Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

W3C slaps down Google's proposal to treat multiple domains as same origin

theregister.com

Post reply on HN
Print view View original

61–70 of 128 posts

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#61

Post by JeremyNT »

Woung1938 wrote: post #3
t0mas88 wrote: post #2

What a weird coincidence that this would really help let's say a company that used google.com as well as google.co.uk and doubleclick.com as their "first party" set. Good that W3C stopped it.

W3C doesn't really have any real power over what happens in the internet today. It's browser vendors associated with WHATWG that draw the straws now.

Indeed, and an advertising company also happens to be the dominant browser vendor.

We're quickly approaching the third "E" in "embrace, extend, extinguish."

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#62

Post by dmitriid »

random5634 wrote: post #54
dmitriid wrote: post #8

Earlier quoted context omitted.

> If users can’t access gmail / YouTube etc, they will be ignoring the w3c. Are users unable to access gmail / YouTube etc now?

Users will use / do what is required to access YT. Google could proxy through a google.com domain so same site cookies could be set, they could implement this in chrome and users would follow along

Once again: are users unable to access those sites now?

Why would they not be able to access them if Google doesn't implement FPS?

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#63

Post by bilekas »

jaywalk wrote: post #38
bilekas wrote: post #37

I'm not sure why this would be such a big deal for Google.. I know they might be communicating between .co.uk .com etc.. But apart from that, why would Google benefit so much from this ?

It's not just google.com and google.co.uk, but also youtube.com, gmail.com, doubleclick.com, etc. Starting to see the bigger picture?

Ah okay, I see.. If anything I see the potential for more domain certifiation fraud, expired domains still being attatched somhow o an entity.. but makes sense now why they would push for it.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#64

Post by dmitriid »

mwexler wrote: post #58
Daho0n wrote: post #11

Earlier quoted context omitted.

Users can't ignore W3C. Browser makers can. This "feature" would open up for tracking using today's modern analysis systems with year 2000 privacy protections.

I'm not sure I understand. In the year 2000, we let any domain get access to it's cookie. In this proposal, an entity can let domains it controls have access to a shared cookie, all others are still blocked. But fair point: if I am allowed to say that I have a "relationship" with eviltracker.com, then they could get the shared cookie... But it's easy to add requirements like ownership vs partnership, or purpose-based…

> But it's easy to add requirements like ownership vs partnership

Ah, yes. "Easy".

How exactly do you envision that?

- Is ownership/partnership info easily and immediately accessible?

- Who is going to verify ownership/partnership info?

- How is that applicable to First Party Sets?

- LVMH owns at least 75 different brands. Even though it owns them, for all intents and purposes these are different legal entities and (especially under GDPR, CCPA and any other privacy law in existence) they cannot be treated as a single entity.

- amazon.com and amazon.de are two separate legal entities with wildly different privacy requirements. Same goes to subdivisions in each of the 75 brands I mentioned for LVMH.

and so on.

Yes. Easy.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#65

Post by random5634 »

dmitriid wrote: post #62
random5634 wrote: post #54

Earlier quoted context omitted.

Users will use / do what is required to access YT. Google could proxy through a google.com domain so same site cookies could be set, they could implement this in chrome and users would follow along

Once again: are users unable to access those sites now ? Why would they not be able to access them if Google doesn't implement FPS?

Free products are generally supported by advertising. We are being told the W3C has “slapped down” googles attempts around FPS.

I am making the point that if google comes up with a workaround to this “slap down” - users will follow - even if you and others are yelling “it’s not W3C”. That could be modifying chrome to allow this, it could be hosting things under one domain etc

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#66

Post by dmitriid »

Jaxkr wrote: post #33
bryanrasmussen wrote: post #22

Earlier quoted context omitted.

for the purposes of anti-trust law somewhere around 3% market share isn't really considered an option.

Firefox when combined with Safari are a formidable opponent to Google’s monopoly. The First Party Sets standard couldn’t be forced through because Firefox and Safari wouldn’t accept it.

Google doesn't care if Safari and Firefox don't accept something. See https://webapicontroversy.com

They will release it and then will engage their network of developer advocates and business representatives to try and make developers pressure Apple and Mozilla.

Just some examples of one such rhetoric: https://twitter.com/slightlylate/status/1191027005342404608 and https://twitter.com/slightlylate/status/1369773901610250240 and don't forget, what's missing is your advocacy: https://twitter.com/slightlylate/status/1360364259088027655

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#67

Post by throwaway1492 »

mtrovo wrote: post #24

(googler here, but this is my opinion) I think there's a big abstraction gap between what we use domains for and what they were supposed to be used for, in a way that we shouldn't assume any ownership only based on the domain itself. For instance you can have a number of sites that use separate domains but are owned by the same entity (N domains for 1 party). You could also have the same base domain being used for se…

> (googler here, but this is my opinion)

Sergei here, gtf back to work and stop posting company policy on social media!

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#68

Post by TomGullen »

gsich wrote: post #28
bigth wrote: post #26

Earlier quoted context omitted.

Years ago, webpages loaded faster by using domain sharding. A big website I had used one domain as its primary, but images were on another domain, and there was yet another domain for resources like css and js.

How is this faster? More DNS requests, more TCP connections. At first this is purely slower.

Before HTTP2 this was common

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#69

Post by dmitriid »

random5634 wrote: post #65
dmitriid wrote: post #62

Earlier quoted context omitted.

Once again: are users unable to access those sites now ? Why would they not be able to access them if Google doesn't implement FPS?

Free products are generally supported by advertising. We are being told the W3C has “slapped down” googles attempts around FPS. I am making the point that if google comes up with a workaround to this “slap down” - users will follow - even if you and others are yelling “it’s not W3C”. That could be modifying chrome to allow this, it could be hosting things under one domain etc

> Free products are generally supported by advertising. We are being told the W3C has “slapped down” googles attempts around FPS.

You were talking about "If users can’t access gmail / YouTube etc, they will be ignoring the w3c". Now it's suddenly "free sites" and "advertising".

And don't worry, advertising isn't going anywhere.

> I am making the point that if google comes up with a workaround to this “slap down” - users will follow

They will not come up with a "workaround", they will just implement it ignoring any objections.

However, that's not the point. What was it about users not being able to access youtube etc.?

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#70

Post by hansel_der »

mwexler wrote: post #49

Assuming a domain name as a hard boundary for information is a disaster, imho. All of our fights over "1st party" and "3rd party" based on arbitrary names for a service is just specious, and the continued emphasis of "origin" as a "load-bearing" pillar is only due to legacy, not due to utility. The First Party Set proposal reflects a real need of enterprises and services, though the edge cases of the current solution…

> address bars are really just search bars, who actually types a full domain anymore?

recently found myself pasting an (local) ip(v4) address in the address-bar and being taken to a search engine - strange times

Post reply on HN