Conversation

Rich Felker
@RichFelker
Huh? The web has been working fine with 3rd party cookies entirely blocked for 2 decades. But never miss a chance to use a crisis as an excuse for rolling back enhanced privacy defaults... Never change, Google...
Quote Tweet
Justin Schuh
@justinschuh
We've temporarily reverted Chrome's SameSite rollout, and intend to pick it back up in the summer. It was a necessary decision given that COVID-19 has redefined how web services are meeting essential needs for so many people right now. blog.chromium.org/2020/04/tempor
2
16
Daniel Micay
@DanielMicay
Replying to
@RichFelker
SameSite cookies are a CSRF mitigation, not a privacy enhancement. SameSite=Strict stops cookies from being sent cross-origin and should be set for all cookies in newly developed code. SameSite=Lax still sends them for cross-origin GET requests for compatibility with legacy code.
2
Daniel Micay
@DanielMicay
Replying to
@DanielMicay
and
@RichFelker
Changing the default to SameSite=Lax will mitigate most CSRF attacks by default. SameSite=None was standardized so that developers can opt-out of the changed default. The option to disable third party cookies is a much different thing. That only disallows them from being set.
2
Rich Felker
@RichFelker
Replying to
@DanielMicay
Third party cookies just shouldn't exist at all. It's shameful that any browser still supports them. Default should have been disabled 20 years ago, removed entirely (no option to enable) 10 years ago.
1
Daniel Micay
@DanielMicay
Replying to
@RichFelker
The third party cookie toggle in web browsers for enabling/disabling them only applies to setting cookies, not sending existing ones, so the meaning of third party cookie has been watered down by browsers. The toggle has the same issue I mentioned with a forced SameSite=Lax.
1