To download from Google Drive, you must enable third party cookies?

Post by rpadovani » Tue, Jul 19, 2022, 11:26 AM UTC

nickjj wrote: post #26

rpadovani wrote: post #6

Earlier quoted context omitted.

It's a defense in depth mechanism: when you allow user-generated content uploaded on your main domain, somebody will find a way to break your security system and make that content executable on the user's browser. When doing so, an attacker can steal cookies, and/or invoke APIs for the user. Now, there are of course ways to avoid that, but in the end, if every other system fails, being on a domain without any API and…

Is this also another case for hosting your main site on www.example.com instead of example.com? This way you could have cookies only on www.example.com while hosting user generated content on assets.example.com or whatever sub-domain you want that's not www?

Post by dwighttk » Tue, Jul 19, 2022, 11:29 AM UTC

frognumber wrote: post #36

sneak wrote: post #19

Earlier quoted context omitted.

I don't see any problems with a monoculture of rendering engine. Browser (and features, especially privacy ones), absolutely. Renderer, not so much.

In general, I like to have at least two implementations to make sure multiple implementations are possible. If the rendering engine bit-rots, goes the way of the original Netscape, Internet Explorer, etc., you don't want the internet to break.

Post by [deleted] » Tue, Jul 19, 2022, 11:31 AM UTC

jefftk wrote: post #33

This is wrong: try downloading something with Safari, which blocks third party cookies by default, and it works fine. Instead, the problem is that downloading from Google Drive is using User-Agent sniffing to determine whether third party cookies are expected to be enabled, and choosing between implementations. (Disclosure: I used to work at Google, but I don't know anything internal on this)

Post by sneak » Tue, Jul 19, 2022, 11:35 AM UTC

gorgoiler wrote: post #25

sneak wrote: post #19

Earlier quoted context omitted.

I don't see any problems with a monoculture of rendering engine. Browser (and features, especially privacy ones), absolutely. Renderer, not so much.

Have you ever used a service in life where there is no competition? Straight up lack of competition examples are the easiest: DMV, airport food court, buying beer at a sports stadium etc. If you work in tech then you’ve probably had to use software over whose purchase you had no control: Jira, PeopleHR, Taleo, Concur. There’s no competition there because you, the end user, don’t have the option to choose from a free…

Post by nottorp » Tue, Jul 19, 2022, 11:40 AM UTC

jefftk wrote: post #33

This is wrong: try downloading something with Safari, which blocks third party cookies by default, and it works fine. Instead, the problem is that downloading from Google Drive is using User-Agent sniffing to determine whether third party cookies are expected to be enabled, and choosing between implementations. (Disclosure: I used to work at Google, but I don't know anything internal on this)