w3ctag / web-without-3p-cookies

Draft finding about third-party cookie removal
https://w3ctag.github.io/web-without-3p-cookies/
Other
9 stars 2 forks source link

warn against combined harms, but not against parallel development and testing #13

Closed npdoty closed 1 year ago

npdoty commented 1 year ago

We are also wary of new approaches being introduced while third-party cookies are still available to authors, as this comes with a risk that more, parallel channels for privacy invasion become possible, rather than fewer.

I think the intent here is to warn against adding new features which could allow additional cross-origin state that would likely be combined with third-party cookies, browser fingerprinting and other privacy-invasive means in ways that would be a long-term negative harm. I appreciate the emphasis that deprecation should happen (and personally preferred the earlier language about deprecation not being dependent on replacement).

Cautioning against the introduction, development or deployment of new approaches in parallel, though, seems to discourage discussion and testing, which have been very successful parts of web standards development and adoption. We want this transition to get going more quickly -- progress is overdue! -- and this could instead be interpreted as recommending waterfall-style development.

Maybe:

We are also wary of new mechanisms being introduced that would be combined by some actors with cookies, fingerprinting surface or other tools in a way that would be abused for greater privacy invasion.