This should be the central argument the DOJ uses to separate Chrome from Google: The entire web for a monopoly-size portion of users is massively less secure because the web browser is owned by a company which is very vested in it being less secure.
Honestly I’m surprised Google hasn’t offered to buy Truth Social for a few hundred million just to make this little antitrust problem go away.
From TFA: "Until today, Google was still planning to roll out a dialog in Chrome that would prompt users to turn off third-party cookies in favor of Google's updated solution. […] …Google won't be pushing that cookie dialog to users. You can still choose to disable third-party cookies in Chrome, though."
Google is saying they’re fine with no third party cookies. The rest of the industry needs them.
How do you protect user privacy while also not killing googles competitors? Which need is more important?
I'm guessing the reason google doesn't use third party cookies is because they get higher quality data from people being signed in to Google services, and that is independent of whether they are using Chrome or not.
There's no reason they couldn't allow add-ons to do it: but instead with manifest v3 I think it is impossible to do it in a general way isn't it? Like with the other ad-blocking you have to have a hardcoded number of rules you can define for blocking cookies in the requests as well, at least through the declarativeNetRequest API.
Maybe it is possible for through one of the cookies APIs, but the cookie's API has race conditions where the site can still sometimes see them from what I understand and redirects can activate before your extension gets a chance to respond.
And then of course extensions don't even run on mobile and that isn't an accident.
I do disagree with your cause and effect though, they have gotten blocked from replacing third party cookies with privacy sandbox because it replaces a standard everyone can use equally with a Google-controlled system. They could have cited the industry standard to block third party cookies in other browsers and done so without a replacement, the reason they are being prohibited from doing so is because they are motivated to maintain data access for themselves via privacy sandbox.
You can read countless statements from the Chrome team about Privacy Sandbox where they state how vital spying on users for ad targeting is, they've never "wanted" to remove doing so.
Those statements about tracking you're referencing are legal shielding against antitrust suits from adtech competitors.
https://blogs.windows.com/msedgedev/2024/03/05/new-privacy-p...
I guess that was going to be too insane to actually manage.
Google scraps plan to remove third-party cookies from Chrome (26 points, 9 months ago, 3 comments) https://news.ycombinator.com/item?id=41046637
Chrome is entrenching third-party cookies that will mislead users (511 points, 8 months ago, 311 comments) https://news.ycombinator.com/item?id=41391412
What Google's U-Turn on Third-Party Cookies Means for Chrome Privacy (3 points, 7 months ago) https://news.ycombinator.com/item?id=41788239
chrome://settings/cookies
Aren't all cookies trivially "any-party" cookies? Can't any form of persistence be used to track a user? 3rd-party cookies as they exist today just give a path of least resistance so that most of that behavior is implemented the same way. Consistent implementation allows the user a simple way to block that behavior.
legitster•3h ago
Cookies are much maligned these days, but to defend them a little bit - the alternatives are almost universally worse for user privacy. Persistent session storage? Browser fingerprinting? Locking everything behind a user account with mandatory sign-in? Blegh.
On the other hand, cookies are a pretty transparent interaction. It's a tiny file that sites in your browser. You can look at them. They expire on their own. You as a user can delete, modity, edit, hack them to your heart's content. They contain no PII on their own. They are old-fashioned and limited and that's a good thing.
The real problem here is not the cookie - it's the third party data networks. I would much rather focus our ire on the function rather than the form.
tmpz22•3h ago
devrandoom•2h ago
Henchman21•2h ago
matthewdgreen•2h ago
orangecat•2h ago
timewizard•1h ago
Likewise "autoplay blocking" isn't too hard to overcome. It's more out of politeness that it's ever honored.
zmmmmm•2h ago
But third party cookies are a lot more insidious, because they get sent without any visibility to the user and have generally peripheral relevance to the application they are using. It's like if you go to the supermarket and they ask you if you want to sign up for a loyalty card and you say yes, vs you go to the supermarket and they secretly plant trackers on you so that when you go to other shops they can tell who you are. One is a lot worse than the other.
frollogaston•2h ago
ferngodfather•2h ago
paulryanrogers•2h ago
frollogaston•1h ago
winrid•32m ago
asddubs•2h ago
AlienRobot•1h ago
Any website can add Google Analytics by copy and pasting 1 line of code. To avoid this cookie, you need to have your own analytics web app. This makes sense for medium-size websites, but if you have a small website your host will probably bill it as a separate website.
First-party comments? Now you need your own comment system, which means you have a long list of responsibilities that you simply wouldn't have if you just used Disqus or Facebook comments. All those spam links to virulent sites will be on your servers now.
Honestly, the Internet would be a much more awesome place if 3P cookies were the norm and everyone was okay with embedding everything everywhere. In the past hotlinking was a problem due to bandwidth concerns, but nowadays most of the traffic is bots anyway so it would be a drop in the bucket.
bawolff•1h ago
rukuu001•2h ago
pests•2h ago
rukuu001•42m ago
meattle•46m ago
Buttons840•2h ago
This is not true in practice though. Cryptography means they cannot be altered (or even read) if their creator doesn't want them to be altered. Of all the CRUD operations, users can only realiably delete the cookie.
NBJack•56m ago
zeroCalories•44m ago
rileymat2•33m ago
nicce•2h ago
I have been looking them and yes, in 50 years…