If this is really about protecting users and not about kneecapping web apps shouldn't Apple also wipe user data in native apps that haven't been used in a week?

Outside privacy issues; visiting a website once shouldn't be enough for a website to store as much data as it wants on someone's computer.

Installing a native app is a stronger form of opt-in than simply clicking an URL to a new website.

Chromium (and derivatives such as Edge) allows users to install web apps. You're right that such a facility could be used as a signal for webkit that a particular site's IDB data should be retained for longer than a week.

> install web apps

That's what a PWA is :). Browsers should lift these restrictions for installed PWAs, and probably do.

The browser under discussion in TFA doesn't have PWAs as such. [0] Of course I agree with your restatement of what I said browsers should do upthread. b^)

[0] https://caniuse.com/#search=beforeinstallprompt

Safari still lets you add a web app to the homescreen, though. It could be used as a signal.

Yeah it seems they are encouraging that as a solution. Unless I’m misunderstanding.

“ Web applications added to the home screen are not part of Safari and thus have their own counter of days of use. Their days of use will match actual use of the web application which resets the timer. We do not expect the first-party in such a web application to have its website data deleted.

If your web application does experience website data deletion, please let us know since we would consider it a serious bug. It is not the intention of Intelligent Tracking Prevention to delete website data for first parties in web applications.”

Was that section originally in TFA? It's encouraging, but it certainly contradicts claims that this will only be applied to "3rd party" stuff in iframes...

Native apps don't really have the problem of third-party ad networks storing data intermixed with app data in this way, though.

The regular reports about tracking in random advertising/... SDKs suggest otherwise

Why not though? It seems like third-party SDKs could be included by the developer and stored on my local device.

Every iOS app I ever built for a client had Facebook's SDK and tracking installed, at the client's request. Often Google's and Twitter's too and the user has no awareness of this.

They are much worse.

The seven day wipe is going to encourage further adoption of Facebook or Google centralized logins, since this flow makes state restoration after a cookie wipe least painful. (Even saved login-passwords combinations can become de-synchronized between devices.) I don't think the theoretical benefits of enhanced privacy are worth the concrete costs of internet centralization.

First-party cookies aren't on the list of affected storage, are they?

https://webkit.org/blog/8613/intelligent-tracking-prevention... already limited 1st party cookies set from JS to 7d.

This post is about them extending it to all storage set from JS.

However any cookies set via HTTP, like http secureonly cookies that tend to be used for logging in, are exempt from that seven day limit.

Correct.

I expect companies will start working around this with CNAMEing and proxying, and I'm curious how Apple will handle it.

I would expect the end game of this would be advertising networks injecting content directly into the page as it's rendered on the webserver. If they want tracking, at some point they'll just ask companies to hand over their logs…

Yes. Or sites just CNAMEing entirely over to their ad network, which then proxies the page content and inserts ads. Which are then, as a side effect, are very difficult to block.

And since they can easily correlate logs server side, they can track people between sites.

Oh my, what a grim vision of the future. I'm going to stop recommending ad blockers, on the theory that I don't have to be faster than the bear...

I suspect the EU will just outlaw that kind of collaboration.

I think this is the eventual goal from tracking prevention's side.

Yeah, that seems potentially destructive for apps that want users to have a local only copy. You would need to provide a full import / export option in case someone goes on vacation.

95% of my regularly used websites and applications have had usage gaps that have reached a week.