[HN Gopher] Ask HN: Why Google cookies are exempted when blockin...
___________________________________________________________________
Ask HN: Why Google cookies are exempted when blocking third-party
cookies?
I disabled third-party cookies option in my chrome browser and yet
cookies are being set from google.com and accounts.google.com
domain to other sites like upwork.com. see screenshot:
https://i.imgur.com/zEm2r4Y.png To see for yourself, disable third
party cookies in chrome browser -> open upwork.com -> see cookies
info. As per my understanding third-party cookies are those
created by domains other than the one the user is visiting at the
time. So, why google.com domain cookies are being set on
upwork.com? Update: This issue doesn't happen in Firefox.
Author : jerrygoyal
Score : 68 points
Date : 2021-05-07 16:58 UTC (6 hours ago)
| vuelto wrote:
| Not seeing that in Ubuntu Chromium. They actually get blocked in
| my case. Also Privacy Badger, cause why not...
| https://privacybadger.org/
| jakub_g wrote:
| I don't know the details of the implementation, so I'm theorizing
| here, but the most important thing is not whether those cookies
| are set, but whether they can be read e.g. by other browser tabs
| and other origins. It could be that those cookies are temporarily
| set, in an isolated way, to avoid breaking things too much. IIRC,
| there are some heuristics in place and some cookies used for
| multi-domain Single-Sign-On are allowed (even in Firefox).
| martini333 wrote:
| Works as expected for me in Chrome 90 https://imgur.com/a/HDxsf5g
| livre wrote:
| That's how it appears to me on Edge but when I open the
| inspector and go to the Applications tab the cookies are there
| and haven't actually been blocked. Can you check if that's the
| case for you too?
| jerrygoyal wrote:
| that's strange cause I also used Chrome v90 and I could still
| see Google cookies even in incognito mode. Could you try after
| disabling any ad blocker/privacy extensions.
| magicalist wrote:
| when I open upwork.com it has 6 iframes in it, including to
| accounts.google.com/o/oauth2... I'd imagine that's where the
| cookie goes, not to the parent frame.
|
| You'd need to see _which_ request has the cookie on it, not just
| which ones were set "when you viewed this page".
| flowerlad wrote:
| To reduce this kind of abuse I use Edge when visiting Google
| sites, and Chrome when visiting Microsoft sites.
| kiwijamo wrote:
| One could simplify that to just Firefox for both properties.
| livre wrote:
| I can't provide an answer but I can provide a little more info
| about my tests.
|
| I tried this in Microsoft Edge. They show up as blocked in that
| "Cookies in use" popup but when you open the inspector and go to
| the Application tab the cookies are there, not blocked. In
| Firefox's inspector in the Storage tab those domains don't show
| any cookies unless explicitly allowed.
| Animats wrote:
| Because Google doesn't want you to do that.[1]
|
| Use Firefox. The Web works just fine with all Google tracking
| blocked.
|
| [1] https://fossbytes.com/chrome-doesnt-delete-google-cookies/
| jakub_g wrote:
| To be devil's advocate, if someone wants to clear all cookies
| and still be logged in to Google: it's like eating a cake and
| having a cake (well, cookie). In Chrome, being logged in to
| google.com and logged in to Chrome are tightly linked. (If you
| don't like that, don't use Chrome).
|
| (Of course Google could do the other thing and say "ok since
| you clear all cookies, we log you out of Chrome, so you lose
| sync etc." but it's probably _not_ what most people want, nor
| what Google wants).
| oh_sigh wrote:
| Why can't google chrome just have a special login cookie? So
| you need to log in to chrome, but doing so doesn't mean
| you're logged into your google account.
| sneak wrote:
| They used to be separate, but daddy G decided that having
| two separate login states for Google-the-browser and
| Google-the-website was too confusing for our widdle heads.
|
| Oh well. At least it makes it dead-simple for the
| advertising company to track your complete browsing
| history.
|
| PS: Install cookie autodelete, install uBlock origin,
| disable chrome login/sync entirely, and disable "enhanced"
| safe browsing. Block the google domains from loading
| globally on sites in uBlock. Also, and I cannot stress this
| enough: _stop using gmail_. It subjects not only yourself
| to total ad surveillance, but every single person you
| correspond with.
| [deleted]
| IshKebab wrote:
| Probably because you are logged into Chrome.
| jerrygoyal wrote:
| well it's happening in incognito mode too.
| insomniacity wrote:
| You trusted Google not to track you in Incognito mode?
___________________________________________________________________
(page generated 2021-05-07 23:02 UTC)