HN Explorer

Ask HN: Why Google cookies are exempted when blocking third-party cookies?

82 points by jerrygoyal ↗ HN
I disabled third-party cookies option in my chrome browser and yet cookies are being set from google.com and accounts.google.com domain to other sites like upwork.com.

see screenshot: https://i.imgur.com/zEm2r4Y.png

To see for yourself, disable third party cookies in chrome browser -> open upwork.com -> see cookies info.

As per my understanding third-party cookies are those created by domains other than the one the user is visiting at the time. So, why google.com domain cookies are being set on upwork.com?

Update: This issue doesn't happen in Firefox.

37 comments

[ 25.9 ms ] story [ 1131 ms ] thread
livre
I can't provide an answer but I can provide a little more info about my tests.

I tried this in Microsoft Edge. They show up as blocked in that "Cookies in use" popup but when you open the inspector and go to the Application tab the cookies are there, not blocked. In Firefox's inspector in the Storage tab those domains don't show any cookies unless explicitly allowed.

Animats
Because Google doesn't want you to do that.[1]

Use Firefox. The Web works just fine with all Google tracking blocked.

[1] https://fossbytes.com/chrome-doesnt-delete-google-cookies/

jakub_g
To be devil's advocate, if someone wants to clear all cookies and still be logged in to Google: it's like eating a cake and having a cake (well, cookie). In Chrome, being logged in to google.com and logged in to Chrome are tightly linked. (If you don't like that, don't use Chrome).

(Of course Google could do the other thing and say "ok since you clear all cookies, we log you out of Chrome, so you lose sync etc." but it's probably _not_ what most people want, nor what Google wants).

[deleted]
(comment deleted)
oh_sigh
Why can't google chrome just have a special login cookie? So you need to log in to chrome, but doing so doesn't mean you're logged into your google account.
sneak
They used to be separate, but daddy G decided that having two separate login states for Google-the-browser and Google-the-website was too confusing for our widdle heads.

Oh well. At least it makes it dead-simple for the advertising company to track your complete browsing history.

PS: Install cookie autodelete, install uBlock origin, disable chrome login/sync entirely, and disable "enhanced" safe browsing. Block the google domains from loading globally on sites in uBlock. Also, and I cannot stress this enough: stop using gmail. It subjects not only yourself to total ad surveillance, but every single person you correspond with.

lolinder
This is why I use Firefox + Multi-Account Containers. Google and all its services I haven't yet been able to elimiate go in its own container. Google's cookies in all other containers are third-party and so get rejected.
jerrygoyal
> someone wants to clear all cookies and still be logged in to Google: it's like eating a cake and having a cake (well, cookie)

not sure if this argument is valid here because that third party cookies issue still happens in incognito mode where I'm not logged in to my Google account.

drpixie
"Don't be evil" ... Well, why not? ... Ba ha ha ha haaaaaa.
olliej
When I joined google a few years ago the phrase “don’t be evil” was nowhere in the orientation materials or any official documents.
deepsun
Do you know if I can use Firefox in multiple "identities". E.g. with chrome I use two windows with different colored themes, one for personal, one for work account. Each has their own tab history and stuff.

I like Firefox but didn't find this feature.

jakub_g
I don't know the details of the implementation, so I'm theorizing here, but the most important thing is not whether those cookies are set, but whether they can be read e.g. by other browser tabs and other origins. It could be that those cookies are temporarily set, in an isolated way, to avoid breaking things too much. IIRC, there are some heuristics in place and some cookies used for multi-domain Single-Sign-On are allowed (even in Firefox).
martini333
Works as expected for me in Chrome 90 https://imgur.com/a/HDxsf5g
jerrygoyal
that's strange cause I also used Chrome v90 and I could still see Google cookies even in incognito mode. Could you try after disabling any ad blocker/privacy extensions.
livre
That's how it appears to me on Edge but when I open the inspector and go to the Applications tab the cookies are there and haven't actually been blocked. Can you check if that's the case for you too?
magicalist
when I open upwork.com it has 6 iframes in it, including to accounts.google.com/o/oauth2... I'd imagine that's where the cookie goes, not to the parent frame.

You'd need to see which request has the cookie on it, not just which ones were set "when you viewed this page".

flowerlad
To reduce this kind of abuse I use Edge when visiting Google sites, and Chrome when visiting Microsoft sites.
kiwijamo
One could simplify that to just Firefox for both properties.
bashinator
But then what would you use to visit mozilla.org?
jameshush
Obviously Opera ;). Then just switch back to Chrome when you want to visit Opera's website to close the loop.
IshKebab
Probably because you are logged into Chrome.
jerrygoyal
well it's happening in incognito mode too.
insomniacity
You trusted Google not to track you in Incognito mode?
rualca
> well it's happening in incognito mode too.

You're raising doubts regarding a browser's threat to privacy by stating an observation that depends on blind faith on the same browser not threatening privacy.

olliej
Especially when the browser is made by an advertising company
tacker2000
If this bothers you, dont use Chrome, ever. Use Chromium if you really need it and dont want to use Firefox. And get rid of your google account whilst youre at it.
unparagoned
Use brave if you also want the benefits if a chromium browser
FractalHQ
Why no love for Brave around here?
retox
In Chrome you can disable auto-playing videos on any site except Youtube.
maverick74
For those who REALLY want Chromium-based browsers (Really?!?!?!?)...

Why not use Falkon (falkon.org)?