[renonce]

> I can't log in to stackoverflow.com, then go to superuser.com and already be logged in.

I would expect a popup like “This site wants to share cookies with stackexchange.com, press Allow to sign in, press Reject to reject forever or press Ignore to decide later”. Takes a single click to enjoy the benefits of both worlds. The mechanism should make sure that every website has a single “first-party domain” shared across all subsites and that first-party domain must not share cookies with any other site than itself to minimize confusion.

[troupo]

Instead you will get a "we and our 3789 partners value your privacy", and people will blame GDPR/whatever regulation for it.

[thayne]

And that would be annoying to people who aren't already logged in to a related site.

Also, there is no way to know which related site the user is logged in to, so they would have to prompt for every one of their sites.

[renonce]

> Also, there is no way to know which related site the user is logged in to, so they would have to prompt for every one of their sites.

This is not how it works. The mechanism is about allowing a cluster of websites to choose a single first party domain and have all of them share cookies together, not sharing arbitrary cookie from arbitrary domain, otherwise it would create loopholes in connected components that bring back the downsides of third-party cookies. What you mentioned should be done using SSO.

After thinking about it a bit more, I have a clearer picture of how it should work in my mind:

* All cookies are double-keyed: the primary key is the origin of the top-level page and the secondary key is the origin of the page that sets the cookie, just like how partitioned cookies work right now.

* stackoverflow.com uses a header, meta tag or script to request changing its primary key domain to “stackexchange.com”

* The browser makes a request to https://stackexchange.com/domains.txt and make sure that “stackoverflow.com” is in the list, authorising this first-party domain change

* When the user agrees to the change, the page is reloaded with stackexchange.com as the primary key, thus stackoverflow.com can obtain login details from stackexchange.com via CORS or cross site cookies.

* A side effect is that all cookies and state are lost when switching the first-party domain. Should stackoverflow.com be acquired by a new owner, say x.com and changes its first-party domain to x.com, all cookies on stackoverflow.com are lost and the user will have to login on x.com again, maybe using credentials from stackexchange.com. It’s unfortunate but it works around the issues mentioned in the post in a clean way, avoiding loopholes that transfer cookies by switching the first-party domain frequently.