Hacker News Reader

Comment by michaelt | Hacker News Reader

  Google got back to me [...] they had internally discussed
  the information leak problems associated with CSP and had 
  come up with no solutions that did not hamper CSP's 
  function.

Surely disabling third party cookies would fix this?

If it doesn't say www.facebook.com in the address bar, the browser doesn't send the facebook cookies, so the response is always consistent with the user not being logged in.

It might mean '+1' buttons have to be regular links, but other than that who loses out except ad networks?

View on HN

That depends on the definition of "disabling third party cookies".

If you are logged in Facebook, the facebook.com cookie is now first-party (because you visited facebook.com) and it is sent each time you make a request to Facebook from other domains. Blocking third party cookies usually mean that you block cookies from domain that you never directly visited (although Firefox has an option to disable ALL third-party cookies, even those from sites you visited [1]).

If the browser prevented sending cookies on cross-domain requests, it would block all authenticated cross-domain calls and that would severely limit the possible integration of web sites and applications. You could still pass session ids in the URL, but these can be sniffed by other servers, e.g., with the REFERER header.

[1] https://support.mozilla.org/en-US/kb/disable-third-party-coo...

Youtube.com couldn't show my logged-in state from a google.com server then?

With third-party cookies turned off, youtube.com definitely shouldn't be able to show your logged-in state from a google.com server. They generally play some fancy footwork with redirects to deliberately break third-party cookie origin parties so that they can achieve "single sign-in". I, personally, would prefer it if this were not possible, but it seems unlikely that Google would find this a desirable outcome.

Personally, I isolate my logged-in Google services in their own separate browser. I was hoping to find (or write) a browser plugin which opens URLs in different browsers based on regex of some sort (i.e. *.google.com, gmail.com, youtube.com links open in Chrome, everything else in Firefox), but I believe this is difficult to achieve because of the way browser sandboxing works (at least in Chrome).

Why should it? It's a different domain, therefore a different entity as far as the web is concerned.

Youtube could use OAuth, just like other sites that let you sign in with Google or Facebook.

The only difference is when you click to log in, your browser is briefly forwarded to a google.com server that then forwards you back. That, and it's much better for security.

Reply on news.ycombinator.com