Chrome is entrenching third-party cookies that will mislead users • Hacker News Board

Re: Chrome is entrenching third-party cookies that will mislead users

#261

Post by mindslight » Fri, Aug 30, 2024, 3:34 PM UTC

nine_k wrote: post #143

throwaway937474 wrote: post #138

Earlier quoted context omitted.

Now substitute the first one for "gay", and you might get a death sentence in several parts of the world. Why does almost nobody on this site thinks about the wider world bedsides their own extremely privileged position? I would very much prefer for advertisers to not even be able to determine my city, for personal safety. Throwaway account for obvious reasons.

This is very true. Usually the discussion goes about tracking by commercial entities in rich Westernized countries, which, by no coincidence, are the principal market of the ad industry. (Yes, China exists and is a huge market, but commercial tracking is a minor problem here, compared to other forms of surveillance.) If you belong to such a category that the mere belonging to it is a death sentence, if revealed, the…

Government and commercial surveillance are intrinsically linked and framing them as some dichotomy is essentially just a coping mechanism. It's quite plausible that someone in a category that is openly accepted in the western world ends up traveling to a country where that category has been criminalized, and then ends up in the sights of the authorities based off surveillance records/analysis bought from consumer surveillance companies in the western world.

Re: Chrome is entrenching third-party cookies that will mislead users

#262

Post by hn_version_0023 » Fri, Aug 30, 2024, 3:46 PM UTC

bad_user wrote: post #252

rpastuszak wrote: post #250

Earlier quoted context omitted.

> And of course they want to cater to advertisers because it is advertising that maintains the open web As someone who worked both on advertiser and publisher sides (incl. content monetisation): advertisers like to say that they support publishers and the open web, but in fact, they are keeping it hostage. We've had the means/tech to support publishers directly for years (I don't mean crypto). It's in the interest of…

> As someone who worked both on advertiser and publisher sides (incl. content monetisation): advertisers like to say that they support publishers and the open web, but in fact, they are keeping it hostage. I know what you're saying, I agree, as I worked (in the past) on advertising platforms as well, but both of those statements can be true at the same time. The open web was built on advertising, but the perverse inc…

> micro-transactions are not possible given the huge banking fees.

We can change this via legislation. The “financialization” of everything feels related to the adtech conundrum.

Bringing banks to heel for the good of society is long overdue IMO.

Re: Chrome is entrenching third-party cookies that will mislead users

#263

Post by renonce » Fri, Aug 30, 2024, 3:49 PM UTC

thayne wrote: post #245

renonce wrote: post #197

Earlier quoted context omitted.

> I can't log in to stackoverflow.com, then go to superuser.com and already be logged in. I would expect a popup like “This site wants to share cookies with stackexchange.com, press Allow to sign in, press Reject to reject forever or press Ignore to decide later”. Takes a single click to enjoy the benefits of both worlds. The mechanism should make sure that every website has a single “first-party domain” shared acros…

And that would be annoying to people who aren't already logged in to a related site. Also, there is no way to know which related site the user is logged in to, so they would have to prompt for every one of their sites.

> Also, there is no way to know which related site the user is logged in to, so they would have to prompt for every one of their sites.

This is not how it works. The mechanism is about allowing a cluster of websites to choose a single first party domain and have all of them share cookies together, not sharing arbitrary cookie from arbitrary domain, otherwise it would create loopholes in connected components that bring back the downsides of third-party cookies. What you mentioned should be done using SSO.

After thinking about it a bit more, I have a clearer picture of how it should work in my mind:

* All cookies are double-keyed: the primary key is the origin of the top-level page and the secondary key is the origin of the page that sets the cookie, just like how partitioned cookies work right now.

* stackoverflow.com uses a header, meta tag or script to request changing its primary key domain to “stackexchange.com”

* The browser makes a request to https://stackexchange.com/domains.txt and make sure that “stackoverflow.com” is in the list, authorising this first-party domain change

* When the user agrees to the change, the page is reloaded with stackexchange.com as the primary key, thus stackoverflow.com can obtain login details from stackexchange.com via CORS or cross site cookies.

* A side effect is that all cookies and state are lost when switching the first-party domain. Should stackoverflow.com be acquired by a new owner, say x.com and changes its first-party domain to x.com, all cookies on stackoverflow.com are lost and the user will have to login on x.com again, maybe using credentials from stackexchange.com. It’s unfortunate but it works around the issues mentioned in the post in a clean way, avoiding loopholes that transfer cookies by switching the first-party domain frequently.

Re: Chrome is entrenching third-party cookies that will mislead users

#264

Post by nine_k » Fri, Aug 30, 2024, 4:11 PM UTC

mindslight wrote: post #261

nine_k wrote: post #143

Earlier quoted context omitted.

This is very true. Usually the discussion goes about tracking by commercial entities in rich Westernized countries, which, by no coincidence, are the principal market of the ad industry. (Yes, China exists and is a huge market, but commercial tracking is a minor problem here, compared to other forms of surveillance.) If you belong to such a category that the mere belonging to it is a death sentence, if revealed, the…

Government and commercial surveillance are intrinsically linked and framing them as some dichotomy is essentially just a coping mechanism. It's quite plausible that someone in a category that is openly accepted in the western world ends up traveling to a country where that category has been criminalized, and then ends up in the sights of the authorities based off surveillance records/analysis bought from consumer sur…

Fair enough. The difference is mostly how much the government limits commercial surveillance (eg in EU) or integrates / buys it as part of its own surveillance (not only China or Russia, but also many Western countries to a limited extent).

Re: Chrome is entrenching third-party cookies that will mislead users

#265

Post by dwighttk » Fri, Aug 30, 2024, 4:13 PM UTC

jsnell wrote: post #59

dwighttk wrote: post #37

Earlier quoted context omitted.

OP seems to claim 13% same / 87% opposite

I don't think you can make that conclusion. I think you're making the assumption that all three data points are needed for all 87%. But obviously some people can be uniquely identified based on just {zip, date or birth}, such that gender isn't necessary. So the distribution could e.g. be 8% same, 8% opposite, 5% both, 79% neither, and explain the original numbers without triggering the paradox.

Yeah I was off, but by their numbers

87% of the time, there are no others on my birthdate or there is one other and opposite gender.

13% of the time is 1 same gender or more of either or both.

Re: Chrome is entrenching third-party cookies that will mislead users

#266

Post by crooked-v » Fri, Aug 30, 2024, 4:13 PM UTC

autoexec wrote: post #125

codedokode wrote: post #85

Have been using Firefox for a long time, no issues, though long ago when I had little memory, Chrome was using less of it. Firefox also has HTTPS-only mode, encrypted DNS without fallbacks, supports SOCKS and Encrypted Client Hello (although almost no website support it). However, it is better to just buy more memory (unless you are lucky to use Apple products). Regarding analytics, I believe browsers should take use…

> Regarding analytics, I believe browsers should take user's side and do not cooperate with marketing companies Browsers were supposed to act as agents working for the user. User-agents. These days it's getting harder and harder to find a browser that doesn't work for an ad company at the expense of the user. Chrome's entire reason for existing is data collection. Firefox can, for now at least, be hardened to work fo…

Safari does a decent job of that, especially with Apple pushing an increasing number of privacy features by default. Of course, that comes with it being as a feature of an expensive hardware ecosystem, rather than an independent product.

Re: Chrome is entrenching third-party cookies that will mislead users

#267

Post by gkbrk » Fri, Aug 30, 2024, 4:21 PM UTC

dotancohen wrote: post #240

pwdisswordfishz wrote: post #182

Earlier quoted context omitted.

> That’s like saying the entire point of TLS is to prevent users from looking at the traffic being sent to a website. In the case of mobile apps, it is.

Can you clarify that statement?

A lot of mobile apps use TLS with certificate pinning, so even if the user installs a system-wide root CA, the app doesn't accept it and won't let the user look at what data is being sent to the servers.

Re: Chrome is entrenching third-party cookies that will mislead users

#268

Post by dingaling » Fri, Aug 30, 2024, 4:22 PM UTC

bad_user wrote: post #247

roelschroeven wrote: post #187

Earlier quoted context omitted.

DoH means that each application does its own DNS queries, instead of using the OS's functionality. Whether that includes reading /etc/hosts is up to the application, and it looks like high profile applications like Chrome and Firefox don't read /etc/hosts. > The entire point of these technologies is to prevent your ISP and everyone else along the way from knowing which websites you visit. More correctly, the point is…

Excluding leaks, the ISP does not see the hostnames, what it sees are the IPs you're connecting to. 20% of internet traffic goes through Cloudflare, so at least for those, the IPs are meaningless. Both privacy and security are layered, and perfect is the enemy of good. Securing the DNS is an obvious first step, forcing the Internet to HTTPS by default was another. Google and Mozilla have contributed to better privacy…

> Excluding leaks, the ISP does not see the hostnames

Unfortunately they can, either through the unencrypted hostname passed in SNI or in the cert returned by the server .

Re: Chrome is entrenching third-party cookies that will mislead users

#269

Post by oarsinsync » Fri, Aug 30, 2024, 4:27 PM UTC

dotancohen wrote: post #240

pwdisswordfishz wrote: post #182

Earlier quoted context omitted.

> That’s like saying the entire point of TLS is to prevent users from looking at the traffic being sent to a website. In the case of mobile apps, it is.

Can you clarify that statement?

A lot of mobile apps use TLS connections when communicating with their backends.

You can MITM the traffic, and continue to deliver the traffic using a self signed certificate that you’ve trusted on your mobile device, and boom, you can capture the traffic at your proxy point and be happy.

A lot of mobile apps use certificate pinning to ensure that the backend certificate matches what the app expects. Now your self signed certificate, even though it’s trusted at the OS level, no longer matches the certificate that the app is expecting, and no data is exchanged after TLS handshake fails.

Re: Chrome is entrenching third-party cookies that will mislead users

#270

Post by gkbrk » Fri, Aug 30, 2024, 4:27 PM UTC

bad_user wrote: post #244

nicce wrote: post #57

Earlier quoted context omitted.

As a competitor, let's add that they are ad company too.

Name one browser that isn't funded by ads. Even the minor browsers, pretending to not be funded by ads at this point (while the VC capital is drying up) depend on one of the 3 browser engines, all of which are funded by ads.

Ladybird is funded entirely through donations, and doesn't depend on one of the 3 browser engines.