News for hackers. Stuff that matters.
Re:Proposal: Treat FLoC as a security concern by jffry on Sunday April 18, 2021 @06:23PM (#26857065)
Third party cookies, love them or hate them, have been with us for a long time, and simply dropping them would not be viable without the long phase out. And a long phase out is not something around which you can form a singular rallying cry.

FLoC is a new thing which is just being rolled out, so it's a lot easier for people to resist adding a new thing that makes the internet more crappy and less private.

I think it's unnecessarily fatalist to say that all of this will continue to happen so what's the point of resisting it. Public awareness and negative opinion of the pervasiveness and creepiness of internet tracking continues to grow, and advocacy against tracking mechanisms helps create the type of groundswell which could actually shift public policy to forbid such tracking.

Google specifically is catching some heat for potential antitrust problems, so raising a ruckus about Google abusing its dominant browser position to cram FLoC into the internet is more likely to have positive effect than ever before.

Re:Proposal: Treat FLoC as a security concern by tomxor on Sunday April 18, 2021 @08:53PM (#26858125)
> Third party cookies, love them or hate them, have been with us for a long time, and simply dropping them would not be viable without the long phase out.

Not true, FireFox and Safari have had them off by default for over a year now. Additionally Chrome had planned to turn them off last year but then cried "covid" which for some reason = delay... because... think of the adverts! i mean covid!

Anyway, I'm pretty sure any large websites relying on 3rd party cookies for functionality will have already experienced users blocking issues. We have and have already been forced to change, we don't do ads, but our use case is a bit esoteric in that it needed 3rd party cookies for sessions.

Re:Proposal: Treat FLoC as a security concern by surround on Monday April 19, 2021 @12:38AM (#26859150)
> Not true, FireFox and Safari have had them off by default for over a year now.

Not quite. They will block some 3rd party tracking cookies that fall on their tracking blacklist. If you want to block all 3rd party cookies you have to explicitly disable them.

Re:Proposal: Treat FLoC as a security concern by om2 on Monday April 19, 2021 @02:39AM (#26859709)
Safari does actually block all third party cookies by default, not just a subset. And has been doing so for about a year now.
Re:Proposal: Treat FLoC as a security concern by mk81 on Monday April 19, 2021 @08:24AM (#26861933)
If I understand correctly, they allow 3rd-party cookies but delete them at the end of the browsing session rather than respecting the expiry.
Re:Proposal: Treat FLoC as a security concern by hirsin on Sunday April 18, 2021 @10:05PM (#26858498)
Care to reach out? This username at Microsoft.

We're working to understand what legitimate use cases are broken without 3p cookies so we can work with Google to backfill them. FLOC helps ad trackers track but doesn't help with any of the legitimate uses of 3p cookies like auth.

Re:Proposal: Treat FLoC as a security concern by livre on Sunday April 18, 2021 @10:36PM (#26858642)
Since you seem to work for Microsoft, the broken use case I know: without 3p cookies Microsoft Teams is broken (it shows a not very useful error page asking to refresh the page, when you do it shows the same error again). Many of us need it for remote work so I guess this one of the things Google had in mind when they delayed disabling 3p cookies by default.
Re:Proposal: Treat FLoC as a security concern by hirsin on Monday April 19, 2021 @11:35AM (#26863929)
Yes, Teams relies on silent auth from within an iframe (all those chat windows etc). This is impossible without 3p cookies, so we're working with Google to find a solution. Storage access API in Safari works, but sounds like it won't make it to Chrome.
Re:Proposal: Treat FLoC as a security concern by livre on Monday April 19, 2021 @06:25PM (#26868581)
Thanks, nice to know you are working on it.
Re:Proposal: Treat FLoC as a security concern by pabs3 on Sunday April 18, 2021 @10:11PM (#26858538)
Auth should be doable with just redirects though right? Isn't that how OAuth and OpenID connect work?
Re:Proposal: Treat FLoC as a security concern by catlifeonmars on Sunday April 18, 2021 @11:27PM (#26858864)
Same thought. I’m curious to know what other kinds of authentication protocols require third-party cookies to operate. Within OIDC, even more obscure/advanced features such as session management and global logout require only 1st party (the IdPs) cookies in order to function.

I guess the tradeoff being made here is just leaning into our reliance on the certificate authority system. Whereas before, with third party cookies, you might have had more flexibility with how you structure your domains.

Re:Proposal: Treat FLoC as a security concern by hirsin on Monday April 19, 2021 @11:36AM (#26863945)
The implicit grant, while deprecated, is still used across the ecosystem. Further, embedded apps (eg you have a portal that iframes Salesforce and Salesforce needs to be authenticated) can't redirect to the login page or open that iframe for cookies.

Front channel logout is also broken, part of the OIDC spec. It opens iframes to sites, but the sites don't get their cookies and can't write them.

Re:Proposal: Treat FLoC as a security concern by om2 on Monday April 19, 2021 @02:41AM (#26859722)
OAuth sometimes is done using an iframe and a pop-up window instead of by navigating to the federated auth provider and back. That version often needs third party cookies.
Re:Proposal: Treat FLoC as a security concern by jffry on Sunday April 18, 2021 @10:07PM (#26858511)
Sure, I suppose all that (waves hand at third-party cookies situation) is what I meant by the long phase out of them. As far as I can recall those defaults were signaled a fair amount of time in advance.

I have sympathy for anybody with a legitimate use for third-party cookies whose life has been made more difficult by bad actors abusing features to maximise their own profits.

Same tragedy that finally caused origin-based cache partitioning at the expense of some performance.

Re:Proposal: Treat FLoC as a security concern by propogandist on Monday April 19, 2021 @02:48PM (#26866518)
this is the same execuse facebook's been using, although they're trying to push the narrative that limited tracking in Apple's iOs 14+ "hurts Small Business!"

https://twitter.com/jason_kint/status/1383391849902075911 (video in thread)

Re:Proposal: Treat FLoC as a security concern by rtpg on Sunday April 18, 2021 @08:59PM (#26858152)
Another thing is that third-party cookies can actually offer real functionality that has nothing to do with advertising (for example platforms like Salesforce let you integrate your own offering into a Salesforce users' system, and third-party cookies can be a pretty straightforward way of accomplishing that).

I don't see really any non-tracking reason for FLoC

Re:Proposal: Treat FLoC as a security concern by throw4592745 on Sunday April 18, 2021 @07:26PM (#26857543)
I have 3rd party cookies off. The only thing I have seen requiring 3rd party cookies in the last year is Microsoft when I had to use teams.
Re:Proposal: Treat FLoC as a security concern by izacus on Monday April 19, 2021 @03:37AM (#26860011)
> FLoC is a new thing which is just being rolled out, so it's a lot easier for people to resist adding a new thing that makes the internet more crappy and less private.

What exactly about FLoC is making the internet less private though? Every time I see the technology it seems that it's deliberately built to keep private data in your Chrome browser and leak significantly less than anything else Ad related right now.

Also, why is WordPress allowing so many ad and anlytics tracking plugins and not considering those as security issues?

Re:Proposal: Treat FLoC as a security concern by slver on Sunday April 18, 2021 @06:29PM (#26857109)
If you have figured out a way to eliminate tracking, be my guest. Mozilla would like to know, Apple would like to know. Until then FLoC attracts attention because it's new, yes, this explains our reaction. It's still an irrational reaction.

Also what's this "predatory targeting of unsophisticated consumers" about? You don't need targeting for this. Heck you don't need anything for this. The way it's usually carried out is you hack some sites and redirect them to you landing page about "this one magic trick to riches, banks hate her".

Re:Proposal: Treat FLoC as a security concern by jffry on Sunday April 18, 2021 @10:11PM (#26858537)
Mozilla at least has done plenty of things to reduce the effectiveness and scope of tracking on the web.

Just because we can't create an ironclad solution doesn't mean that there isn't real value in reducing the usable surface area for profiling and tracking users across the web.

FLoC is an additional means of tracking users that is presently being pushed by a giant corporation who controls a significant web browser, of course anybody who is pro-user-privacy would rail against its rollout. It's ridiculous to call that an irrational reaction.

Re:Proposal: Treat FLoC as a security concern by om2 on Monday April 19, 2021 @02:45AM (#26859743)
Apple is doing just fine on greatly reducing tracking, and we don’t think FLoC or anything much like it is necessary. Safari already blocks 3P cookies by default and has done so for a year.
Re:Proposal: Treat FLoC as a security concern by salawat on Sunday April 18, 2021 @07:06PM (#26857392)
So you're the one who keeps doing that, or is it a group thing?

Just curious. It undoubtedly works, but I've always wondered why it's so pervasive.

Re:Proposal: Treat FLoC as a security concern by slver on Monday April 19, 2021 @12:44AM (#26859188)
Congratulations, you win a free iPhone.