News for hackers. Stuff that matters.

A comment on Firefox rolls out Total Cookie Protection by default to more users (2022). Parent comment

Re:Firefox rolls out Total Cookie Protection by default to m... by immibis on Thursday August 29, 2024 @03:17PM (#41394343)
Yes, that's right. You can't steal credentials from another site without their permission.
[ Parent | on HN ]
Re:Firefox rolls out Total Cookie Protection by default to m... by andrewmcwatters on Thursday August 29, 2024 @03:52PM (#41394642)
No... that's not how that mechanism was ever used. The authentication flow I'm describing was used by companies to embed login flows for functionality that was delivered by iframe as companion behavior next to the first-party site.
[ Parent | on HN ]
Re:Firefox rolls out Total Cookie Protection by default to m... by moi2388 on Friday August 30, 2024 @02:11AM (#41398108)
OAuth. If you take Google as example, You let them sign in with Google through OAuth and then query the user data through the APIs. On-behalf-of/authorization code grant flow.

You can’t do an iframe, but you can still get the data if it’s supported by their api and yours.

Which is the way it should be, imo.

[ Parent | on HN ]