W3C slaps down Google's proposal to treat multiple domains as same origin

Re:W3C slaps down Google's proposal to treat multiple domain... by mwexler on Friday April 09, 2021 @09:52AM (#26750580)

I'm not sure I understand. In the year 2000, we let any domain get access to it's cookie. In this proposal, an entity can let domains it controls have access to a shared cookie, all others are still blocked. But fair point: if I am allowed to say that I have a "relationship" with eviltracker.com, then they could get the shared cookie... But it's easy to add requirements like ownership vs partnership, or purpose-based access, or other enhancements.

So, not really as bad as you suggest, but true, some problem cases can arise.

[ Parent | on HN ]

Re:W3C slaps down Google's proposal to treat multiple domain... by dmitriid on Friday April 09, 2021 @10:10AM (#26750785)

> But it's easy to add requirements like ownership vs partnership

Ah, yes. "Easy".

How exactly do you envision that?

- Is ownership/partnership info easily and immediately accessible?

- Who is going to verify ownership/partnership info?

- How is that applicable to First Party Sets?

- LVMH owns at least 75 different brands. Even though it owns them, for all intents and purposes these are different legal entities and (especially under GDPR, CCPA and any other privacy law in existence) they cannot be treated as a single entity.

- amazon.com and amazon.de are two separate legal entities with wildly different privacy requirements. Same goes to subdivisions in each of the 75 brands I mentioned for LVMH.

and so on.

Yes. Easy.

[ Parent | on HN ]