Google Inc. regarding its intention to completely cease support for third-party cookies in Chrome within the next two years, which are set when accessing websites other than the current page's domain. Such cookies are used to track users' movements across websites in ad networks, social media widgets, and web analytics systems.
As well as made yesterday to unify the User-Agent header, the push against third-party cookies is part of an initiative aimed at achieving a balance between users' needs for privacy and the desire of ad networks and websites to track user preferences. By the end of this year, in an additional APIs are expected to be included in the browser To determine a user's interest category without individual identification and without tying to the history of visits to specific sites, ad networks are suggested to use the
Floc Conversion Measurement Trust Token without compromising privacy is being handled
by a separate working group. , established under the W3C organization.
CSRF attacks, The specified Set-Cookie header attribute SameSite is by default set to 'SameSite=Lax' starting from Chrome 76, which restricts the sending of Cookies for embeds from third-party sites. However, sites can override this restriction by explicitly setting SameSite=None when installing Cookies. The SameSite attribute can take two values: 'strict' or 'lax'. In 'strict' mode, Cookies are prevented from being sent for any type of cross-site requests. In 'lax' mode, more lenient restrictions apply, and the sending of Cookies is blocked only for cross-site subrequests, such as image requests or content loading through iframes.
In Chrome 80, scheduled for February 4, stricter restrictions will be applied, prohibiting the processing of third-party cookies for requests without HTTPS (cookies with SameSite=None can only be set in Secure mode). In addition, work continues on implementing measures to detect and protect against circumventing tracking methods and hidden identification ('browser fingerprinting').
Let us remind you that in Firefox, starting from the release , tracking cookies from all third-party systems are ignored by default. Google considers such blocking justified, but it requires prior preparation of the web ecosystem and offering alternative APIs for tasks that previously relied on third-party cookies, without compromising privacy and undermining the monetization models of advertising-funded websites. In response to the cookie blocking without providing alternatives, ad networks have not stopped tracking but have instead resorted to using more sophisticated methods based on hidden user identification (fingerprinting) or through for tracking subdomains in the website's domain where the ads are displayed.
Source: opennet.ru
