Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

To download from Google Drive, you must enable third party cookies?

support.google.com

Post reply on HN
Print view View original

131–140 of 166 posts

Re: To download from Google Drive, you must enable third party cookies?

#131

Post by jrochkind1 »

horsawlarway wrote: post #122
ethbr0 wrote: post #105

Earlier quoted context omitted.

> A single entity manages multiple domains and shares cookie auth across them. The issue is we (the users) really want a more nuanced concept of "third party": something like "different domain that's controlled by the first party." Unfortunately, any declaration that relies on the first party will immediately be abused to hell ("All these tracking domains are controlled by me, so plz allow them!"), and we'd be right…

I think you're falling into the same trap. Some things are not solved in the appropriate manner through a technological solution. They are misuses (and abuses) of a perfectly acceptable system. Don't undo the system, address the misuse. Take your example: >Unfortunately, any declaration that relies on the first party will immediately be abused to hell ("All these tracking domains are controlled by me, so plz allow th…

What is the definition of what is "really" "my" domain?

If I put a custom domain on an S3/cloudfront that's part of my system, so it appears as `storage.mysystem.com`, is there something nefarious going on?

Who decides what is allowable declaration of a domain to be mine? And who enforces this with fines? Is there currently any way to fine someone on the internet for violating a rule? What would you imagine this looking like, an organization that has the ability to fine people globally, and enforce the payment of those fines (by... taking domains back I guess?), and who would control it? (and who would pay for it, how?) It's a lot of global legal infrastructure we don't really have now, I think. It would be a pretty huge step.

Re: To download from Google Drive, you must enable third party cookies?

#132

Post by _flux »

coder543 wrote: post #120
jefftk wrote: post #119

Earlier quoted context omitted.

> There are also mitigations that could be put in place for file sharing, like requiring the user to have accepted a file sharing request from that account before (via Google sent notification email) for a direct link to actually work. That sounds pretty annoying? I upload something, give access to coder543, and ping you a link in Slack or whatever tool we use. But you can't open it until you go into your email and c…

Maybe my phrasing was awkward, but I said you would only have to do this once for a given account. So, if I've never accepted a share from you before, your links won't work. When you share something with me for the first time, I would have to accept it via a Google-sent email containing a link that only Google knows (not something that can be sent via slack), and then all your future share links would work for me on…

Do people want to have friend requests in Google? If I wanted to share a file to your Google account, would you like to trust the future shares automatically as well? It doesn't seem like the superior alternative to just using 3rd party cookies—other than that it works if 3rd party cookies are disabled.

It also provides a new attack vector (your friends) if such people are able to create more credible documents (e.g. due to an attack, not due to a deliberate intent to mislead you).

Re: To download from Google Drive, you must enable third party cookies?

#133

Post by coder543 »

_flux wrote: post #132
coder543 wrote: post #120

Earlier quoted context omitted.

Maybe my phrasing was awkward, but I said you would only have to do this once for a given account. So, if I've never accepted a share from you before, your links won't work. When you share something with me for the first time, I would have to accept it via a Google-sent email containing a link that only Google knows (not something that can be sent via slack), and then all your future share links would work for me on…

Do people want to have friend requests in Google? If I wanted to share a file to your Google account, would you like to trust the future shares automatically as well? It doesn't seem like the superior alternative to just using 3rd party cookies—other than that it works if 3rd party cookies are disabled. It also provides a new attack vector (your friends) if such people are able to create more credible documents (e.g.…

The alternative is trusting all shared links, which is currently what Google does. Third party cookies have nothing to do with it. Having some form of revokable authorization to be able to click on links from a person is superior to "all sketchy links working instantly."

If you get a Google Drive link by someone claiming to be a friend you know, you could download malware right now, because Google trusts all of these links equally. With this mitigation in place, you would be stopped: “hey, this isn’t someone you’ve ever received files from before.” Because they aren’t actually your friend using your friend’s account which you’ve received files from before. It would add a serious obstacle to a lot of these impersonation attacks, and I see impersonation attacks all the time.

My comment awhile ago said that this mitigation would be nice regardless of whether Google kept using their separate domain or not.

It absolutely doesn’t provide a new attack vector. It strictly serves to reduce the attack surface, not to increase it.

Re: To download from Google Drive, you must enable third party cookies?

#134

Post by rndgermandude »

jefftk wrote: post #81
workingon wrote: post #77

Earlier quoted context omitted.

It seems obvious to me why they don't use that for everyone, and it has nothing to do with security.

From my understanding of how these decisions were made inside Google, it's very likely to be one of: * Security: as described above * Efficiency: the method used for Safari requires more server resources * Performance: the method used for Safari is slower What is the reason that seems obvious to you?

I saw the efficiency/performance claim a bunch of times now. How is using a cookie over say the same data embedded in the requested URL or transmitted as form-data supposedly more efficient? The server still has to check the auth, no matter what part of the request it extracted the auth data from. Or am I missing something here?

As for security, yeah, there are some good reasons for not embedding auth info in the link (tho one could still POST the same data instead without a third party cookie, etc), as well as for having a dedicated domain for user content.

Re: To download from Google Drive, you must enable third party cookies?

#135

Post by jefftk »

ethbr0 wrote: post #105
horsawlarway wrote: post #84

Earlier quoted context omitted.

I don't really agree (and I'm happy to bash on Google). This is basically the poster child for a case when someone should be using 3rd party cookies: A single entity manages multiple domains and shares cookie auth across them. It's not like the other flow is somehow making you less identifiable - they're literally just passing the same information in a more round-about, less usable manner. I genuinely think the curre…

> A single entity manages multiple domains and shares cookie auth across them. The issue is we (the users) really want a more nuanced concept of "third party": something like "different domain that's controlled by the first party." Unfortunately, any declaration that relies on the first party will immediately be abused to hell ("All these tracking domains are controlled by me, so plz allow them!"), and we'd be right…

> The issue is we (the users) really want a more nuanced concept of "third party": something like "different domain that's controlled by the first party."

Chrome was playing with an idea like that: https://developer.chrome.com/docs/privacy-sandbox/first-part...

Re: To download from Google Drive, you must enable third party cookies?

#136

Post by Forgeties79 »

jeromegv wrote: post #68
Forgeties79 wrote: post #57

Earlier quoted context omitted.

What are your thoughts on brave browser? I’ve used it over firefox for about two years now and I really enjoy it.

Brave is just chrome underneath so you’re definitely not helping to browser diversity.

Appreciate it!

Re: To download from Google Drive, you must enable third party cookies?

#138

Post by thayne »

xxs wrote: post #99
jefftk wrote: post #71

Earlier quoted context omitted.

The explanation in the other comment is also correct. When you go from drive.google.com to googleusercontent.com to download a file, this historically worked by using third-party cookies to verify that you were authorized to download the file. When Safari dropped support for third-party cookies they added a new flow which uses link decoration instead, but only use this flow when they think the browser doesn't support…

>I'm not sure why they don't use the new flow for everyone. It's less secure, slower (more round trips), and more server side intense - likely considered a hack. Effectively it does the same what a cookie would. The 3rd party cookies are not a bad thing per se, it's just that they have been abused to hell and back, is what causes their reputation.

I don't think it has to be. They could make the request as an ajax request with an Authorization header. Of course that makes the frontend more complex as it as to do some gymnastics to treat the response as a download.

Re: To download from Google Drive, you must enable third party cookies?

#140

Post by ethbr0 »

jefftk wrote: post #135
ethbr0 wrote: post #105

Earlier quoted context omitted.

> A single entity manages multiple domains and shares cookie auth across them. The issue is we (the users) really want a more nuanced concept of "third party": something like "different domain that's controlled by the first party." Unfortunately, any declaration that relies on the first party will immediately be abused to hell ("All these tracking domains are controlled by me, so plz allow them!"), and we'd be right…

> The issue is we (the users) really want a more nuanced concept of "third party": something like "different domain that's controlled by the first party." Chrome was playing with an idea like that: https://developer.chrome.com/docs/privacy-sandbox/first-part...

Neat! It feels like cryptographic attestation by the child/secondary site would be less subject to abuse.

I.e. proving they have access to the same private key used to sign the parent, which would by definition not be something the parent would willingly share with random third parties

Post reply on HN