Google has plans to deprecate cookies over http

To be fair, the evil bit's a great idea; it just failed to get much support from the malware developer community.

They want them to last for less time. Perhaps that's the right word.

One of my earliest memories of professional programming was talking to another dev, many years my senior in experience, about a "deprecated" API. They insisted the word was "depreciated". I didn't push it for the conversation, but afterwards triple-double-checked I wasn't crazy. Nearly 20 years later, I still feel I might be using the word wrong.

Yes.

Speaking with some amount of experience working with people on that team: his role at Google is precisely what you see him doing here—deprecating insecure fundamental components of the web.

A proposal like this wouldn't have been approved for public release if the rest of the Chromium security team didn't see merit to it.

Everyone keeps calling him "some guy." Mike West is attached to a number of similar RFCs.

That all being said, I wouldn't immediately discount the idea even if it only turns out to be a research exercise.

See the Intent to Deprecate on blink-dev: https://groups.google.com/a/chromium.org/d/msg/blink-dev/r0U...

This went to blink-dev: https://groups.google.com/a/chromium.org/forum/m/#!topic/bli...

I’m not familiar with their workflow but it looks like something that the development team is considering, not random babbling from a random employee.

This is the background explainer for "Intent to Deprecate: Nonsecurely delivered cookies", from the official Blink mailing list ( https://groups.google.com/a/chromium.org/forum/#!topic/blink...).

Technically yes, it's the Blink team that has plans to deprecate, but that is effectively Google.

next step: disable javascript