Hacker News Reader

Comment by amelius | Hacker News Reader

Shouldn't a browser not send cookies when the request comes from a different domain? That would seem like the most sensible solution to me. Unless somebody can show a caveat of course.

View on HN

This is exactly what the "block third-party cookies" option does. It really should be enabled per default, possibly with a permission prompt for cases where they are useful.

The interesting thing here is that third-party cookies usually allow a central site (e.g. an ad server) to track a user across many other sites. It's almost the other way around here: "other sites" can track status on a "central site".

I didn't know this option exists. Thanks. I enabled the option and indeed, this social media fingerprint stopped working :)

I believe that cross-site scripting [0] can be used to get around domain restrictions.

[0] https://en.wikipedia.org/wiki/Cross-site_scripting

[1] (This is not my area of expertise. If I'm not correct... please let me know!)

That requires exploiting an XSS vulnerability in the target domain however. Such vulnerabilities are sadly common, but can be prevented.

No, that's not really related. Cross-site scripting's name comes from the vulnerabilities which allow an attacker to insert a <script> tag pointing at a script on another domain (or an inline script). It doesn't have to do with cookies and doesn't get around or really interact with the "block 3rd party cookies" setting.

Reply on news.ycombinator.com