Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Ask HN: Why Google cookies are exempted when blocking third-party cookies?
82 points by jerrygoyal on May 7, 2021 | hide | past | favorite | 36 comments
I disabled third-party cookies option in my chrome browser and yet cookies are being set from google.com and accounts.google.com domain to other sites like upwork.com.

see screenshot: https://i.imgur.com/zEm2r4Y.png

To see for yourself, disable third party cookies in chrome browser -> open upwork.com -> see cookies info.

As per my understanding third-party cookies are those created by domains other than the one the user is visiting at the time. So, why google.com domain cookies are being set on upwork.com?

Update: This issue doesn't happen in Firefox.



Because Google doesn't want you to do that.[1]

Use Firefox. The Web works just fine with all Google tracking blocked.

[1] https://fossbytes.com/chrome-doesnt-delete-google-cookies/


To be devil's advocate, if someone wants to clear all cookies and still be logged in to Google: it's like eating a cake and having a cake (well, cookie). In Chrome, being logged in to google.com and logged in to Chrome are tightly linked. (If you don't like that, don't use Chrome).

(Of course Google could do the other thing and say "ok since you clear all cookies, we log you out of Chrome, so you lose sync etc." but it's probably _not_ what most people want, nor what Google wants).


Why can't google chrome just have a special login cookie? So you need to log in to chrome, but doing so doesn't mean you're logged into your google account.


They used to be separate, but daddy G decided that having two separate login states for Google-the-browser and Google-the-website was too confusing for our widdle heads.

Oh well. At least it makes it dead-simple for the advertising company to track your complete browsing history.

PS: Install cookie autodelete, install uBlock origin, disable chrome login/sync entirely, and disable "enhanced" safe browsing. Block the google domains from loading globally on sites in uBlock. Also, and I cannot stress this enough: stop using gmail. It subjects not only yourself to total ad surveillance, but every single person you correspond with.


> someone wants to clear all cookies and still be logged in to Google: it's like eating a cake and having a cake (well, cookie)

not sure if this argument is valid here because that third party cookies issue still happens in incognito mode where I'm not logged in to my Google account.


This is why I use Firefox + Multi-Account Containers. Google and all its services I haven't yet been able to elimiate go in its own container. Google's cookies in all other containers are third-party and so get rejected.


Do you know if I can use Firefox in multiple "identities". E.g. with chrome I use two windows with different colored themes, one for personal, one for work account. Each has their own tab history and stuff.

I like Firefox but didn't find this feature.


You can have multiple identities, just as you can have them in chrome without being logged in. search for Firefox Multi-Account Containers. OR https://support.mozilla.org/en-US/kb/profile-manager-create-... But you can always create a shortcut for each identity...I use this method for Brave.


"Don't be evil" ... Well, why not? ... Ba ha ha ha haaaaaa.


When I joined google a few years ago the phrase “don’t be evil” was nowhere in the orientation materials or any official documents.


I can't provide an answer but I can provide a little more info about my tests.

I tried this in Microsoft Edge. They show up as blocked in that "Cookies in use" popup but when you open the inspector and go to the Application tab the cookies are there, not blocked. In Firefox's inspector in the Storage tab those domains don't show any cookies unless explicitly allowed.


when I open upwork.com it has 6 iframes in it, including to accounts.google.com/o/oauth2... I'd imagine that's where the cookie goes, not to the parent frame.

You'd need to see which request has the cookie on it, not just which ones were set "when you viewed this page".


To reduce this kind of abuse I use Edge when visiting Google sites, and Chrome when visiting Microsoft sites.


One could simplify that to just Firefox for both properties.


But then what would you use to visit mozilla.org?


Obviously Opera ;). Then just switch back to Chrome when you want to visit Opera's website to close the loop.


What’s wrong with Brave



Interesting reading...


I don't know the details of the implementation, so I'm theorizing here, but the most important thing is not whether those cookies are set, but whether they can be read e.g. by other browser tabs and other origins. It could be that those cookies are temporarily set, in an isolated way, to avoid breaking things too much. IIRC, there are some heuristics in place and some cookies used for multi-domain Single-Sign-On are allowed (even in Firefox).


Works as expected for me in Chrome 90 https://imgur.com/a/HDxsf5g


That's how it appears to me on Edge but when I open the inspector and go to the Applications tab the cookies are there and haven't actually been blocked. Can you check if that's the case for you too?


I only have cookies from the site.


that's strange cause I also used Chrome v90 and I could still see Google cookies even in incognito mode. Could you try after disabling any ad blocker/privacy extensions.


Why not use a Google Container?

https://addons.mozilla.org/en-US/firefox/addon/google-contai...

Oh... you are using Chrome!!! There's no point then. You won't be able to hide from Google no matter what you do!

Firefox + DuckDuckGo is just as good as all that "Googlish" things ;)


If this bothers you, dont use Chrome, ever. Use Chromium if you really need it and dont want to use Firefox. And get rid of your google account whilst youre at it.


Not seeing that in Ubuntu Chromium. They actually get blocked in my case. Also Privacy Badger, cause why not... https://privacybadger.org/


Probably because you are logged into Chrome.


well it's happening in incognito mode too.


You trusted Google not to track you in Incognito mode?


> well it's happening in incognito mode too.

You're raising doubts regarding a browser's threat to privacy by stating an observation that depends on blind faith on the same browser not threatening privacy.


Especially when the browser is made by an advertising company


For those who REALLY want Chromium-based browsers (Really?!?!?!?)...

Why not use Falkon (falkon.org)?


In Chrome you can disable auto-playing videos on any site except Youtube.


Use brave if you also want the benefits if a chromium browser


Why no love for Brave around here?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: