4 ms·

It seems obvious to me why they don't use that for everyone, and it has nothing to do with security.

jefftk 4y ago
From my understanding of how these decisions were made inside Google, it's very likely to be one of: * Security: as described above * Efficiency: the method used for Safari requires more server resources * Performance: the method used for Safari is slower What is the reason that seems obvious to you?
- dataflow 4y ago
  > What is the reason that seems obvious to you? The reason he's thinking of is that they want to annoy people into enabling 3rd party cookies for tracking purposes, with security/performance/etc. as the excuse.
  - horsawlarway 4y ago
    Except their instructions are specific to whitelisting the exact subdomains in question - they aren't telling you "Enable 3rd party cookies".
    - dataflow 4y ago
      Yeah I'm not agreeing with it, just think that's what he was thinking of.
    - Nextgrid 4y ago
      Can you whitelist third-party cookies for a specific set of domains in any mainstream browser? To the best of my knowledge you can’t.
      - jefftk 4y ago
        The article we're commenting on has specific instructions for how to do this in Chrome: https://support.google.com/drive/answer/2423534 https://support.google.com/drive/answer/2423534
      - horsawlarway 4y ago
        You can absolutely do this in any Chromium based browser. Go to settings, check "block 3rd party cookies" scroll down to customized behaviors, click "Add" next to "sites that can always use cookies" Enter the domain you want. Before saving, make sure to check "Including third-party cookies on this site". -- Or, ya know, read the instructions in the link on this post telling you to do exactly this for drive.google.com :P
- api 4y ago
  The assumption is that every single thing Google does is a dark pattern to track you. In this case you are probably right, but surveillance is Google's business model.
- rndgermandude 4y ago
  I saw the efficiency/performance claim a bunch of times now. How is using a cookie over say the same data embedded in the requested URL or transmitted as form-data supposedly more efficient? The server still has to check the auth, no matter what part of the request it extracted the auth data from. Or am I missing something here? As for security, yeah, there are some good reasons for not embedding auth info in the link (tho one could still POST the same data instead without a third party cookie, etc), as well as for having a dedicated domain for user content.
horsawlarway 4y ago
I don't really agree (and I'm happy to bash on Google). This is basically the poster child for a case when someone should be using 3rd party cookies: A single entity manages multiple domains and shares cookie auth across them. It's not like the other flow is somehow making you less identifiable - they're literally just passing the same information in a more round-about, less usable manner. I genuinely think the current approach of blacklisting everything with essentially no recourse to enable a fine-grained whitelist related to cookies going to an alternate domain is fundamentally web-hostile. The web worked because you could link to 3rd parties. We're currently throwing the baby out with the bath water because our government is dysfunctional and unable to regulate tech privacy.
- ascagnel_ 4y ago
  > This is basically the poster child for a case when someone should be using 3rd party cookies: A single entity manages multiple domains and shares cookie auth across them. If everyone would use 3rd party cookies like you're describing, there'd be no issue with users enabling them. Instead, they're frequently used to track users across domains, and the alternate flow used for Safari should be the pragmatic option used for everyone. You're right to complain about how we're basically unable to use an otherwise-useful feature because of bad actors. It's a signal that core web technologies need to be created with potential abuses first and foremost.
  - horsawlarway 4y ago
    > It's a signal that core web technologies need to be created with potential abuses first and foremost. No. This is how absolutely everyone ends up with the shittiest version of everything. We need recourse and a general legal expectation that you DON'T abuse your users. Honestly - that attitude is exactly the problem: You're letting bad actors literally ruin the web, because the US government is unable to pull its fucking mouth out of the feed trough (or honestly do much of anything at all, right now). We don't take that stance for literally ANY other industry: You can buy a gun, but guns can kill people. You can buy a car, but cars can crash. You can get a dog, and that dog can bite people. The answer is not "Ban it because it might be bad". The answer is to properly set expectations that abuse will be met with heavy penalties. This is not fucking Minority Report, and we shouldn't be trying to "precognition" all the bad out of the world. We should address it head on, and fucking burn the bad actors to the ground.

From my understanding of how these decisions were made inside Google, it's very likely to be one of: * Security: as described above * Efficiency: the method used for Safari requires more server resources * Performance: the method used for Safari is slower What is the reason that seems obvious to you?

dataflow 4y ago
> What is the reason that seems obvious to you? The reason he's thinking of is that they want to annoy people into enabling 3rd party cookies for tracking purposes, with security/performance/etc. as the excuse.
- horsawlarway 4y ago
  Except their instructions are specific to whitelisting the exact subdomains in question - they aren't telling you "Enable 3rd party cookies".
  - dataflow 4y ago
    Yeah I'm not agreeing with it, just think that's what he was thinking of.
  - Nextgrid 4y ago
    Can you whitelist third-party cookies for a specific set of domains in any mainstream browser? To the best of my knowledge you can’t.
    - jefftk 4y ago
      The article we're commenting on has specific instructions for how to do this in Chrome: https://support.google.com/drive/answer/2423534 https://support.google.com/drive/answer/2423534
    - horsawlarway 4y ago
      You can absolutely do this in any Chromium based browser. Go to settings, check "block 3rd party cookies" scroll down to customized behaviors, click "Add" next to "sites that can always use cookies" Enter the domain you want. Before saving, make sure to check "Including third-party cookies on this site". -- Or, ya know, read the instructions in the link on this post telling you to do exactly this for drive.google.com :P
api 4y ago
The assumption is that every single thing Google does is a dark pattern to track you. In this case you are probably right, but surveillance is Google's business model.
rndgermandude 4y ago
I saw the efficiency/performance claim a bunch of times now. How is using a cookie over say the same data embedded in the requested URL or transmitted as form-data supposedly more efficient? The server still has to check the auth, no matter what part of the request it extracted the auth data from. Or am I missing something here? As for security, yeah, there are some good reasons for not embedding auth info in the link (tho one could still POST the same data instead without a third party cookie, etc), as well as for having a dedicated domain for user content.

horsawlarway 4y ago

I don't really agree (and I'm happy to bash on Google). This is basically the poster child for a case when someone should be using 3rd party cookies: A single entity manages multiple domains and shares cookie auth across them. It's not like the other flow is somehow making you less identifiable - they're literally just passing the same information in a more round-about, less usable manner. I genuinely think the current approach of blacklisting everything with essentially no recourse to enable a fine-grained whitelist related to cookies going to an alternate domain is fundamentally web-hostile. The web worked because you could link to 3rd parties. We're currently throwing the baby out with the bath water because our government is dysfunctional and unable to regulate tech privacy.

ascagnel_ 4y ago
> This is basically the poster child for a case when someone should be using 3rd party cookies: A single entity manages multiple domains and shares cookie auth across them. If everyone would use 3rd party cookies like you're describing, there'd be no issue with users enabling them. Instead, they're frequently used to track users across domains, and the alternate flow used for Safari should be the pragmatic option used for everyone. You're right to complain about how we're basically unable to use an otherwise-useful feature because of bad actors. It's a signal that core web technologies need to be created with potential abuses first and foremost.
- horsawlarway 4y ago
  > It's a signal that core web technologies need to be created with potential abuses first and foremost. No. This is how absolutely everyone ends up with the shittiest version of everything. We need recourse and a general legal expectation that you DON'T abuse your users. Honestly - that attitude is exactly the problem: You're letting bad actors literally ruin the web, because the US government is unable to pull its fucking mouth out of the feed trough (or honestly do much of anything at all, right now). We don't take that stance for literally ANY other industry: You can buy a gun, but guns can kill people. You can buy a car, but cars can crash. You can get a dog, and that dog can bite people. The answer is not "Ban it because it might be bad". The answer is to properly set expectations that abuse will be met with heavy penalties. This is not fucking Minority Report, and we shouldn't be trying to "precognition" all the bad out of the world. We should address it head on, and fucking burn the bad actors to the ground.