bucket.

Disqus hasn't needed third party cookies for a long time.

This was the example I thought of too. Somehow they got around it, I thought using iframes or whatever is the newer replacement for them.

Then again I'm surprised by something broken in iframes every single time I use them, and last time was years ago, so...

> First-party comments? Now you need your own comment system

This is incorrect. Without 3P cookies widgets like Disqus cannot track (and automatically sign-in) user across different websites, but everything else including posting comments or liking them should work, you just need to sign-in on every website instead of doing it once.

> Any website can add Google Analytics by copy and pasting 1 line of code.

Again incorrect. Google Analytics doesn't need 3P cookies to count the number of visitors. Without 3P cookies it is just harder to correlate visits across different websites, which is what website owners don't really need, why are you supposed to know what competitor sites your users visit? None of your business.

And for cross-site authoriation there are standards like OpenID. So we could disable 3P cookies right now and Internet will work just fine.

>Without 3P cookies widgets like Disqus cannot track (and automatically sign-in) user across different websites, but everything else including posting comments or liking them should work, you just need to sign-in on every website instead of doing it once.

I feel like I don't understand what a 3P cookie is, then. Isn't Disqus a third-party service? Doesn't it use a cookie to know you have signed in?

If you put a Disqus comment form or Google Analytics in your website, wouldn't you need a cookie popup to comply with GDPR and similar regulations that regulate sending user data to third-parties?

Is 3P cookie supposed to be about the domain of the cookie? But then can a script from one domain like GA set a cookie in a different domain like of a website that uses GA? That doesn't sound right, considering you can't do this server side.

Can you help me understand how would it work for it not to be a 3P cookie?

> Isn't Disqus a third-party service? Doesn't it use a cookie to know you have signed in?

Let's say Disqus JS code is embedded on a site A. Then it can set cookies for that domain. So when you enter your Disqus login and password on site A, it can send a request to Disqus server, obtain authorization token and save it in cookies for domain A. This way you will be recognized every time you visit site A.

This means that operators of site A may access those cookies too, but I don't see any problem here - it's their site anyway.

> If you put a Disqus comment form or Google Analytics in your website, wouldn't you need a cookie popup to comply with GDPR and similar regulations that regulate sending user data to third-parties?

Probably you need.

> Is 3P cookie supposed to be about the domain of the cookie?

3P cookie means that when site A includes content from site B (image, iframes) then the browser will send domain B's cookies with the request for that content. This means that if content from site B is included on 100 different websites, site B can track the user across them using cookies.

So when you sign into Disqus, it can recognize (and track your actions) you on any site using Disqus widget.

When 3P cookies are disabled, requests for content embedded from other sites like B, will be anonymous and without cookies. You will have to log into Disqus for every site where you want to leave a comment.

I see. That's a bit ironic. Cookies use useful because you don't need to use URL query parameters all the time. So what they are doing is taking the session token that would be sent in the Disqus domain cookie and storing it as an embedder's cookie, then using Javascript to put the cookie data in URL's / requests. In fact, "cookie" is probably not even a good method to do this since it will get send in embedder's requests. You could just use localstorage for it.

I've always found the negative effects of 3P cookies, the creepiness of being logged in on every site and ads following you around, to be symptoms of other problems (using the same browser profile for everything you do, a culture of not paying for websites so they have to rely on ads for monetization), so I'm not sure if this is a great solution to the actual problems.

But I guess it does make the internet better for the average person.

It's not surprising that there are legit uses like this for 3P cookies, and that the cons probably outweigh the pros. Browsers already stopped allowing cross-site caching for similar reasons years ago, which I'd say comes at a bigger cost.

Lots of the usecases for CORS are also use cases for third party cookies (anytime you set withCredentials = true)

Re the supermarkets - I understand this happens in a limited way already with bluetooth scanning :/

Not anymore since most devices now randomize any Bluetooth identifiers like they do MAC address. Might be a few scenarios it’s possible but it’s been locked down since it made major headlines years ago.

Your phone yes, but I believe there's still issues with peripheral BT devices

And cameras…

Reply on news.ycombinator.com