News for hackers. Stuff that matters.
Re:Full third-party cookie blocking and more by dfabulich on Tuesday March 24, 2020 @03:57PM (#22678337)
That is what it means. The only workaround is to require the user to login and to keep a backup of the data on your server.
Re:Full third-party cookie blocking and more by tempestn on Wednesday March 25, 2020 @01:11AM (#22682098)
Exactly. Which to me suggests this could result in more tracking rather than less. At AutoTempest we haven't even bothered to make user accounts thus far, since there's no reason why you should need an account to search for used cars, and we can store user preferences in cookies or localStorage. If those only persist for 7 days though, we're basically forced to have users create accounts and store their preferences on our servers, to avoid a poor user experience.

Blocking 3rd party cookies I'm fully on board with, but I don't want first party cookies deleted unless I actually specify it. Fortunately as a user I can keep using Firefox, but since iOS is always going to be a large percentage of our users, there's not much choice on the provider side.

Re:Full third-party cookie blocking and more by dillondoyle on Tuesday March 24, 2020 @04:27PM (#22678620)
This is what we do. Store a 1st party httponly secure cookie jwt representing the user, then grab any extra data from the backend. Or just something like session cookie but persist it.

I wouldn't be surprised if this is one of the ways ad tracking tries to rebuild a universal identifier like the old urchin module. Might not be as easy as a cname but those might get blocked. It's always a game of cat and mouse. Could place uuid as 1st party httponly cookie. maybe uuid is domain scoped. then 'echo out' so accessible by 3rd party JS. Like a hash, one would need to know the global pooled uuid already and then combined with knowable domain could tie that uuid into the 2nd party tracking pool.

Re:Full third-party cookie blocking and more by dfabulich on Tuesday March 24, 2020 @05:28PM (#22679220)
1st party httponly secure cookies will be erased in seven days.

You need the user to manually provide an identifier (i.e. login) to avoid losing everything.

The user's password safe is now the only non-volatile storage mechanism on Safari.

Re:Full third-party cookie blocking and more by shakna on Tuesday March 24, 2020 @09:44PM (#22681211)
> 1st party httponly secure cookies will be erased in seven days.

httponly cookies can't be set from JS, and the seven day erasure only applies to cookies set from JS. That's why they're the recommended method for keeping a user logged in.

Re:Full third-party cookie blocking and more by johncolanduoni on Tuesday March 24, 2020 @06:10PM (#22679613)
They explicitly say 1st party httponly secure cookies are exempt and are their first recommended alternative.