To download from Google Drive, you must enable third party cookies?

https://support.google.com/drive/answer/2423534?hl=en&co=GENIE.Platform%3DDesktop

by seydor • 4 years ago

387 157 4 years ago

support.google.com

dvfjsdhgfv2• 4 years ago

Seems like in this particular case, notwithstanding Google's long history of abuse and opportunism, this one is a genuine case when you enable a cookie for technical and not (necessarily) user tracking reasons.

thih9• 4 years ago

Is it certain that Google will not use these (i.e. cookies enabled for technical reasons) also for tracking?

Some companies are requesting permissions for more or less valid reasons and later using these permissions for their own goals as well.

robertlagrant2• 4 years ago

There's no need to use cookies for this when they control the backend. They know you're accessing a file because their server had to authenticate you.

kevin_thibedeau• 4 years ago

It's just another dark pattern their middle management cooks up under the guise of legitimacy.

dvfjsdhgfv2• 4 years ago

In other cases - yes. In this one - not necessarily. The content itself is hosted on a different domain and for a good reason. Most importantly though, they don't need another cookie to track you: you are already there, they know who you are, they know you already requested a resource, and they can track you over all Google services and many others anyway. They don't need to use a dirty trick to send you an additional cookie although the very fact that we're having the discussion means Firefox made a good decision and hopefully people will notice this pattern more.

rpadovani5• 4 years ago

I think it is because they use `googleusercontent.com` for content uploaded by users - that makes sense for security reasons, never ever let users upload content to your main domain.

celdon25• 4 years ago

Can you elaborate on this? What's special about the domain here for security?

rpadovani5• 4 years ago

It's a defense in depth mechanism: when you allow user-generated content uploaded on your main domain, somebody will find a way to break your security system and make that content executable on the user's browser.

When doing so, an attacker can steal cookies, and/or invoke APIs for the user.

Now, there are of course ways to avoid that, but in the end, if every other system fails, being on a domain without any API and without any sensitive content allows reducing the blast of the impact.

Real-world example: https://gitlab.com/gitlab-org/gitlab/-/issues/200094

GitLab has APIs under their main domain. Due to a misconfiguration, it was possible to render in the browser user-generated `.svg` files. Thus, a malicious crafted SVG file could bring to a XSS, and accessing a lot of personal user data on the main domain.

There are technical reasons for the shared domain, but if that particular API call was on another domain, the impact of the vulnerability would have been way smaller.

TobTobXX• 4 years ago

Also, malware detection algorithms decrease their rating for the google.com domain when they encounter malicious content on this domain. Probably not an issue for google specifically, as they themselves control this list for Chrome, but for other companies this might be relevant too.

est• 4 years ago

Maybe we could categorize cookie's party by domain's whois record?

rpadovani5• 4 years ago

Unfeasible.

Whois data are heavily redacted, and not really checked upon, so you have two problems:

* you have access only to redacted data;

* and also if you had access to original data, they are basically free form text;

jabiko• 4 years ago

I'm wondering why the information necessary for downloading the file can't just be encoded as a URL parameter.

When the user clicks a file download link it should be possible to generate a short lived token that authenticates the user against googleusercontent.com.

ratww• 4 years ago

That's quite easy to do with Amazon S3. Maybe Google could just use AWS since implementing this feature seems to be a bit complex for them. /s

newscracker• 4 years ago

If you’re anyway using Google Drive, you could use Firefox with the Google Container extension [1] to limit Google’s tracking activities across Google tabs to this container. Also install Cookie AutoDelete [2] and let the cookies, cache, local storage, etc., get cleared soon after you close the tabs.

[1] https://addons.mozilla.org/en-US/firefox/addon/google-contai...

[2] https://addons.mozilla.org/en-US/firefox/addon/cookie-autode...

giancarlostoro2• 4 years ago

Honestly anyone concerned about a Chrome / WebKit browser monopoly needs to use Firefox now if you already are not.

sneak3• 4 years ago

I don't see any problems with a monoculture of rendering engine.

Browser (and features, especially privacy ones), absolutely. Renderer, not so much.

oxff• 4 years ago

Can't do that when Firefox simply isn't good enough. Vivaldi beats it in features and what I need from browser as a power-user.

zmxz2• 4 years ago

I'd love to, but it's simply unusable compared to Chrome when it comes to web development.

rpastuszak• 4 years ago

At this stage, I think we can draw a line between WebKit and Blink, so even having more WebKit based browsers would be a welcome change.

I'd still prefer to see a mainstream Gecko based browser, of course! I think outside of the tech crowd FF is pretty niche.

Forgeties792• 4 years ago

What are your thoughts on brave browser? I’ve used it over firefox for about two years now and I really enjoy it.

LinAGKar• 4 years ago

That's not really usable until they fix the issue where it wipes the tabs history.

GTP2• 4 years ago

And from their solution:

"Type chrome://settings/cookies in the browser address bar"

I love how they assume everybody uses Chrome.

jefftk14• 4 years ago

It's only broken on Chrome, though. In Safari it works fine without third party cookies.

GTP2• 4 years ago

This is interesting, are you sure your browser isn't making an exception for google drive?

NicuCalcea• 4 years ago

It's broken in Firefox for me.

krono• 4 years ago

As far as I'm aware no browser offers granular third-party cookie permission controls - e.g. allow third-party cookies from `googleusercontent.com` but only on `drive.google.com`.

throwaway294566• 4 years ago

Firefox with uMatrix can do that.

lapinot• 4 years ago

Or ublock origin, in advanced mode. I took time to transition away from umatrix and i miss the interface but it's fine.

whywhywhywhy• 4 years ago

Wasted a lot of time trying to figure this one out a few months ago.

wanderingmind2• 4 years ago

If using linux or mac, just FUSE mount with rclone. If you need more privacy,load the mount with encryption so google has no idea about the files you are working with.

wbecher• 4 years ago

I was going to write just this! rclone is a lifesaver!

ronjouch• 4 years ago

Thank you and thanks wanderingmind for sharing this! I knew rclone, but didn't know you you could pair it with a fuse mount! Looks like an awwwwwesome addition to the toolbelt :))))

haunter• 4 years ago

That’s not limited to Linux or macOS at all, works perfectly under Windows too

wanderingmind2• 4 years ago

Thanks for that info. Haven't used windows in a long time, so did not want to post of something I'm not sure.

jefftk14• 4 years ago

This is wrong: try downloading something with Safari, which blocks third party cookies by default, and it works fine.

Instead, the problem is that downloading from Google Drive is using User-Agent sniffing to determine whether third party cookies are expected to be enabled, and choosing between implementations.

(Disclosure: I used to work at Google, but I don't know anything internal on this)

nottorp2• 4 years ago

Or Safari has an exception for google cookies.

jefftk14• 4 years ago

If you open developer tools you can see cookies aren't being sent.

Nextgrid2• 4 years ago

Oh wow - so while there was a non-malicious explanation in another comment (https://news.ycombinator.com/item?id=32149130), this clearly looks like malicious behavior.

They're relying on the fact that most browsers lack per-domain cookie controls to force Google Drive users to allow third-party cookies knowing full well the majority won't remember (or bother) to disable them after.

jefftk14• 4 years ago

The explanation in the other comment is also correct. When you go from drive.google.com to googleusercontent.com to download a file, this historically worked by using third-party cookies to verify that you were authorized to download the file. When Safari dropped support for third-party cookies they added a new flow which uses link decoration instead, but only use this flow when they think the browser doesn't support third-party cookies. Their "does this browser do third-party cookies" logic isn't very good, and doesn't handle Chrome without third-party cookies.

I'm not sure why they don't use the new flow for everyone. My guess is that it's less secure? Maybe that if the link they generate is shared it gives access beyond what the original owner chose to share?

kretor• 4 years ago

What browsers lack per-domain cookie controls?

II2II• 4 years ago

I'm not sure if blocking third party cookies is the cause, but I have had difficulty downloading files under Firefox. Disabling third party cookies is one of the first settings I enable after installing Firefox.

I would not be surprised if Apple makes an exception for Google.

jefftk14• 4 years ago

I would not be surprised if Apple makes an exception for Google.

Apple doesn't, which you can verify with developer tools in Safari.

ajvs3• 4 years ago

No point disabling them now due to Total Cookie Protection by the way. All 3rd-party cookies are isolated to the 1st-party domain they're obtained from.

mynameismon• 4 years ago

I don't think this is the issue. I use Vivaldi, blocking third party cookies by default, and I was unable to download before I disabled third party cookies temporarily.

jefftk14• 4 years ago

Vivaldi pretends to be Chrome: https://vivaldi.com/blog/user-agent-changes/

Ideally they would be using feature detection to check whether third-party cookies are supported, but I think it's UA sniffing (possibly because this is a slow feature to check through behavior?)

lelandfe• 4 years ago

If you mock your UA string in Chrome, does downloading work like Safari?

seydor• 4 years ago

How is it wrong? And if safari does it without cookies, why not chrome?

Chrome is used by 65% of people, safari ~15% (<10% on desktop)

Quarrelsome• 4 years ago

I believe they're suggesting some code is executed based on the user agent. So Safari gets treated differently. Safari is defacto zero 3rd party cookies but Chrome isn't which is possibly why that site is treating them different.

dheera• 4 years ago

Yeah, so all you need to do is ask Chrome to report a Safari User-Agent.

jmprspret• 4 years ago

Not sure if it's still the case, but a while back google docs complained that because I wasn't using chrome some features weren't supported. After changing my UA to chrome, the banner dissapeared and as far as I remember the features it said were "unsupported" worked fine.

dethos• 4 years ago

I've faced this problem in the past and it is really annoying. One of the many reasons why I dislike this service and try to avoid it as much as possible.

nottorp2• 4 years ago

Google container for Firefox :)

You're screwed on iOS though.

mig39• 4 years ago

Doesn't require 3rd party cookies on iOS or Safari on MacOS.

Pakdef• 4 years ago

So, could you just spoof your user-agent on Linux/Windows for an Apple one?

btdmaster• 4 years ago

yt-dlp works fine last I tried!

ninju• 4 years ago

The title is tad incomplete.

You need to enable 3rd party cookies ONLY FOR the drive endpoint, *drive.google.com*. You can whitelist which endpoints are permitted.

They way the title is written it gave me the impression that you needed to enable 3rd party cookies globally (which is incorrect)

zagrebian2• 4 years ago

Are third-party cookies cross-origin or cross-site?

FateOfNations• 4 years ago

They specifically need to set a cookie so that googleusercontent.com knows who you are when you click a link on drive.google.com to download a file.

0xbadcafebee• 4 years ago

Google pre-emptively setting its services up to fail and be sunset. If they keep this up maybe they can sunset services before they even launch

martini333• 4 years ago

Why not enable [*.]googleusercontent.com instead?

iknownothow• 4 years ago

Pro tip: If you want to download an image or pdf, Drive will still let you print, so you can print it to file as a PDF.

Animats• 4 years ago

What happens with curl?

password4321• 4 years ago

The workaround: Preview, ⋮ > Open in new window, Download

istillwritecode• 4 years ago

You need third party cookies even if is shared with anyone who has the link. This is not about authentication.

To download from Google Drive, you must enable third party cookies?

Related Stories