Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

To download from Google Drive, you must enable third party cookies?

support.google.com

Post reply on HN
Print view View original

121–130 of 166 posts

Re: To download from Google Drive, you must enable third party cookies?

#121

Post by kretor »

Nextgrid wrote: post #64
jefftk wrote: post #33

This is wrong: try downloading something with Safari, which blocks third party cookies by default, and it works fine. Instead, the problem is that downloading from Google Drive is using User-Agent sniffing to determine whether third party cookies are expected to be enabled, and choosing between implementations. (Disclosure: I used to work at Google, but I don't know anything internal on this)

Oh wow - so while there was a non-malicious explanation in another comment ( https://news.ycombinator.com/item?id=32149130 ), this clearly looks like malicious behavior. They're relying on the fact that most browsers lack per-domain cookie controls to force Google Drive users to allow third-party cookies knowing full well the majority won't remember (or bother) to disable them after.

What browsers lack per-domain cookie controls?

Re: To download from Google Drive, you must enable third party cookies?

#122

Post by horsawlarway »

ethbr0 wrote: post #105
horsawlarway wrote: post #84

Earlier quoted context omitted.

I don't really agree (and I'm happy to bash on Google). This is basically the poster child for a case when someone should be using 3rd party cookies: A single entity manages multiple domains and shares cookie auth across them. It's not like the other flow is somehow making you less identifiable - they're literally just passing the same information in a more round-about, less usable manner. I genuinely think the curre…

> A single entity manages multiple domains and shares cookie auth across them. The issue is we (the users) really want a more nuanced concept of "third party": something like "different domain that's controlled by the first party." Unfortunately, any declaration that relies on the first party will immediately be abused to hell ("All these tracking domains are controlled by me, so plz allow them!"), and we'd be right…

I think you're falling into the same trap.

Some things are not solved in the appropriate manner through a technological solution.

They are misuses (and abuses) of a perfectly acceptable system. Don't undo the system, address the misuse.

Take your example:

>Unfortunately, any declaration that relies on the first party will immediately be abused to hell ("All these tracking domains are controlled by me, so plz allow them!"), and we'd be right back here.

The only reason this is the case is because this misuse has zero consequences.

Make them declare their domains, if they choose to include tracking domains, fine the ever-loving shit out of them. Not the ".05% of yearly profit" bullshit - I'm talking 200% of daily revenue for the top controlling company for every day that domain was on the list after it was declared a bad actor. If the company can't pay? Fucking nationalize them, remove the tracking domain, sell it to the highest bidder.*

Watch how fucking fast these companies will scramble to fix the problem when the stakes are real.

When the stakes are trivial - it doesn't matter what technology you try to put in place to block this, they will just work around it.

* I understand this is ridiculously extreme, but I'm done playing with these fucks. We've had the gloves on for the last 20 years, it's time they come off.

Re: To download from Google Drive, you must enable third party cookies?

#123

Post by bogwog »

sneak wrote: post #47
gorgoiler wrote: post #25

Earlier quoted context omitted.

Have you ever used a service in life where there is no competition? Straight up lack of competition examples are the easiest: DMV, airport food court, buying beer at a sports stadium etc. If you work in tech then you’ve probably had to use software over whose purchase you had no control: Jira, PeopleHR, Taleo, Concur. There’s no competition there because you, the end user, don’t have the option to choose from a free…

We are talking at cross purposes: your comment is a reasonable refutation of a browser monoculture, something we agree would be bad. FWIW I am typing my response to you in Graphene. Ultimately the issue is: what is the harm in using a library maintained by Google to do the webview rendering in a non-Google browser? I just don't see it.

If Google has a monopoly on the rendering engine, who decides what the future of web rendering looks like? Google, and nobody else.

Re: To download from Google Drive, you must enable third party cookies?

#124

Post by bogwog »

robertlagrant wrote: post #11
thih9 wrote: post #7

Earlier quoted context omitted.

Is it certain that Google will not use these (i.e. cookies enabled for technical reasons) also for tracking? Some companies are requesting permissions for more or less valid reasons and later using these permissions for their own goals as well.

There's no need to use cookies for this when they control the backend. They know you're accessing a file because their server had to authenticate you.

What about sharing a link with an unauthenticated user? Last I checked, Drive lets you create a public download link for your files.

Re: To download from Google Drive, you must enable third party cookies?

#125

Post by shadowgovt »

hedora wrote: post #118
shadowgovt wrote: post #61

Earlier quoted context omitted.

The innovation we've enjoyed since was mostly caused by Google getting tired of waiting for either Microsoft or Mozilla to improve on the browser paradigm and footing the bill to roll their own.

History doesn't really linenup with that: Web 2.0 was based on some IE extensions that were introduced when Firefox was the viable other game in town. Concretely, Google Maps (the poster child for AJAX) launched in 2005, and Chrome launched in 2008.

I was referring to the innovations in browser capabilities. Process sandboxing massively improved both the robustness of the browser experience and the boldness with which features could be used (because a crashing site wouldn't take the whole browser with it). It paved the way for the actual "browser is the OS for the web" experience we have today, unlike IE's attempt to wed a crash-prone application to its core OS functionality. As a result, the browser capability specs themselves exploded, which eventually rendered Flash, Silverlight, and ActiveX plugins mostly redundant and allowed browser vendors to make their way towards stripping them out in favor of web-engine-only solutions.

Re: To download from Google Drive, you must enable third party cookies?

#126

Post by kevingadd »

xenomachina wrote: post #115
coder543 wrote: post #106

Earlier quoted context omitted.

I don't fully understand why they need to use a separate domain for this at all. There is infinite URL space available on drive.google.com, even if Google just used a proxy behind the scenes to route those requests to whatever load balancer normally services googleusercontent.com, and that would solve the issue with third party cookies entirely... as well as several other issues, like potentially confusing users with…

Using a separate domain for user generated content is usually done for security reasons. For example, if a user-generated chunk of JavaScript was executed from drive.google.com, then it could potentially gain access to your drive.google.com, or maybe even *.google.com, authentication cookies. Scripts running on an unrelated domain have no such access. This usually isn't the only thing protecting against this, and is…

Native browsers tend to flag any files they download with information on what domain the file came from, so it's also relevant in that case. Windows and OS X will pop up a warning when opening untrusted files, so whether the user sees 'google.com' or not could be important.

Re: To download from Google Drive, you must enable third party cookies?

#129

Post by zagrebian »

ninju wrote: post #108

The title is tad incomplete. You need to enable 3rd party cookies ONLY FOR the drive endpoint, *drive.google.com*. You can whitelist which endpoints are permitted. They way the title is written it gave me the impression that you needed to enable 3rd party cookies globally (which is incorrect)

Are third-party cookies cross-origin or cross-site?

Re: To download from Google Drive, you must enable third party cookies?

#130

Post by robertlagrant »

bogwog wrote: post #124
robertlagrant wrote: post #11

Earlier quoted context omitted.

There's no need to use cookies for this when they control the backend. They know you're accessing a file because their server had to authenticate you.

What about sharing a link with an unauthenticated user? Last I checked, Drive lets you create a public download link for your files.

Hmm, yes, that's true. I wonder if that works with cookies disabled.
Post reply on HN