Hacker News new | ask | show | jobs
by pbreit 1420 days ago
As much as I loathe the cookie warnings, I'm constantly amazed at situations that don't avoid them. For example: there is no reason that PayPal needs to serve 3rd party cookies in a payment flow.

I've actually started to reject nonessential cookies most of the time now. Doubt it matters at all.
1 comments
WatchDog 1420 days ago
Payment gateway integrations might be one of the few legitimate non-advertising use cases I can think of for 3rd party cookies.

What makes you say they don't need them?

link
lopatin 1420 days ago
Do you mean that if you reject the cookie then the transaction will fail?
link
WatchDog 1420 days ago
I worked for a payment gateway years ago, when safari rolled out their initial blocking of third party cookies back in 2013 it broke some of our transaction flows yes.

There are a bunch of different kinds of payment gateway integrations, with various tradeoffs.

However a common pattern, at least at the time, was to use an iframe with the payment form in it.

Our form was multi page, and used cookie based sessions to track state between pages, so when they started being blocked, the payment form stopped working for safari users. The solution we chose at the time was to put the session id into the URL, but that has it's own security issues. There are other ways to address that particular issue that don't involve cookies, but would have required a significant rewrite of the system.

Some potentially legitimate ongoing use cases for 3rd party cookies, would be remembering payment details, and one click checkout across various sites that use the same payment gateway.

link
pbreit 1411 days ago
Wouldn't those be "necessary cookies"?
link
lokedhs 1420 days ago
If the use is required for the site to function, the data may be shared. The only ones you can reject are the ones that are not necessary, which usually involves ad trackers and similar things.

It should also be noted that these popups are likely not legal (or rather, they probably don't constitute informed consent under the the GDPR), but that's a completely different discussion to be had.

link
pbreit 1411 days ago
What 3rd party cookie is needed to process a payment? It's obnoxious I have to take care of the cookie situation what seems like every time I start a PayPal payment flow.
link
closewith 1420 days ago
If you actually needed the third-party cookie, it would be classed as strictly necessary and the site wouldn't need to ask for your consent.
link