We have mixed feelings about this. Most people could probably figure out that google.com and google.co.uk are owned by the same entity. And probably many people are aware that youtube.com and google.com are related. But some entities own hundreds of domain names with no clear lexical relationship. I doubt a lot of people would expect TechCrunch.com and huffpost.com to be related and would not really expect to be tracked between the two. So common ownership might not be enough to give users a reasonable expectation of a cross-site relationship.
Also, a tracking service could just ask to be CNAMEd to a random subdomain and become everybody’s “first party”, couldn’t it?
It could, but access through these various CNAMEs would not give it stateful cross-site tracking ability, since each would be a different Origin. It would be providing a hosted first-party analytics/ads/whatever service within the storage space of the first party.
Additionally, people who own the sites can use them together via methods like this, while third parties will have a more difficult time. Bravo.
This has been a feature of Adobe Analytics for over a decade. Google Analytics doesn't currently offer this as a feature, but some enterprising individuals have explored how to hack it in after ITP 2.1 was announced.
Re:WebKit Tracking Prevention Policy
by specialist on Thursday August 15, 2019 @09:25AM
(#20704940)
"We have mixed feelings about this."
No need.
Anyone choosing to mix and match also has the resources for some minor duplication of effort.
Or they could just do it all service side.
I think that's a problem for companies that owns multiple domains and want to track users between those. Browsers shouldn't have to help with that, but rather implement the most simple and efficient way of protecting their users, as long as it doesn't make the users' life more complicated. That's what should matter: users, not companies.
How to know when unrelated domains are actually part of the same site is a hard problem. The Public-suffix List approach works okay-ish for cookies, but no one's really happy enough with it to trust for riskier features, and it doesn't help organizations with multiple names (apple.com and icloud.com, google.com and youtube.com, facebook.com and fb.com, etc). As that example list shows at least two major browser vendors have a vested interest in making this work while preserving security.
One conversation-starter folks are discussing is https://github.com/mikewest/first-party-sets
Re:WebKit Tracking Prevention Policy
by w1nst0nsm1th on Thursday August 15, 2019 @02:22PM
(#20708106)
coca-cola.dev is not owned by Coca-Cola, even if coca-cola.be, cocacola.be, cocacola.fr and coca-cola.fr is owned by Coca-Cola.
The same way with bosch.com and bosch.dev. One is a famous tools manufacturer, the other is a web developer.
It is impossible to guess the entity behind domain names by only the domain name.
A third party is any party that does not fall within the definition of first party above.
This policy doesn't distinguish between companies that own multiple top level domains. I understand that it may be technically hard to figure out but at the policy level are two domains owned by one company really third party to each other?
Are example.com and example.us really always different first parties? What about apple.com and iCloud.com? Or those redirect chains that happen after logging into google such that login cookies are set on youtube.com and whatnot?
It does say 'in practice' but I feel like this is mistaking a technical limitation that it's hard to know if two TLD's are controlled by the same legal entity for a policy.