As much as third party cookies are dangerous and unnecessary in a personal browsing setting, they are unfortunately a fact of life in the wonderful world of enterprise. that embedded Salesforce widget inside the SAP module of the Atlassian tool runs on a toxic mix of iframes and single-sign-on, and no-one in the company wants to have to go and rewrite it because someone at google wants to make the world a better place
Google has been extremely busy trying to find ways to get login flows to keep working adequately well. In a specified, standardized manner. Look at what explainers they have, and note how many deal with 3rd party cookies or storage bucket access, https://github.com/orgs/explainers-by-googlers/repositories?...
Also compounding the difficulty is that we added storage isolation to the web, making even more of a fractal maze of problems, before figuring out how we were going to get rid of 3rd party cookies. That's probably fine, it's been a progressive layering of pretty good privacy/security, but it's more specced out complexity that has to be tangled with.
Someone at... where?
Then microsoft come in and say "hey, just use Edge, we're Enterprisey just like you - we understand you guys. we'll disable this crap by default"
https://learn.microsoft.com/en-us/deployedge/edge-ie-mode-po...
So yeah, it’s not simple, but it’s been done before and the concept works.
When w3.org wrote that statement after they threw in the towel, it seems bizarre to me to suggest they wrote that statement only to do Google's bidding?
This is not the only way. The SSO framework can be built into the browser or the OS, shifting it from third party to zeroth party.
And, in fact, foundational OS framework SSO is now available in current major releases of both Windows and MacOS.