Ask HN: Why Google cookies are exempted when blocking third-party cookies?

https://news.ycombinator.com/item?id=27078077

by jerrygoyal • 5 years ago

82 36 5 years ago

news.ycombinator.com

I disabled third-party cookies option in my chrome browser and yet cookies are being set from google.com and accounts.google.com domain to other sites like upwork.com.

see screenshot: https://i.imgur.com/zEm2r4Y.png

To see for yourself, disable third party cookies in chrome browser -> open upwork.com -> see cookies info.

As per my understanding third-party cookies are those created by domains other than the one the user is visiting at the time. So, why google.com domain cookies are being set on upwork.com?

Update: This issue doesn't happen in Firefox.

livre2• 5 years ago

I can't provide an answer but I can provide a little more info about my tests.

I tried this in Microsoft Edge. They show up as blocked in that "Cookies in use" popup but when you open the inspector and go to the Application tab the cookies are there, not blocked. In Firefox's inspector in the Storage tab those domains don't show any cookies unless explicitly allowed.

Animats• 5 years ago

Because Google doesn't want you to do that.[1]

Use Firefox. The Web works just fine with all Google tracking blocked.

[1] https://fossbytes.com/chrome-doesnt-delete-google-cookies/

jakub_g2• 5 years ago

To be devil's advocate, if someone wants to clear all cookies and still be logged in to Google: it's like eating a cake and having a cake (well, cookie). In Chrome, being logged in to google.com and logged in to Chrome are tightly linked. (If you don't like that, don't use Chrome).

(Of course Google could do the other thing and say "ok since you clear all cookies, we log you out of Chrome, so you lose sync etc." but it's probably _not_ what most people want, nor what Google wants).

oh_sigh• 5 years ago

Why can't google chrome just have a special login cookie? So you need to log in to chrome, but doing so doesn't mean you're logged into your google account.

lolinder• 5 years ago

This is why I use Firefox + Multi-Account Containers. Google and all its services I haven't yet been able to elimiate go in its own container. Google's cookies in all other containers are third-party and so get rejected.

jerrygoyal3• 5 years ago

someone wants to clear all cookies and still be logged in to Google: it's like eating a cake and having a cake (well, cookie)

not sure if this argument is valid here because that third party cookies issue still happens in incognito mode where I'm not logged in to my Google account.

drpixie• 5 years ago

"Don't be evil" ... Well, why not? ... Ba ha ha ha haaaaaa.

olliej2• 5 years ago

When I joined google a few years ago the phrase “don’t be evil” was nowhere in the orientation materials or any official documents.

deepsun• 5 years ago

Do you know if I can use Firefox in multiple "identities". E.g. with chrome I use two windows with different colored themes, one for personal, one for work account. Each has their own tab history and stuff.

I like Firefox but didn't find this feature.

laci27• 5 years ago

You can have multiple identities, just as you can have them in chrome without being logged in. search for Firefox Multi-Account Containers. OR https://support.mozilla.org/en-US/kb/profile-manager-create-... But you can always create a shortcut for each identity...I use this method for Brave.

vuelto• 5 years ago

Not seeing that in Ubuntu Chromium. They actually get blocked in my case. Also Privacy Badger, cause why not... https://privacybadger.org/

jakub_g2• 5 years ago

I don't know the details of the implementation, so I'm theorizing here, but the most important thing is not whether those cookies are set, but whether they can be read e.g. by other browser tabs and other origins. It could be that those cookies are temporarily set, in an isolated way, to avoid breaking things too much. IIRC, there are some heuristics in place and some cookies used for multi-domain Single-Sign-On are allowed (even in Firefox).

martini3332• 5 years ago

Works as expected for me in Chrome 90 https://imgur.com/a/HDxsf5g

jerrygoyal3• 5 years ago

that's strange cause I also used Chrome v90 and I could still see Google cookies even in incognito mode. Could you try after disabling any ad blocker/privacy extensions.

livre2• 5 years ago

That's how it appears to me on Edge but when I open the inspector and go to the Applications tab the cookies are there and haven't actually been blocked. Can you check if that's the case for you too?

martini3332• 5 years ago

I only have cookies from the site.

magicalist• 5 years ago

when I open upwork.com it has 6 iframes in it, including to accounts.google.com/o/oauth2... I'd imagine that's where the cookie goes, not to the parent frame.

You'd need to see which request has the cookie on it, not just which ones were set "when you viewed this page".

flowerlad• 5 years ago

To reduce this kind of abuse I use Edge when visiting Google sites, and Chrome when visiting Microsoft sites.

kiwijamo• 5 years ago

One could simplify that to just Firefox for both properties.

bashinator• 5 years ago

But then what would you use to visit mozilla.org?

FractalHQ2• 5 years ago

What’s wrong with Brave

throwaway77388• 5 years ago

I think there's more, but here are some:

[1] https://github.com/lobsters/lobsters/issues/761

[2] https://github.com/lobsters/lobsters-ansible/issues/45

[3] https://news.ycombinator.com/item?id=18734999

[4] https://web.archive.org/web/20181221180137if_/https://twitte...

[5] https://web.archive.org/web/20181221231556if_/https://twitte...

IshKebab• 5 years ago

Probably because you are logged into Chrome.

jerrygoyal3• 5 years ago

well it's happening in incognito mode too.

insomniacity• 5 years ago

You trusted Google not to track you in Incognito mode?

rualca• 5 years ago

well it's happening in incognito mode too.

You're raising doubts regarding a browser's threat to privacy by stating an observation that depends on blind faith on the same browser not threatening privacy.

tacker2000• 5 years ago

If this bothers you, dont use Chrome, ever. Use Chromium if you really need it and dont want to use Firefox. And get rid of your google account whilst youre at it.

unparagoned• 5 years ago

Use brave if you also want the benefits if a chromium browser

FractalHQ2• 5 years ago

Why no love for Brave around here?

retox• 5 years ago

In Chrome you can disable auto-playing videos on any site except Youtube.

maverick743• 5 years ago

Why not use a Google Container?

https://addons.mozilla.org/en-US/firefox/addon/google-contai...

Oh... you are using Chrome!!! There's no point then. You won't be able to hide from Google no matter what you do!

Firefox + DuckDuckGo is just as good as all that "Googlish" things ;)

maverick743• 5 years ago

For those who REALLY want Chromium-based browsers (Really?!?!?!?)...

Why not use Falkon (falkon.org)?

Ask HN: Why Google cookies are exempted when blocking third-party cookies?

Related Stories