privacycg / nav-tracking-mitigations

Navigation-based Tracking Mitigations
https://privacycg.github.io/nav-tracking-mitigations/
35 stars 16 forks source link

Simulated third-party cookies in First-party Sets #26

Closed RussStringham closed 1 year ago

RussStringham commented 2 years ago

Your explainer states that a goal is to "Prevent stateful bounces from simulating third-party cookies when third-party cookies are disabled, either due to browser policy or user settings."

Later in the explainer you mention that First-party Sets will not be integrated with this proposal. By that I assume you mean that you will not treat a tracker site that is a member of a first-party set any differently when it is accessed only by other sites that are also members of the same set? The alternative would be to add another determination option that a tracker site is being used for a legitimate use case if both it and site1 are in the same first-party set. Of course this adds a complication when tracker is accessed from outside the first-party set, because in that case it should not have access to its storage (i.e. tracker storage must be partitioned by first-party set, at least when tracker is part of the set).

Without this, bounce tracking cannot be used within a first-party set to simulate third-party cookies to store state that the company wants to share between the sites it owns/controls. The company must instead rely on a login or other techniques to share this state between sites, in which case I don't see any benefit to first-party sets.

johannhof commented 2 years ago

in which case I don't see any benefit to first-party sets.

Sites in an FPS can use the Storage Access API to actually access third-party cookies instead of having to simulate them, so this seems very hyperbolic.