Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

To download from Google Drive, you must enable third party cookies?

support.google.com

Post reply on HN
Print view View original

11–20 of 166 posts

Re: To download from Google Drive, you must enable third party cookies?

#11

Post by robertlagrant »

thih9 wrote: post #7
dvfjsdhgfv wrote: post #2

Seems like in this particular case, notwithstanding Google's long history of abuse and opportunism, this one is a genuine case when you enable a cookie for technical and not (necessarily) user tracking reasons.

Is it certain that Google will not use these (i.e. cookies enabled for technical reasons) also for tracking? Some companies are requesting permissions for more or less valid reasons and later using these permissions for their own goals as well.

There's no need to use cookies for this when they control the backend. They know you're accessing a file because their server had to authenticate you.

Re: To download from Google Drive, you must enable third party cookies?

#12

Post by jabiko »

I'm wondering why the information necessary for downloading the file can't just be encoded as a URL parameter.

When the user clicks a file download link it should be possible to generate a short lived token that authenticates the user against googleusercontent.com.

Re: To download from Google Drive, you must enable third party cookies?

#13

Post by hannes0 »

rpadovani wrote: post #6
celdon25 wrote: post #5

Earlier quoted context omitted.

Can you elaborate on this? What's special about the domain here for security?

It's a defense in depth mechanism: when you allow user-generated content uploaded on your main domain, somebody will find a way to break your security system and make that content executable on the user's browser. When doing so, an attacker can steal cookies, and/or invoke APIs for the user. Now, there are of course ways to avoid that, but in the end, if every other system fails, being on a domain without any API and…

How does the configuration look like (very broadly)? Is already a domain redirect helpful here?

Re: To download from Google Drive, you must enable third party cookies?

#14

Post by ratww »

jabiko wrote: post #12

I'm wondering why the information necessary for downloading the file can't just be encoded as a URL parameter. When the user clicks a file download link it should be possible to generate a short lived token that authenticates the user against googleusercontent.com.

That's quite easy to do with Amazon S3. Maybe Google could just use AWS since implementing this feature seems to be a bit complex for them. /s

Re: To download from Google Drive, you must enable third party cookies?

#15

Post by newscracker »

If you’re anyway using Google Drive, you could use Firefox with the Google Container extension [1] to limit Google’s tracking activities across Google tabs to this container. Also install Cookie AutoDelete [2] and let the cookies, cache, local storage, etc., get cleared soon after you close the tabs.

[1]: https://addons.mozilla.org/en-US/firefox/addon/google-contai...

[2]: https://addons.mozilla.org/en-US/firefox/addon/cookie-autode...

Re: To download from Google Drive, you must enable third party cookies?

#16

Post by rpadovani »

hannes0 wrote: post #13
rpadovani wrote: post #6

Earlier quoted context omitted.

It's a defense in depth mechanism: when you allow user-generated content uploaded on your main domain, somebody will find a way to break your security system and make that content executable on the user's browser. When doing so, an attacker can steal cookies, and/or invoke APIs for the user. Now, there are of course ways to avoid that, but in the end, if every other system fails, being on a domain without any API and…

How does the configuration look like (very broadly)? Is already a domain redirect helpful here?

Yes, as long as the content is downloaded from another domain, everything is good.

The point is: if for any reason (0-day, misconfiguration, bug, whatever) the content uploaded from the user is executed by the browser, instead of being "just" rendered or downloaded, it must execute in a different domain. Given domains are sandboxed by the browser, a vulnerability on domain A cannot affect domain B.

Of course, there are still way to shoot you in the foot (e.g., having the same access token in the cookies for both domains), but it's one measure more. This is why security should be layered, and you shouldn't rely on just one defense: https://en.wikipedia.org/wiki/Defense_in_depth_(computing)

Re: To download from Google Drive, you must enable third party cookies?

#17

Post by giancarlostoro »

newscracker wrote: post #15

If you’re anyway using Google Drive, you could use Firefox with the Google Container extension [1] to limit Google’s tracking activities across Google tabs to this container. Also install Cookie AutoDelete [2] and let the cookies, cache, local storage, etc., get cleared soon after you close the tabs. [1]: https://addons.mozilla.org/en-US/firefox/addon/google-contai... [2]: https://addons.mozilla.org/en-US/firefox/add…

Honestly anyone concerned about a Chrome / WebKit browser monopoly needs to use Firefox now if you already are not.

Re: To download from Google Drive, you must enable third party cookies?

#19

Post by sneak »

giancarlostoro wrote: post #17
newscracker wrote: post #15

If you’re anyway using Google Drive, you could use Firefox with the Google Container extension [1] to limit Google’s tracking activities across Google tabs to this container. Also install Cookie AutoDelete [2] and let the cookies, cache, local storage, etc., get cleared soon after you close the tabs. [1]: https://addons.mozilla.org/en-US/firefox/addon/google-contai... [2]: https://addons.mozilla.org/en-US/firefox/add…

Honestly anyone concerned about a Chrome / WebKit browser monopoly needs to use Firefox now if you already are not.

I don't see any problems with a monoculture of rendering engine.

Browser (and features, especially privacy ones), absolutely. Renderer, not so much.

Post reply on HN