Browsers: "3rd-party cookies are blocked unless you add a P3P header..."
Websites: "Ok. What should be in the header?"
Browsers: "Anything... it doesn't matter. Just add the header then 3rd-party cookies are fine"
Websites: "Ok, we'll just add a P3P header saying 'Ceci n'est pas une P3P header' then. Problem solved."
The problem is, that indication is made with _lack_ of a particular token; and google includes a fake P3P header with no tokens in it. Thus, according to the protocol, google's header indicates that it does not use cookies for anything at all.
Btw, I'm not defending Google, they're clearly not acting perfectly here. I'm simply pointing out that this is a clear case of, "what did you expect to happen?" Any spec that still sets a cookie that is declared as not being used for any purpose seems deeply flawed.
I also found it interesting that Microsoft called out Google and not Facebook, which gives the article a political overtone.
I agree that P3P clearly needs some rethinking to stay relevant. Especially now that the cat's out of the bag on how to bypass it. (Microsoft's immediate response is to set up yet another blacklist system... some cultures just never change.)
For everyone's entertainment, the OP's comments linked to an amusing satire of P3P called P5P, or the "Pretty Please Platform for Participating Publishers." This is possibly the best collection of protocol tokens I have seen since RFC 2324.
I think MS probably needs to acknowledge that P3P is broken, and change the default so it doesn't affect third party cookie acceptance. Administrators for Windows environments that think otherwise can override the default by deploying a group policy.
What do you think about robots.txt then? Isn't that a standard that isn't enforced as well?
Ultimately, P3P comes down to the honor system. Unfortunately, that doesn't work on the internet.
You would not be surprised if a warez program installed a keylogger on your computer, but you hold Google Chrome to a higher standard. Isn't that true for the internet too? Why equate Google to any other site on the internet?
>Ultimately, P3P comes down to the honor system. Unfortunately, that doesn't work on the internet.
Would you say the same thing if you came to know that Google employees are reading your email for fun and profit?
Granted, the standard is written to be abused. On the other hand, Google's behavior is basically "well if you don't say no it's not rape. What, you were bound and gagged at the time? Well nothing I can do about that".