Hacker News Reader

Not so much. AFAICT anything including an IFRAME to Google (e.g. a map) will set their tracking cookie, and anything fetched from any of their servers will probably try to identify you via browser fingerprinting. To do anything that really matters, you need to block the HTTP requests.

View on HN

I just tested this and it's simply not true. Cookie headers to an iframe from a third-party domain are suppressed when third-party cookie blocking is on, and sent when cookie blocking is off.

Google whitelists their own third-party cookies by default in Chrome and it's possible other browsers come with a preset whitelist as well, maybe that's what you encountered.

You're probably right -- I can't create a reproducible test case now. Still, given the browser fingerprinting, you're best off blocking the HTTP connection.

Citation for the whitelist claim?

There was an exception for Google in my cookie whitelist that I didn't put there, but after checking some other chrome installs it isn't on all of them.

Reply on news.ycombinator.com