Hacker News new | ask | show | jobs
by mbetter 5232 days ago
Someone instructs their browser to not accept third party cookies, full stop. Google then does something, mumbles a bit, and then sets a third party cookie.

How isn't this nefarious?

3 comments

The nefarious bit is in IE- which, although it pretends to allow you to "instruct the browser not to accept 3rd party cookies, full stop," actually accepts third party cookies from any site with a P3P code it doesn't understand.
>The nefarious bit is in IE- which, although it pretends to allow you to "instruct the browser not to accept 3rd party cookies, full stop," actually accepts third party cookies from any site with a P3P code it doesn't understand.

No, if you select that option, it actually blocks all third party cookies.

No, it actually doesn't (or this discussion wouldn't be happening).
So do you work at Google or are you just a fanboy? IE is not being nefarious in this case. IE is following a standard that Google is actively abusing. Not sure why you have such an infatuation with Google, but I dare say: Everything in moderation.
Could you please avoid personal attacks? They add nothing to your argument while making the discussion less pleasant and civil.

I don't mean to single you out, but I've just been seeing too many of them lately.

It's not as if the users set IE to read P3P headers so technically they didn't override any user settings.

P3P is lacking: http://bits.blogs.nytimes.com/2010/09/17/a-loophole-big-enou...

So P3P is flawed and IE implements a flawed standard. Granted.

Google is still using this flaw to override the user setting "Do not allow 3rd party cookies" to allow themselves to track users.

There is no "technically" about this, they've misused the standard to override user settings.

Not exactly. The user setting is inaccurate, as it actually should have said "Do not allow 3rd party cookies, except for those from sites which have a code that indicates they aren't tracking cookies or a code we don't understand."

Instead it says "Third Party Cookies" with choices of Accept, Block, or Prompt.

>Not exactly. The user setting is inaccurate, as it actually should have said "Do not allow 3rd party cookies, except for those from sites which have a code that indicates they aren't tracking cookies or a code we don't understand."

That's exactly what they do.

>Instead it says "Third Party Cookies" with choices of Accept, Block, or Prompt.

No, it doesn't.

You sound as if you have researched it, but you seem to be trying to mislead folks by spreading nonsense.

Hmm....you act as if you have looked at it, but you haven't. You simply lie.
Is that really so hard to understand?

Google is intentionally using the loophole. They are intentionally circumventing users’ wishes. That’s nefarious. It’s first and foremost a moral failing. That’s exactly the problem. Just because it’s possible doesn’t mean it’s right.

That the loophole exists is a separate issue that also has to be remedied – but it doesn’t make Google’s behavior any less evil.

If by "mumbles a bit" you mean not supporting an unsupported and defunct proposed "standard" that doesn't work in practice and is only implemented in IE, then yeah.
It's a W3C recommendation. Scare quotes around the word standard are unnecessary, since a vast number of current web standards came out of W3C processes.

Or is it not 'standards-compliant' when WebKit implements features that only WebKit has, even if they're from W3C standards?

It's not really much of a standard if no one references it in the real world.

And the W3C standards are most successful when they document how technology is already being used in the wild. Proscriptive web standards handed down from on high have historically not fared well. Plenty of W3C standards are duds.

Why does everyone always assume quotes are used as scare quotes? I quoted "standard" because it's not a standard. If the standards body no longer exists and no one follows the standard, it's not a standard.
That's the definition of scare quotes.

"Scare quotes are quotation marks placed around a word or phrase to indicate that it does not signify its literal or conventional meaning."

"If scare quotes are enclosing a word or phrase that does not represent a quotation from another source they may simply serve to alert the reader that the word or phrase is used in an unusual, special, or non-standard way or should be understood to include caveats to the conventional meaning."

http://en.wikipedia.org/wiki/Scare_quotes

I would have thought the "proposed" and "defunct" clauses would indicate that "standard" was in name only. The term "scare quotes" indicates to the reader that the writer is intending to mislead or persuade. I don't agree that my usage constitutes what is generally accepted as scare quotes, but even if you disagree, the point still stands. IE is stomping its feet complaining that Google isn't supporting a standard that only IE supports (when even the standards body doesn't support it anymore).

Come up with a better standard, then complain when Google breaks it. Otherwise it's just another example of Google being "evil" (that's scare quotes).

Scare quotes don't have anything to do with your opinion of the author. Scare quotes are quotes that are editorial rather than informational.
>when even the standards body doesn't support it anymore

Don't they? I am curious, do you have a reference for that?