Improving privacy and security on the web
blog.chromium.org
Improving privacy and security on the web
1–10 of 64 posts
Re: Improving privacy and security on the web
#2Interesting. So apparently Chrome is going to stop sending cookies in cross-site requests unless they're created with `CrossOrigin=None` and the page is loaded over HTTPS?
Re: Improving privacy and security on the web
#3Interesting. So apparently Chrome is going to stop sending cookies in cross-site requests unless they're created with `CrossOrigin=None` and the page is loaded over HTTPS?
We're proposing treating cookies as `SameSite=Lax` by default (https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-03...). Developers would be able to opt-into the status quo by explicitly asserting `SameSite=None`, but to do so, they'll also need to ensure that their cookies won't be delivered over non-secure transport by asserting the `Secure` attribute as well.
https://tools.ietf.org/html/draft-west-cookie-incrementalism spells out the proposal in a bit more detail.
Re: Improving privacy and security on the web
#4Interesting. So apparently Chrome is going to stop sending cookies in cross-site requests unless they're created with `CrossOrigin=None` and the page is loaded over HTTPS?
We're proposing treating cookies as `SameSite=Lax` by default ( https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-03... ). Developers would be able to opt-into the status quo by explicitly asserting `SameSite=None`, but to do so, they'll also need to ensure that their cookies won't be delivered over non-secure transport by asserting the `Secure` attribute as well. https://tools.ietf.org/html/draft-west-cookie…
This is exactly the information I was looking for when I opened chromium blog post. Technical and to the point. Is there a reason why this couldn't be appended to the blog post?
Re: Improving privacy and security on the web
#5Is this another way for Google to prevent you from clearing their cookies via the 'Clear Cookies' option?
Its a step in the right direction with enforcing SameSite cookie scoping, but we must be cautious that Google doesn't use this to force you to always be logged in. Google has a long way to go to rebuild trust after that last browser login debacle. I don't trust em.
Re: Improving privacy and security on the web
#6Is this another way for Google to prevent you from clearing their cookies via the 'Clear Cookies' option? Its a step in the right direction with enforcing SameSite cookie scoping, but we must be cautious that Google doesn't use this to force you to always be logged in. Google has a long way to go to rebuild trust after that last browser login debacle. I don't trust em.
google will absolutely not do anything in the name of trust and privacy as we define them because their business model is 100% about selling ads to more people.
Re: Improving privacy and security on the web
#7Interesting. So apparently Chrome is going to stop sending cookies in cross-site requests unless they're created with `CrossOrigin=None` and the page is loaded over HTTPS?
We're proposing treating cookies as `SameSite=Lax` by default ( https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-03... ). Developers would be able to opt-into the status quo by explicitly asserting `SameSite=None`, but to do so, they'll also need to ensure that their cookies won't be delivered over non-secure transport by asserting the `Secure` attribute as well. https://tools.ietf.org/html/draft-west-cookie…
Have you done some crawling or other means of checking as to how many web pages with a login your change would break?
Re: Improving privacy and security on the web
#8Earlier quoted context omitted.
We're proposing treating cookies as `SameSite=Lax` by default ( https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-03... ). Developers would be able to opt-into the status quo by explicitly asserting `SameSite=None`, but to do so, they'll also need to ensure that their cookies won't be delivered over non-secure transport by asserting the `Secure` attribute as well. https://tools.ietf.org/html/draft-west-cookie…
Have you done some crawling or other means of checking as to how many web pages with a login your change would break?
Unfortunately, crawling isn't a terribly effective way of evaluating breakage, as the crawler doesn't sign-in, and therefore doesn't attempt to federate sign-in across multiple sites. That's part of the reason that we're not shipping this change today, but proposing it as a (near-)future step.
To that end, we've implemented the change behind two flags (chrome://flags/#same-site-by-default-cookies and chrome://flags/#cookies-without-same-site-must-be-secure) so that we can work with developers to help them migrate cookies that need to be accessible cross-site to `SameSite=None; Secure`.
Ideally, we won't unintentionally break anything when we're confident enough to ship this change.
Re: Improving privacy and security on the web
#9Really disappointed in you Google for not addressing fingerprinting much sooner.
Re: Improving privacy and security on the web
#10Really disappointed in you Google for not addressing fingerprinting much sooner.
Be disappointed all you want, but they're not really "addressing" fingerprinting. It is exceptionally difficult --- computer-science Hard difficult --- to prevent fingerprinting; all you can really do is break popular libraries people use today. It's an arms race, and a much harder arms race than exploit-hardened runtimes are.