Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

To download from Google Drive, you must enable third party cookies?

support.google.com

Post reply on HN
Print view View original

91–100 of 166 posts

Re: To download from Google Drive, you must enable third party cookies?

#91

Post by ascagnel_ »

horsawlarway wrote: post #84
workingon wrote: post #77

Earlier quoted context omitted.

It seems obvious to me why they don't use that for everyone, and it has nothing to do with security.

I don't really agree (and I'm happy to bash on Google). This is basically the poster child for a case when someone should be using 3rd party cookies: A single entity manages multiple domains and shares cookie auth across them. It's not like the other flow is somehow making you less identifiable - they're literally just passing the same information in a more round-about, less usable manner. I genuinely think the curre…

> This is basically the poster child for a case when someone should be using 3rd party cookies: A single entity manages multiple domains and shares cookie auth across them.

If everyone would use 3rd party cookies like you're describing, there'd be no issue with users enabling them. Instead, they're frequently used to track users across domains, and the alternate flow used for Safari should be the pragmatic option used for everyone.

You're right to complain about how we're basically unable to use an otherwise-useful feature because of bad actors. It's a signal that core web technologies need to be created with potential abuses first and foremost.

Re: To download from Google Drive, you must enable third party cookies?

#92

Post by Quarrelsome »

seydor wrote: post #90
jefftk wrote: post #33

This is wrong: try downloading something with Safari, which blocks third party cookies by default, and it works fine. Instead, the problem is that downloading from Google Drive is using User-Agent sniffing to determine whether third party cookies are expected to be enabled, and choosing between implementations. (Disclosure: I used to work at Google, but I don't know anything internal on this)

How is it wrong? And if safari does it without cookies, why not chrome? Chrome is used by 65% of people, safari ~15% (<10% on desktop)

I believe they're suggesting some code is executed based on the user agent. So Safari gets treated differently. Safari is defacto zero 3rd party cookies but Chrome isn't which is possibly why that site is treating them different.

Re: To download from Google Drive, you must enable third party cookies?

#93

Post by dheera »

jefftk wrote: post #33

This is wrong: try downloading something with Safari, which blocks third party cookies by default, and it works fine. Instead, the problem is that downloading from Google Drive is using User-Agent sniffing to determine whether third party cookies are expected to be enabled, and choosing between implementations. (Disclosure: I used to work at Google, but I don't know anything internal on this)

Yeah, so all you need to do is ask Chrome to report a Safari User-Agent.

Re: To download from Google Drive, you must enable third party cookies?

#95

Post by dataflow »

horsawlarway wrote: post #88
dataflow wrote: post #83

Earlier quoted context omitted.

> What is the reason that seems obvious to you? The reason he's thinking of is that they want to annoy people into enabling 3rd party cookies for tracking purposes, with security/performance/etc. as the excuse.

Except their instructions are specific to whitelisting the exact subdomains in question - they aren't telling you "Enable 3rd party cookies".

Yeah I'm not agreeing with it, just think that's what he was thinking of.

Re: To download from Google Drive, you must enable third party cookies?

#96

Post by ronjouch »

wbecher wrote: post #44
wanderingmind wrote: post #32

If using linux or mac, just FUSE mount with rclone. If you need more privacy,load the mount with encryption so google has no idea about the files you are working with.

I was going to write just this! rclone is a lifesaver!

Thank you and thanks wanderingmind for sharing this! I knew rclone, but didn't know you you could pair it with a fuse mount! Looks like an awwwwwesome addition to the toolbelt :))))

Re: To download from Google Drive, you must enable third party cookies?

#97

Post by Nextgrid »

horsawlarway wrote: post #88
dataflow wrote: post #83

Earlier quoted context omitted.

> What is the reason that seems obvious to you? The reason he's thinking of is that they want to annoy people into enabling 3rd party cookies for tracking purposes, with security/performance/etc. as the excuse.

Except their instructions are specific to whitelisting the exact subdomains in question - they aren't telling you "Enable 3rd party cookies".

Can you whitelist third-party cookies for a specific set of domains in any mainstream browser? To the best of my knowledge you can’t.

Re: To download from Google Drive, you must enable third party cookies?

#98

Post by krisgenre »

zmxz wrote: post #46
giancarlostoro wrote: post #17

Earlier quoted context omitted.

Honestly anyone concerned about a Chrome / WebKit browser monopoly needs to use Firefox now if you already are not.

I'd love to, but it's simply unusable compared to Chrome when it comes to web development.

AFAIK Firefox is the only browser that does 'persist logs' in dev console right. i.e I get to see the responses of all requests whereas Chrome only shows the current page responses. Chrome has also refused to acknowledge this as a bug.

Re: To download from Google Drive, you must enable third party cookies?

#99

Post by xxs »

jefftk wrote: post #71
Nextgrid wrote: post #64

Earlier quoted context omitted.

Oh wow - so while there was a non-malicious explanation in another comment ( https://news.ycombinator.com/item?id=32149130 ), this clearly looks like malicious behavior. They're relying on the fact that most browsers lack per-domain cookie controls to force Google Drive users to allow third-party cookies knowing full well the majority won't remember (or bother) to disable them after.

The explanation in the other comment is also correct. When you go from drive.google.com to googleusercontent.com to download a file, this historically worked by using third-party cookies to verify that you were authorized to download the file. When Safari dropped support for third-party cookies they added a new flow which uses link decoration instead, but only use this flow when they think the browser doesn't support…

>I'm not sure why they don't use the new flow for everyone.

It's less secure, slower (more round trips), and more server side intense - likely considered a hack. Effectively it does the same what a cookie would. The 3rd party cookies are not a bad thing per se, it's just that they have been abused to hell and back, is what causes their reputation.

Re: To download from Google Drive, you must enable third party cookies?

#100

Post by horsawlarway »

ascagnel_ wrote: post #91
horsawlarway wrote: post #84

Earlier quoted context omitted.

I don't really agree (and I'm happy to bash on Google). This is basically the poster child for a case when someone should be using 3rd party cookies: A single entity manages multiple domains and shares cookie auth across them. It's not like the other flow is somehow making you less identifiable - they're literally just passing the same information in a more round-about, less usable manner. I genuinely think the curre…

> This is basically the poster child for a case when someone should be using 3rd party cookies: A single entity manages multiple domains and shares cookie auth across them. If everyone would use 3rd party cookies like you're describing, there'd be no issue with users enabling them. Instead, they're frequently used to track users across domains, and the alternate flow used for Safari should be the pragmatic option use…

> It's a signal that core web technologies need to be created with potential abuses first and foremost.

No. This is how absolutely everyone ends up with the shittiest version of everything.

We need recourse and a general legal expectation that you DON'T abuse your users.

Honestly - that attitude is exactly the problem: You're letting bad actors literally ruin the web, because the US government is unable to pull its fucking mouth out of the feed trough (or honestly do much of anything at all, right now).

We don't take that stance for literally ANY other industry: You can buy a gun, but guns can kill people. You can buy a car, but cars can crash. You can get a dog, and that dog can bite people.

The answer is not "Ban it because it might be bad". The answer is to properly set expectations that abuse will be met with heavy penalties.

This is not fucking Minority Report, and we shouldn't be trying to "precognition" all the bad out of the world. We should address it head on, and fucking burn the bad actors to the ground.

Post reply on HN