,
9 tweets,
2 min read
Read on Twitter
Here are my thoughts on yesterday's privacy announcement from the Chrome team (blog.chromium.org/2019/05/improv…). [Thread]
First, I want to say that I'm happy about what they have to say. Specifically because they 1) acknowledge that tracking is a problem on the web and 2) are willing to make changes to Chrome's default behavior.
What Chrome has announced is a change to their default cookie policy, going from allowing third-party cookie access to not allowing it. However, developers can simply reconfigure their cookies to opt out this new policy and we should expect all trackers to do so immediately.
For a cookie policy to have meaningful effect on cross-site tracking, you also need to partition storage available to third-parties, such as LocalStorage, IndexedDB, ServiceWorkers, and cache. Safari is the only major browser to have such partitioning and we shipped it in 2013.
(Chrome engineers actually asked for our partitioning to be put behind a compile-time flag so that they could compile it out of Chrome back then. This was about a month before the Blink fork. See for example bugs.webkit.org/show_bug.cgi?i….)
Safari's default cookie policy since 10+ years is to deny third-parties to use cookies unless they have been first party at some point. This used to be "Allow cookies for sites I visit" in Safari settings. No other major browser has shipped cookie restrictions on by default yet.
In addition to this cookie policy, Safari now runs with Intelligent Tracking Prevention (ITP) on by default. ITP detects which domains have the ability to track the user and either deletes all of their cookies and website data, or blocks third-party cookie access.
The two latest versions of ITP – 2.1 and 2.2 – cover third-party tracking that abuses the first-party storage space. I.e., third-party tracking is no longer the game for browsers who have been in this fight long enough.
This is all to say that Chrome has a long way to go if they are serious about fighting tracking on the web. Their announced changes will not do anything now, but they are important steps because they show Chrome's willingness to move.
