Chrome is entrenching third-party cookies that will mislead users • Hacker News Board

Re: Chrome is entrenching third-party cookies that will mislead users

#211

Post by [deleted] » Fri, Aug 30, 2024, 11:13 AM UTC

renonce wrote: post #197

thayne wrote: post #174

This is a tough situation. Yes, this can, and will, be abused for tracking users across domains that they don't expect to be related. But there are also legitimate use cases for this. For example, consider the stackexchange family of sites. They are clearly related, have a unified branding, etc. but are on separate domains. On Firefox, which blocks third party cookies, I have to log in to each of those domains separa…

> I can't log in to stackoverflow.com, then go to superuser.com and already be logged in. I would expect a popup like “This site wants to share cookies with stackexchange.com, press Allow to sign in, press Reject to reject forever or press Ignore to decide later”. Takes a single click to enjoy the benefits of both worlds. The mechanism should make sure that every website has a single “first-party domain” shared acros…

[deleted]

Re: Chrome is entrenching third-party cookies that will mislead users

#212

Post by autoexec » Fri, Aug 30, 2024, 11:23 AM UTC

rpastuszak wrote: post #193

autoexec wrote: post #125

Earlier quoted context omitted.

> Regarding analytics, I believe browsers should take user's side and do not cooperate with marketing companies Browsers were supposed to act as agents working for the user. User-agents. These days it's getting harder and harder to find a browser that doesn't work for an ad company at the expense of the user. Chrome's entire reason for existing is data collection. Firefox can, for now at least, be hardened to work fo…

> but Mozilla is an ad-tech company too now. The recent events related to FF are not that much of a shift, considering that Google pays $20B per annum to its (technically non-ad tech) partners, then 85% of Mozilla's total revenue comes from its partnership with Google . That ship had sailed long time ago. https://untested.sonnet.io/Defaults+Matter%2C+Don't+Assume+C...

Firefox really has been going downhill for a long time. Forcing Pocket into the browser, the ad infested new tab page, telemetry, making user accounts a thing, force installing TV show promotions, etc.

What they haven't done before is spend a fortune buying up an ad-tech start up. They barely even bother to maintain a pretense that they care about Firefox users. They basically came right out and said "We know that users don't want this, we can't convince them to, so we were right to force it on them by default and just hope most people don't notice and start complaining" (https://cdn.adtidy.org/blog/new/2wffyscreen_mozilla.png?mw=1...)

Re: Chrome is entrenching third-party cookies that will mislead users

#213

Post by IMTDb » Fri, Aug 30, 2024, 11:23 AM UTC

thayne wrote: post #174

This is a tough situation. Yes, this can, and will, be abused for tracking users across domains that they don't expect to be related. But there are also legitimate use cases for this. For example, consider the stackexchange family of sites. They are clearly related, have a unified branding, etc. but are on separate domains. On Firefox, which blocks third party cookies, I have to log in to each of those domains separa…

> You can argue that it would be better for those sites to be subdomains of a single unified domain, but when the sites were created there wasn't any compelling reason to need to do that

I can also argue that Safari and Firefox have been blocking third party cookies for years now. So stack overflow has had plenty of time to adapt and migrate to the "right" organisation.

To me it look like either they care about allowing unified sign in on their various domaines, and they should have migrated to a subdomain model a long time ago, because users of Firefox, Safari etc have been negatively impacted for a long time. Or they do not care that much (which is fine), but then chrome blocking third-party cookies and the discussion around first party sets should not concern them too much.

Re: Chrome is entrenching third-party cookies that will mislead users

#214

Post by tyingq » Fri, Aug 30, 2024, 11:24 AM UTC

renegat0x0 wrote: post #180

muratsu wrote: post #178

Earlier quoted context omitted.

This reminds me how google conveniently made the switch to manifest v3 when there were legitimate use cases like adblockers. Sure, technically speaking v3 is more secure and that may be better for users but your comment just made me think the opposite is in motion here.

In politics there is a Churchill quote "Never let a crisis go to waste". In IT, big tech never wastes opportunity to introduce a dark design behind a useful feature.

Also see "Patriot Act".

Re: Chrome is entrenching third-party cookies that will mislead users

#215

Post by chgs » Fri, Aug 30, 2024, 11:26 AM UTC

bluejekyll wrote: post #164

dogecoinbase wrote: post #162

Earlier quoted context omitted.

Unfortunately no. The entire point of DoH is to bypass the ability of the users to prevent browsers from providing browsing habits to their owners.

No, that is not the entire point of DoH. That’s like saying the entire point of TLS is to prevent users from looking at the traffic being sent to a website. DNS without DoH, DoT, or DoQ, is wide open to anyone snooping traffic in the raw, that’s not necessarily information you want to share with the world.

DoH is pushed by goggle et al to ensure you continue to provide your data to them.

The browser should respect the OS. The OS should respect the network (dhcp/slacc). If you want to override this then that should be an active choice by the user.

I am quite happy with my OS using normal dns (via WireGuard when out) to my dns server which blocks bad domains before they even reach my firewall, I don’t need DoH, although I have no problem with that as a concept.

What I don’t like is my browser taking away my choice and breaking the model. It should defer to the OS (and I can’t see any time I wouldn’t want it to defer to the OS)

Re: Chrome is entrenching third-party cookies that will mislead users

#216

Post by TacticalCoder » Fri, Aug 30, 2024, 11:28 AM UTC

codedokode wrote: post #85

Have been using Firefox for a long time, no issues, though long ago when I had little memory, Chrome was using less of it. Firefox also has HTTPS-only mode, encrypted DNS without fallbacks, supports SOCKS and Encrypted Client Hello (although almost no website support it). However, it is better to just buy more memory (unless you are lucky to use Apple products). Regarding analytics, I believe browsers should take use…

> Have been using Firefox for a long time, no issues, though long ago when I had little memory, Chrome was using less of it.

I'd say the only area where I still see Chrome leading a bit is for web development: when I run super-heavy JavaScript in dev mode, Chrome is faster than Firefox at executing all the JavaScript nonsense. Seen that there's no ecosystem with more turds, bloatedness and slowness than that horror that JavaScript-the-piece-of-crap is, having a browser a bit quicker at running JavaScript helps.

Long story short: for Web development, I use Chromium (it ships with Debian). For the rest I use Firefox.

> Firefox also has HTTPS-only mode...

In doubt port 80 is blocked by the firewall too.

> encrypted DNS without fallbacks,

And Firefox has a relatively easy "corporate" setting too where you can force also DNS "in the clear" over port 53 UDP (well, it's 99.9999% of the time going to be UDP so you can even firewall port 53 TCP and things shall keep working: believe me I know: theory vs practice and all that)

It's convenient if you run your own DNS resolver (which, itself, can then be forced to only use encrypted DNS).

> supports SOCKS

I confirm: a SOCKS5 proxy over ssh is always sweet.

Firefox just works.

Re: Chrome is entrenching third-party cookies that will mislead users

#217

Post by styfle » Fri, Aug 30, 2024, 11:29 AM UTC

Does Google expect other browsers to just copy their list[0]?

Or are developers supposed to submit their related domains to each browser and they all have their own list to maintain?

This sounds like HSTS.

[0]: https://github.com/GoogleChrome/related-website-sets/blob/ma...

Re: Chrome is entrenching third-party cookies that will mislead users

#218

Post by chgs » Fri, Aug 30, 2024, 11:30 AM UTC

dspillett wrote: post #201

Xelbair wrote: post #183

Earlier quoted context omitted.

The entire point of DoH is to take away control of DNS from the OS vendor to the browser. There were other encrypted standards(dnscrypt for example) that didn't require you to do that, but the one that bypasses the OS was forced by adtech monopolist in charge.

No, the point of DoH is to take control of DNS from ISPs (and related middlemen) and give it back to site/service owners (so their settings are not overridden for whatever reason) and the end-user (so their habits are not as easy to disrupt or track at the ISP level). > but the one that bypasses the OS was forced by adtech monopolist in charge. Assuming by “adtech monopolist in charge” you mean Google, I don't think…

If it was implemented at an OS level and respected standard configuration then fine, DoH, DoT, whatever, I’m happy.

However it wasn’t, and it doesn’t defer to the OS or the network. I can’t set a dhcp option on my network to tell my dozens of clients what dns server to use, I have to manually adjust each browser. I additionally get different reaults depending what I use, my browser will contact a different server than any other application.

That’s broken behaviour which benefits AdTech companies like Google.

Re: Chrome is entrenching third-party cookies that will mislead users

#219

Post by account42 » Fri, Aug 30, 2024, 11:30 AM UTC

grishka wrote: post #191

roelschroeven wrote: post #187

Earlier quoted context omitted.

DoH means that each application does its own DNS queries, instead of using the OS's functionality. Whether that includes reading /etc/hosts is up to the application, and it looks like high profile applications like Chrome and Firefox don't read /etc/hosts. > The entire point of these technologies is to prevent your ISP and everyone else along the way from knowing which websites you visit. More correctly, the point is…

> DoH means that each application does its own DNS queries, instead of using the OS's functionality. HUH?! No! You aren't supposed to implement DNS on the application level! Most modern OSes support some form of DNS over TLS at the system level. You should use that.

Should and what browsers actually do is completely different then.

Re: Chrome is entrenching third-party cookies that will mislead users

#220

Post by TacticalCoder » Fri, Aug 30, 2024, 11:36 AM UTC

dogecoinbase wrote: post #162

tommica wrote: post #161

Earlier quoted context omitted.

Is it as simple as this?

Unfortunately no. The entire point of DoH is to bypass the ability of the users to prevent browsers from providing browsing habits to their owners.

> The entire point of DoH is to bypass the ability of the users to prevent browsers from providing browsing habits to their owners.

It is the entire point of DoH indeed, while hiding behind the idea that is somehow prevents the state/ISP from knowing which sites you go to (which it really doesn't).

There only one way to get best of both world:

    - force your browser to never ever use DoH / DoT: force good old, in the clear, DNS over port 53

    - run your own local DNS resolver (I run *unbound*)

    - only ever allow DNS port 53 to/from your machine and your local resolver (I run *unbound* on an old Raspberry Pi)

    - have your DNS resolver use DoH

This way you get the imaginary protection that your DNS traffic is "encrypted" between you and your ISP: I mean, it is encrypted... But it's an illusion to believe it prevents your ISP / friendly-state-after-your-well-being from knowing which sites you visit.

But you also get full control over which domains can be resolved or not.

As a sidenote unbound supports "wildcards" when blocking domains, which is sweet (as opposed to your typical OS's hosts files, which doesn't support wildcard).

FWIW I've configured unbound to return 0.0.0.0 for the millions (!) of (wildcarded) domains I'm blocking and then I use dnsmasq, locally, to convert any 0.0.0.0 to transform into NXDOMAIN. It's versatile and I like that way.

It's Linux so you set that up once and it works for years.