Google promises next week's cookie-crumbling Chrome 80 will only cause 'a very modest amount of breakage'

Next week Google is scheduled to release Chrome 80 to its stable channel, and says only "a very modest amount of breakage" of websites is expected. The reason web publishers might see "breakage" – which can mean anything from the loss of certain user-facing features to backend analytics errors – is that Chrome 80 handles HTTP …

[asdf]

how cute

Oh look Google is finally getting around to do an inferior job to what Privacy Badger has been doing for me for years now.

[Rich 11]

Re: how cute

Inferior by design.

Now there's a motto to live by.

[Khelban]

Re: how cute

Privacy Possum does it too

[Jamie Jones]

What am I missing here?

So, they've added the requirement for a certain header. All Joe-Nasty needs to do is set that header in their html, and "normal" service will be resumed?

Apart from making people jump through google-hoops, what does this achieve?

[W.S.Gosset]

Re: What am I missing here?

Yeah, it's a bit like that USA Immigration question: "Are you a Nazi? [YN]"

[J 3]

Re: What am I missing here?

Although now answering "yes" to the Nazi question might bring you to the attention of high officials in the administration since there are always positions open there...

[Rich 11]

Re: What am I missing here?

"Are you now, or have you ever been, a member of the Communist Party?"

"No, but if they throw good quiz nights I'm open to the idea of joining."

[MatthewSt]

Re: What am I missing here?

In summary, it stops Joe-Nasty from using cookies that identify you to Google. The problem isn't with cookies from a site, it's about how other sites can redirect you in a way that those cookies will be sent too.

[Jamie Jones]

Re: What am I missing here?

Ahhh, so if I'm Joe-Nicey, and I run a website with adverts I hope are legitimate, I can ensure third party ad-companies I use don't play fast-and-loose with the GDPR...

Thanks, I didn't think of that!

[MatthewSt]

Re: What am I missing here?

No... It means if you run a website where your users have accounts and data (like Google does) then nasty websites can't trick them into performing requests that pretend to be them

[Anonymous Coward]

Re: What am I missing here?

Joe Nasty also has to ensure it takes care of buggy clients, else they'll get the wrong result from them.

[Outer mongolian custard monster from outer space (honest)]

Re: What am I missing here?

samesite=none;secure just means the cookie has to have been transmitted over a secure channel (https) from the 3rd party server, therefore protecting it from snooping in transit.

I'm struggling also to see what huge leap making the bad cookie originate from a https server offers up to defeating various attacks in this case.

Also a value of none breaks older browers that won't rend the page as a result. Previously it had to be missing, lax or secure to be valid.

[Anonymous Coward]

Genossen, wir müssen alles wissen!

© Erich Mielke

[Anonymous Coward]

Oh....like the silent change that borked thousands of business users....

https://www.theverge.com/2019/11/15/20966237/google-chrome-white-tab-screen-crash-experiment-it-admins

[keithpeter]

Re: Oh....like the silent change that borked thousands of business users....

Quote from theverge article referenced above.

"After complaints, Google was forced to reveal it had launched an “experiment” on stable versions of Chrome that had changed the browser’s behavior. The experiment was made silently, without IT admins or users being warned about Google’s changes."

Firefox allows you to disable 'experiments' and 'studies' through both the preferences page in the GUI and through the about:config list for more granular control. Is there an equivalent in Chrome?

Icon: just upgraded the missus to Windows 10 and she is a Chromie

[SVV]

the cookie changes in Chrome 80 further concentrate Google's market power

So, how long now before Chrome directs ALL web traffic through Google's servers, and unilaterally insists on Google mandated HTML extensions on every page it allows - for the safety and security of its' captive users of course?

[Anonymous Coward]

Re: the cookie changes in Chrome 80 further concentrate Google's market power

Exactly. Is this actually an agreed internet standard, or is this Google attempting to trawl the web further into its dragnet by inventing its own "standards" for its one benefit (like so-called "AMP")?

[Arthur 1]

Re: the cookie changes in Chrome 80 further concentrate Google's market power

SameSite comes from IETF and is supported in all major browsers not named Safari. Google is just changing default behaviour to gradually push it to strict, which would improve overall safety on the web. While I'm not one to blindly defend the sometimes ridiculous shenanigans Google gets up to, this isn't really in that category.

[chivo243]

setting timer now

Count down to that annoying devil-may-care chuckle, and the phrase, "I guess we'll have to wait for google to sort this one out..." In the meantime you guys handle the pissed off users. thanks.