Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

W3C slaps down Google's proposal to treat multiple domains as same origin

theregister.com

Post reply on HN
Print view View original

111–120 of 128 posts

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#111

Post by om2 »

mtrovo wrote: post #24

(googler here, but this is my opinion) I think there's a big abstraction gap between what we use domains for and what they were supposed to be used for, in a way that we shouldn't assume any ownership only based on the domain itself. For instance you can have a number of sites that use separate domains but are owned by the same entity (N domains for 1 party). You could also have the same base domain being used for se…

Even when multiple domains are controlled by the same party, there is often no good way for users to be aware that seemingly unrelated sites with unrelated-looking brands are the same, and therefore (under this proposal) you can be tracked across them.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#112

Post by zdragnar »

dylan604 wrote: post #98
zdragnar wrote: post #90

Earlier quoted context omitted.

IE6 also brought us AJAX, so there is something to be said for browser vendors implementing experimental features on their own. The difference between nice and awful, of course, is when developers and vendors treat such features as a given without providing graceful degradation (or progressive enhancement, if you prefer) for users of other browsers.

Sure, AJAX is cool. However, devs would not be allowed to release into the wild if the experimental features were not availalable in released browsers. That whole -strict, -transitional type stuff is just another example. Extreme specific personal reco would be to only allow experimental features available to devs that must compile their own browser from source. this would prevent the vast majority of users from ever…

That isn't remotely the case. Plenty of experimental / one-vendor features have been released and later received wider adoption without fundamentally breaking the user's experience.

I.e. before we had indexeddb, there was websql. The whole PWA slew of features (I.e. service workers) can and are used without breaking user experience.

There can be bad implementations too- youtube's awful performance due to their early version of the web component spec comes to mind- but these features arent really akin to the olden days of ActivX / IE dominance, since they are single purpose and not opening up an entire foreign interface.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#113

Post by om2 »

ryathal wrote: post #86
hnbad wrote: post #23

Earlier quoted context omitted.

The difference is Chrome moves ahead anyway. This is why I'm calling it "standards-washing" -- if you take away the RFC it's no different from the browser wars era or Apple's proprietary CSS extensions for Safari back in the day. How the standards process is supposed to work is something like this: 1. Someone creates a rough proposal. Discussion happens. 2. Someone creates a proof of concept toy implementation. Discu…

This generally happens when committees are too far away from the actual development. It happens all the time at companies too with non-coding architects too. Standard setting bodies need to understand the pace of modern development, they spend way to long in the discussion phase. Once their is running code a lot of the discussion is basically over, and it's a choice of writing the spec to match what happens or browse…

Right now Google does not feel the need to get any other browser vendors or really any other party besides Google to agree. They ship things that they don't even agree on internally! Their process has review points but actually acting on that feedback is totally up to the preferences of the person driving a given feature.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#114

Post by om2 »

mtrovo wrote: post #107
1shooner wrote: post #72

Earlier quoted context omitted.

>in a way that we shouldn't assume any ownership only based on the domain itself. I probably have a naive understanding of this, but why not? In your Shopify example, users should certainly be taught that Shopify does have ownership of mystore.shopify.com (in at least the 'security' and 'privacy' areas of concern from the write-up). Likewise, entities proxying resources controlled by others through their own domains…

mystore.shopify.com is definitely hosted by Shopify but it's content is a totally isolated entity. You can trust laptops.shopify.com but this trust should not automatically transfer to fakestore.shopify.com. In the same way if you have a valid account on laptops.shopify.com, the browser shouldn't allow fakestore.shopify.com to emit a request and buy something on laptops.shopify.com with your valid session on your beh…

If the proposal was limited to opting into strict origin scope (instead of eTLD+1/registerable domain scope) for cookies and other privacy-related things, it would be an improvement.

But it also allows things like specifying that laptops.shopify.com, laptops.com, laptops.social.com, desktops.com and calculators.com are the same party and therefore tracking may happen across them. There's no obvious good way to put the user on notice of this, and the Explainer totally punts on addressing this problem, instead leaving it to each browser to figure out.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#115

Post by om2 »

Despite the extended verbal slap down, it's likely Google will ignore most of this feedback and ship anyway. That way, youtube.com, google.com, and double-click.net will be able to freely share third party cookies amongst themselves in Chrome even after Chrome supposedly removes third-party cookies.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#116

Post by titzer »

foepys wrote: post #105
titzer wrote: post #80

Earlier quoted context omitted.

Former V8er. We moved the vast majority of V8 documentation to public sites. What is non-public is mostly design docs, proposals, strategy, experiments, etc, i.e. the inner workings of the team mechanics. The technical details of V8 are not secret in any way. They may be radically complex, but not secret.

Keeping proposals and design documents private is essentially the same as making a project "source available". It prevents people from participating in the extension of functionality and limits them to being bug fixers. What Microsoft is doing with .NET is true open source where all proposals are being discussed in public with volunteers improving proposals and suggesting new ones.

> Keeping proposals and design documents private is essentially the same as making a project "source available".

Nah. There are plenty of contributors to V8 that are not part of Google. IBM and MIPS and ARM all contributed significantly to specific machine ports, and we had no trouble keeping them abreast of changes and plans. There are several people who have contributed from Igalia as well. And that's just the people I can think of.

It is harder to contribute to V8 than other open source projects. You have to accept a contributor agreement and use the Chromium code review tools. V8 is a big codebase and slow to build, but it's nothing like what you say.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#117

Post by Jaxkr »

dmitriid wrote: post #66
Jaxkr wrote: post #33

Earlier quoted context omitted.

Firefox when combined with Safari are a formidable opponent to Google’s monopoly. The First Party Sets standard couldn’t be forced through because Firefox and Safari wouldn’t accept it.

Google doesn't care if Safari and Firefox don't accept something. See https://webapicontroversy.com They will release it and then will engage their network of developer advocates and business representatives to try and make developers pressure Apple and Mozilla. Just some examples of one such rhetoric: https://twitter.com/slightlylate/status/1191027005342404608 and https://twitter.com/slightlylate/status/136977390161…

These are add-on features, not core cookie functionality.

I’m glad Google pushed a Web USB and Web Bluetooth. I use Web USB / Serial for a browser based microcontroller debugger. I use Web Bluetooth through the Bluefy app to control some Bluetooth devices without App Store apps.

Firefox’s excuse that “security risks of exposing USB devices to the Web are too broad to risk exposing users to them or to explain properly to end users to obtain meaningful informed consent” is infantilizing its users.

I’m a Firefox user, but I have Chrome installed for Web USB. I’d rather a feature exist controversially than not at all.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#118

Post by dmitriid »

Jaxkr wrote: post #117
dmitriid wrote: post #66

Earlier quoted context omitted.

Google doesn't care if Safari and Firefox don't accept something. See https://webapicontroversy.com They will release it and then will engage their network of developer advocates and business representatives to try and make developers pressure Apple and Mozilla. Just some examples of one such rhetoric: https://twitter.com/slightlylate/status/1191027005342404608 and https://twitter.com/slightlylate/status/136977390161…

These are add-on features, not core cookie functionality. I’m glad Google pushed a Web USB and Web Bluetooth. I use Web USB / Serial for a browser based microcontroller debugger. I use Web Bluetooth through the Bluefy app to control some Bluetooth devices without App Store apps. Firefox’s excuse that “security risks of exposing USB devices to the Web are too broad to risk exposing users to them or to explain properly…

> "excuse", "infantilizing users"

Where have you been for the past decade? Users provably don't understand security implications of their choices

The entire ad industry in its current form, the entire tracking industry exist solely because of that. Users routinely allow malicious apps full-system access just because those apps ask nicely.

I'd rather not have features than have them rammed through by a company whose only claim on profitability is running ad networks in a web they increasingly control.

And yes, the "core cookie technology" that Google proposes only makes tracking easier.

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#119

Post by 0xy »

junon wrote: post #104
0xy wrote: post #25

Earlier quoted context omitted.

Hence why Firefox fully implemented the privacy disaster known as the AudioContext API, which leaks sensitive information about your audio peripherals without your consent or notification, even on sites with no audio whatsoever. It's abused almost exclusively by ad networks, including Google's DoubleClick on major sites like StackOverflow. These new APIs are used almost entirely for fingerprinting, and this was imple…

This is the first I've heard of this - why is it being downvoted? I'd like to know more. Do you have any more info about this?

Sure do. StackOverflow's Google ad partner explicitly allows the abuse of AudioContext and other audio APIs for tracking purposes, ruining user security. [1]

These APIs leak sensitive information about your peripherals without your consent or notification [2], and is used rampantly on Google's ad network.

Try it yourself and see. Simply open up the browser console and type: (new AudioContext())

Google Chrome developers have claimed that they consider privacy and security while implementing APIs, while they actively tear down privacy and destroy security (which benefits Google's ad unit). The separation between Google Chrome's security team and DoubleClick, is, in my opinion, non-existent. As another example, DoubleClick has a hard-coded backdoor in Chrome that sends a unique browser install ID as telemetry via headers to DoubleClick domains in all requests. [3]

[1] https://meta.stackexchange.com/questions/332229/stack-overfl...

[2] https://developer.mozilla.org/en-US/docs/Web/API/AudioContex...

[3] https://chromium.googlesource.com/chromium/src/+/e51dcb0c148...

Re: W3C slaps down Google's proposal to treat multiple domains as same origin

#120

Post by dmitriid »

stjohnswarts wrote: post #95
hnbad wrote: post #23

Earlier quoted context omitted.

The difference is Chrome moves ahead anyway. This is why I'm calling it "standards-washing" -- if you take away the RFC it's no different from the browser wars era or Apple's proprietary CSS extensions for Safari back in the day. How the standards process is supposed to work is something like this: 1. Someone creates a rough proposal. Discussion happens. 2. Someone creates a proof of concept toy implementation. Discu…

Do you have know of a writeup or blog post from someone involved in such actions that cites actual situations where this happened when google railroaded a new standard through?

Unfortunately, no. The closest to a writeup is this: https://webapicontroversy.com/
Post reply on HN