Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

To download from Google Drive, you must enable third party cookies?

support.google.com

Post reply on HN
Print view View original

81–90 of 166 posts

Re: To download from Google Drive, you must enable third party cookies?

#81

Post by jefftk »

workingon wrote: post #77
jefftk wrote: post #71

Earlier quoted context omitted.

The explanation in the other comment is also correct. When you go from drive.google.com to googleusercontent.com to download a file, this historically worked by using third-party cookies to verify that you were authorized to download the file. When Safari dropped support for third-party cookies they added a new flow which uses link decoration instead, but only use this flow when they think the browser doesn't support…

It seems obvious to me why they don't use that for everyone, and it has nothing to do with security.

From my understanding of how these decisions were made inside Google, it's very likely to be one of:

* Security: as described above

* Efficiency: the method used for Safari requires more server resources

* Performance: the method used for Safari is slower

What is the reason that seems obvious to you?

Re: To download from Google Drive, you must enable third party cookies?

#82

Post by NicuCalcea »

jefftk wrote: post #35
GTP wrote: post #18

And from their solution: "Type chrome://settings/cookies in the browser address bar" I love how they assume everybody uses Chrome.

It's only broken on Chrome, though. In Safari it works fine without third party cookies.

It's broken in Firefox for me.

Re: To download from Google Drive, you must enable third party cookies?

#83

Post by dataflow »

jefftk wrote: post #81
workingon wrote: post #77

Earlier quoted context omitted.

It seems obvious to me why they don't use that for everyone, and it has nothing to do with security.

From my understanding of how these decisions were made inside Google, it's very likely to be one of: * Security: as described above * Efficiency: the method used for Safari requires more server resources * Performance: the method used for Safari is slower What is the reason that seems obvious to you?

> What is the reason that seems obvious to you?

The reason he's thinking of is that they want to annoy people into enabling 3rd party cookies for tracking purposes, with security/performance/etc. as the excuse.

Re: To download from Google Drive, you must enable third party cookies?

#84

Post by horsawlarway »

workingon wrote: post #77
jefftk wrote: post #71

Earlier quoted context omitted.

The explanation in the other comment is also correct. When you go from drive.google.com to googleusercontent.com to download a file, this historically worked by using third-party cookies to verify that you were authorized to download the file. When Safari dropped support for third-party cookies they added a new flow which uses link decoration instead, but only use this flow when they think the browser doesn't support…

It seems obvious to me why they don't use that for everyone, and it has nothing to do with security.

I don't really agree (and I'm happy to bash on Google).

This is basically the poster child for a case when someone should be using 3rd party cookies: A single entity manages multiple domains and shares cookie auth across them.

It's not like the other flow is somehow making you less identifiable - they're literally just passing the same information in a more round-about, less usable manner.

I genuinely think the current approach of blacklisting everything with essentially no recourse to enable a fine-grained whitelist related to cookies going to an alternate domain is fundamentally web-hostile.

The web worked because you could link to 3rd parties. We're currently throwing the baby out with the bath water because our government is dysfunctional and unable to regulate tech privacy.

Re: To download from Google Drive, you must enable third party cookies?

#85

Post by lelandfe »

jefftk wrote: post #33

This is wrong: try downloading something with Safari, which blocks third party cookies by default, and it works fine. Instead, the problem is that downloading from Google Drive is using User-Agent sniffing to determine whether third party cookies are expected to be enabled, and choosing between implementations. (Disclosure: I used to work at Google, but I don't know anything internal on this)

If you mock your UA string in Chrome, does downloading work like Safari?

Re: To download from Google Drive, you must enable third party cookies?

#86

Post by VoxPelli »

jefftk wrote: post #71
Nextgrid wrote: post #64

Earlier quoted context omitted.

Oh wow - so while there was a non-malicious explanation in another comment ( https://news.ycombinator.com/item?id=32149130 ), this clearly looks like malicious behavior. They're relying on the fact that most browsers lack per-domain cookie controls to force Google Drive users to allow third-party cookies knowing full well the majority won't remember (or bother) to disable them after.

The explanation in the other comment is also correct. When you go from drive.google.com to googleusercontent.com to download a file, this historically worked by using third-party cookies to verify that you were authorized to download the file. When Safari dropped support for third-party cookies they added a new flow which uses link decoration instead, but only use this flow when they think the browser doesn't support…

Embedding the authentication in the link is both a security risk and more complex than simply relying on the cookie.

They could have opted to do what Twitter does: Leave everything accessible wide open even if the file was created in a private context such as Twitter DM:s

Locking down access to static files that you ideally would like to serve and cache straight from storage is a tricky thing in regards to performance, security and maintenance complexity.

Re: To download from Google Drive, you must enable third party cookies?

#87

Post by api »

jefftk wrote: post #81
workingon wrote: post #77

Earlier quoted context omitted.

It seems obvious to me why they don't use that for everyone, and it has nothing to do with security.

From my understanding of how these decisions were made inside Google, it's very likely to be one of: * Security: as described above * Efficiency: the method used for Safari requires more server resources * Performance: the method used for Safari is slower What is the reason that seems obvious to you?

The assumption is that every single thing Google does is a dark pattern to track you.

In this case you are probably right, but surveillance is Google's business model.

Re: To download from Google Drive, you must enable third party cookies?

#88

Post by horsawlarway »

dataflow wrote: post #83
jefftk wrote: post #81

Earlier quoted context omitted.

From my understanding of how these decisions were made inside Google, it's very likely to be one of: * Security: as described above * Efficiency: the method used for Safari requires more server resources * Performance: the method used for Safari is slower What is the reason that seems obvious to you?

> What is the reason that seems obvious to you? The reason he's thinking of is that they want to annoy people into enabling 3rd party cookies for tracking purposes, with security/performance/etc. as the excuse.

Except their instructions are specific to whitelisting the exact subdomains in question - they aren't telling you "Enable 3rd party cookies".

Re: To download from Google Drive, you must enable third party cookies?

#89

Post by gaius_baltar »

sneak wrote: post #19
giancarlostoro wrote: post #17

Earlier quoted context omitted.

Honestly anyone concerned about a Chrome / WebKit browser monopoly needs to use Firefox now if you already are not.

I don't see any problems with a monoculture of rendering engine. Browser (and features, especially privacy ones), absolutely. Renderer, not so much.

> I don't see any problems with a monoculture of rendering engine.

Remember IE6 ? That's what we get with a monoculture.

Re: To download from Google Drive, you must enable third party cookies?

#90

Post by seydor »

jefftk wrote: post #33

This is wrong: try downloading something with Safari, which blocks third party cookies by default, and it works fine. Instead, the problem is that downloading from Google Drive is using User-Agent sniffing to determine whether third party cookies are expected to be enabled, and choosing between implementations. (Disclosure: I used to work at Google, but I don't know anything internal on this)

How is it wrong? And if safari does it without cookies, why not chrome?

Chrome is used by 65% of people, safari ~15% (<10% on desktop)

Post reply on HN