from Hacker News

Chrome is entrenching third-party cookies that will mislead users

by NayamAmarshe on 8/29/24, 2:53 PM with 311 comments

• by codedokode on 8/29/24, 8:33 PM

  Have been using Firefox for a long time, no issues, though long ago when I had little memory, Chrome was using less of it. Firefox also has HTTPS-only mode, encrypted DNS without fallbacks, supports SOCKS and Encrypted Client Hello (although almost no website support it). However, it is better to just buy more memory (unless you are lucky to use Apple products).

  Regarding analytics, I believe browsers should take user's side and do not cooperate with marketing companies; even better, they should implement measures to make user tracking and fingerprinting more difficult. There is no need to track user's browsing history; just make a product better than competitors (so that it gets first place in reviews and comparisons) and buy ads from influencers.

  It would be great if browsers made fingerprinting more difficult, i.e.: not allowed to read canvas data, not allowed to read GPU name, enumerate audio cards, probe for installed extensions etc. Every new web API should guarantee that it doesn't provide more fingerprinting data or hides the data behind a permission.

  Regarding 3rd party cookies: instead of shady lists like RWS browsers should just add a button that allows 3rd party cookies as an exception on a legacy website relying on them (which is probably not very secure). Although, there is a risk that newspaper websites, blog websites and question-answers websites will force users to press the button to see the content.

• by JohnFen on 8/29/24, 7:00 PM

  That seems the obvious result of this sort of thing.

  > Related Website Sets (RWS) is a way for a company to declare relationships among sites, so that browsers allow limited third-party cookie access for specific purposes.

  So the website itself gets to declare other "blessed" domains that can bypass third party cookie blocks? Big websites are constantly looking for ways to abuse users by bypassing their attempts at protecting themselves. How would anyone think these sites can be trusted not to abuse this?

• by thayne on 8/30/24, 6:56 AM

  This is a tough situation.

  Yes, this can, and will, be abused for tracking users across domains that they don't expect to be related.

  But there are also legitimate use cases for this.

  For example, consider the stackexchange family of sites. They are clearly related, have a unified branding, etc. but are on separate domains. On Firefox, which blocks third party cookies, I have to log in to each of those domains separately. I can't log in to stackoverflow.com, then go to superuser.com and already be logged in. That is a problem that First party sets would solve.

  You can argue that it would be better for those sites to be subdomains of a single unified domain, but when the sites were created there wasn't any compelling reason to need to do that, because third party cookies were still very much alive and kicking. And I can say from experience that migrating an app to a different domain without breaking things for users is a royal pain, and can be very expensive.

  I'm not saying that First Party Sets should be accepted as is, but it is attempting to solve real problems. And I think a solution that simultaneously protects users' privacy and maintains a good experience for sites that are legitimately related will be difficult to find, or maybe impossible.

• by styfle on 8/30/24, 11:29 AM

  Does Google expect other browsers to just copy their list[0]?

  Or are developers supposed to submit their related domains to each browser and they all have their own list to maintain?

  This sounds like HSTS.

  [0]: https://github.com/GoogleChrome/related-website-sets/blob/ma...

• by tomComb on 8/29/24, 5:06 PM

  As if brave were a good or objective source for this topic.

• by callmeal on 8/29/24, 7:21 PM

  I guess it's time to start blocking /.well-known/related-website-set.json

• by namdnay on 8/29/24, 4:05 PM

  > and even after third-party cookies have been deprecated in Chrome

  apparently this was written a few weeks ago :)

• by knallfrosch on 8/29/24, 6:58 PM

  I don't care because I use Firefox.

• by acheron on 8/29/24, 5:44 PM

  Padme: So then Brave isn’t going to be based on Chrome anymore, right?

• by aftbit on 8/29/24, 6:14 PM

  I know this isn't quite the right place, but can anyone point to some research or writeups on the Chrome ad topics stuff? How does that impact user privacy? What is shared with third parties? I know next to nothing about it at the moment.

• by enhancer on 8/30/24, 10:06 AM

  People re leaving chrome more and more. Let's hope the trend continues

• by ssss11 on 8/30/24, 4:19 AM

  Google doing something not in the interests of their users? Shock

• by martinald on 8/30/24, 8:33 AM

  This seems quite out of date given Google has announced they are not deprecating third party cookies recently? Or am I missing something?

• by doo_daa on 8/29/24, 8:58 PM

  I've tried brave and Firefox on mobile (android) and I've tried Safari on MacOs. I still just prefer Chrome, it's just a bit better. So I use it with third-party cookies turned off, which is easily (and transparently) done using the settings menu. I can also turn off this "related websites" thing. So what exactly is the problem? All major browsers have allowed users to turn off 3P cookies for years.

• by bugtodiffer on 8/30/24, 9:06 AM

  Hey Google, this site is the password change site for Google.

  Is that enough rationale to add this to the list?

• by hashtag-til on 8/29/24, 4:49 PM

  Does this affect non Chrome users?

• by nashashmi on 8/29/24, 5:33 PM

  I always thought that rws was built in with cross site scripting declarations

• by mrwww on 8/30/24, 4:55 AM

  Firefox for mac and firefox focus for iOS is great.

• by cabbageicefruit on 8/29/24, 5:09 PM

  Damn. If there was ever any doubt about why you should get off chrome, this seems to put an end to that.

• by svieira on 8/29/24, 4:32 PM

  > We conducted a user study with 30 Web users, recruited over social media, and presented them each with 20 pairs of websites. Website pairs were randomly selected from both the Related Website Sets list (i.e., sites Google designates as “related”, and so warranting reduced privacy protections), and the Tranco list of popular websites. Each user was presented with different pairs of websites, asked to view the sites, and then decide if they thought the two sites were operated by the same organization. This resulted in 430 determinations of whether unique pairs of websites were related.

  > In our study, the large majority of users (~73%) made at least one incorrect determination of whether two sites were related to each other, and almost half (~42%) of the determinations made during the study (i.e., all determinations from all users) were incorrect. Most concerning, of the cases where both sites were related (according to the RWS feature), users guessed that the sites were unrelated ~37% of the time, meaning that users would have thought Chrome was protecting them when it was not.

  > ... We conclude from this that the premise underlying RWS is fundamentally incorrect; Web users are (understandably, predictably) not able to accurately determine whether two sites are owned by the same organization. And as a result, RWS is reintroducing exactly the kinds of privacy harms that third-party cookies cause.

  > Lest anyone judge the study participants for being uninformed, or not taking the study seriously, consider for yourself: which of the following pairs of sites are related?

  1. hindustantimes.com and healthshots.com

  2. vwo.com and wingify.com

  3. economictimes.com and cricbuzz.com

  4. indiatoday.in and timesofindia.com

  > (For the above quiz, if you chose “4”, then, unfortunately that is incorrect. That is in fact the only pair of the four that isn’t considered “related” to each other.)

• by bradley13 on 8/29/24, 8:18 PM

  tl;dr: Google is evil. The antitrust measures cannot come soon enough.

• by andresp on 8/30/24, 9:17 AM

  Most people here seem to forget that ads is what pays for the free internet services. The main issue with them is not making the consent more explicit to the user. I think the business model: you either get this for free with ads and targeting, or otherwise you have to pay X, should be more common. I bet most people would pick the free option with ads and targeting.