from Hacker News

Building a more private web: A path towards making third party cookies obsolete

by eh78ssxv2f on 1/14/20, 4:08 PM with 200 comments

• by negus on 1/14/20, 4:53 PM

  Yes this will have a great negative impact for Google's adtech competitors who unlike Google do not have other means to spy on users such as Chrome, search engine, Accelerated Mobile Pages, Gmail, voice assistant and so on.

  But Google really has no choice here due to aggressive campaign by Mozilla, Apple and Microsoft who boast with their Intelligent Tracking Prevention ( https://webkit.org/blog/8828/intelligent-tracking-prevention... ) implementation blaming Google as a company which does not value users privacy. Google would lose privacy-conscious users otherwise.

  But it is clear for me how all this anti-thirdparty cookies situation will go further: server side third party ad trackers -- this will bypass Same Origin Policy and will pose a privacy and security threat for users and websites even more than todays third party frontend ad trackers.

• by zpeti on 1/14/20, 4:36 PM

  I think this is an easy move for Google, it's a "strategy credit" as Ben Thompson would put it.

  Google already knows most of what it needs about you, and it will in the future from searches. It has no motivation to allow 3rd parties help in tracking visitors. This way it can build a moat around its business while pretending to care about privacy. It's bullshit.

• by amluto on 1/14/20, 5:26 PM

  > By undermining the business model of many ad-supported websites, blunt approaches to cookies encourage the use of opaque techniques ...

  This is disingenuous. Reducing tracking does not undermine websites. It undermines advertisers that depend on tracking. If tracking stopped, advertisers would target something else (e.g. content or coarse location) and roughly the same amount of money would go to websites. Google’s privileged position would be a lot less inherently valuable, though.

• by hurricanetc on 1/14/20, 6:24 PM

  >By undermining the business model of many ad-supported websites, blunt approaches to cookies encourage the use of opaque techniques such as fingerprinting (an invasive workaround to replace cookies), which can actually reduce user privacy and control.

  Sure. So how about we block fingerprinting? Oh waaaaaait I see. What you actually want is your privacy invading business model to not be impacted.

  Why are sites able to ascertain the type of browser, operating system, OS version, webkit version, Safari version, time zone, language, platform, vendor, screen dimensions, plugins, etc.

  This shit should be as locked down as location, web cam, and microphone. Block all of it.

• by phelm on 1/14/20, 4:46 PM

  I have disabled 3rd party cookies in my browser for about a year now. My experience has been fine, I have had very few issues with things that I care about, no whitelist and not had to re-enable them yet.

• by Despegar on 1/14/20, 6:10 PM

  > Users are demanding greater privacy--including transparency, choice and control over how their data is used--and it’s clear the web ecosystem needs to evolve to meet these increasing demands. Some browsers have reacted to these concerns by blocking third-party cookies, but we believe this has unintended consequences that can negatively impact both users and the web ecosystem. By undermining the business model of many ad-supported websites, blunt approaches to cookies encourage the use of opaque techniques such as fingerprinting (an invasive workaround to replace cookies), which can actually reduce user privacy and control. We believe that we as a community can, and must, do better.

  The Webkit team already proposed a privacy-preserving way to do ad click attribution [1]. I'm guessing that was too private and Privacy Sandbox works better for Google.

  [1] https://webkit.org/blog/8943/privacy-preserving-ad-click-att...

• by jszymborski on 1/14/20, 4:44 PM

  In the past Chrome has played fast and loose with standards and features, which was fine for them since Firefox and friends needed to adopt them lest they widen the "Only works on Chrom(e/ium)" gap.

  I wonder how removing a feature might go, however. The answer is "probably well because Chrome has overwhelming market share", but I do wonder if, between AMP and "no URLs" and no 3rd party cookies, if there's room for a small but growing "it just works how I'd expect it to on Firefox" contingent to spring up...

• by jotto on 1/14/20, 5:21 PM

  This will break a lot of auth0 jwt/login default integrations since it depends on 3rd party cookies.

• by jka on 1/14/20, 4:33 PM

  There's a short summary of some of the features proposed for the Privacy Sandbox here - https://blog.chromium.org/2019/08/potential-uses-for-privacy...

• by markosaric on 1/14/20, 6:22 PM

  This will hurt the ad-tech businesses and websites/publishers who rely on third-party ads/targeting much more than it will hurt Google (and Facebook).

  Still, Google's revenue on third-party site ads was $6.4bn in Q3 of 2019 out of the $40.5bn in total revenue so it could be felt a bit there too.

  I fear that it all will move to first-party tracking though which will be so much more difficult to block and so much more dangerous in terms of security.

• by rafaelturk on 1/14/20, 4:24 PM

  Hard to read this and extract facts. My sense that this article is intentionally vague.

• by apeace on 1/14/20, 6:08 PM

  If anyone from Google is reading this, the new SameSite policies coming to Chrome 80 are breaking "Login with Google" functionality. I opened an issue here: https://github.com/google/google-api-javascript-client/issue...

• by pc2g4d on 1/14/20, 11:57 PM

  The arms race moves to its next phase.

  I'm not sure this will accomplish much as it's not that hard to serve things from one's own domain. More work for the tracking company to get things set up, I suppose, but harder to detect once established.

• by ryanmccullagh on 1/14/20, 9:13 PM

  So now ad companies will just require a CNAME entry in the website's DNS record.

• by Tepix on 1/15/20, 10:21 AM

  For privacy conscious users who have blocked third party cookies for years, this may make evading tracking ever more complicated.

  My guess is we will need custom GreaseMonkey scripts that prevent parameters from being appended to URLs so when you click on a link to another site it will not pass tracking information. Generally whenever a tracking network changes these parameters the Greasemonkey scripts will have to be updated whereas in the past you could just block the third party cookies and avoid a lot of the tracking.

• by bilekas on 1/14/20, 4:39 PM

  There have been articles recently which are claiming the value of those cookies are not as valuable as before because the majority of them are avoided/altered to obfuscate to the requester.

  So I see this as a : 'Hey we got in before everyone and stopped using cookies first' — When in reality, they're becomming less of a valuable commoddity.

  I'll be very happy when companies stop storing excess info in their own storage.

  Until then, no round of applause from me .

• by EGreg on 1/14/20, 4:15 PM

  What about single-sign-on stuff? What about iframe widgets where you are logged in?? Will there be a way to choose to keep being logged in, in iOS and Android? Or will everything become stateless and dumb?

• by awinter-py on 1/14/20, 4:40 PM

  a large chunk of G's business is first-party ads, i.e. in their own SERP vs on someone else's inventory

  interesting to see if that's the future. certainly anyone with substantial inventory has experimented with this (NYT for example) because they suspect they're getting cheating by G/FB

• by driverdan on 1/14/20, 5:12 PM

  This is so two-faced. This is the key line:

  > Once these approaches have addressed the needs of users, publishers, and advertisers, and we have developed the tools to mitigate workarounds…

  A browser vendor that cared about its users would make a browser for them, not publishers or advertisers. It would block all tracking garbage by default.

  Just admit it Justin, the real Chrome customers are advertisers. You don't actually give a shit about users if it interferes with ad dollars.

  Edit: I left out this good quote

  > Some ideas include new approaches to ensure that ads continue to be relevant for users

  More user-hostile advertiser appeasement.

• by npx13 on 1/14/20, 7:18 PM

  You care about users privacy? Judging by how passive aggressively Google tries to prevent us actually logging out of a Google Account, you are having a laugh.

• by sub7 on 1/14/20, 8:56 PM

  Good riddance. Unfortunately (almost) all our conversations - verbal and text messaging - are being spied on to target us with ads right now.

  Addressing anything else is like pissing in the ocean to change it's colour.

• by Scarbutt on 1/14/20, 4:28 PM

  Looks like safari gave them no choice, so now they grab this as an opportunity to say the want to do it too.

• by exabrial on 1/14/20, 5:14 PM

  I believe they'll just be using the QUIC protocol and IPv6 to track users instead.

• by tboyd47 on 1/14/20, 5:23 PM

  It's the classic regulatory capture move of pulling up the ladder behind you, only they don't need regulators to do it.

  What's more, Firefox is just an off-brand of Google to capture the "privacy first" consumer market segment.

  Doesn't mean I'm going to stop using Firefox, but it just helps to see the big picture.

• by bilekas on 1/14/20, 5:13 PM

  Another reason why Google's concern here for our privacy is nonsense is if we look here :

  https://webkit.org/tracking-prevention-policy/

  We can see, google doesn't need to inform their chrome users :

  > A privileged third party is a party that has the potential to track the user across websites without their knowledge or consent because of special access built into the browser or operating system.

  INOL but my understanding of this would put Google's Chrome into that bracket. Potentially also Microsoft/Apple ?