Tag Archive for: cookies.

Pico CTF Gym – Power Cookie – CTF Training



Google has second thoughts about cutting cookies, so serves up CHIPs • The Register


Last week, third-party cookies received a stay of execution from Google that will allow them to survive until late 2023 – almost two years beyond their previously declared decommission date. But the search-ads-and-apps biz is already planning a resurrection of sorts because third-party cookies are just too useful.

The Chocolate Factory envisions a lesser form of third-party cookie, one that in theory won’t be used for tracking but will be able to support other more acceptable use cases. Google software engineer Dylan Cutler and engineering manager Kaustubha Govind call their confection “partitioned cookies” in a Web Platform Incubator Community Group proposal called “CHIPs.”

Cookies are files that web applications can set in web browsers to store data. They have legitimate uses, like storing data related to the state of the application (e.g. whether you’re logged in), and they can also be used for tracking people across websites.

Third-party cookies – set by scripts that interact with third-party servers – track people by storing a value on one website and then reading that value on another website that implements a similar third-party script. The third-party service in this case then knows all the websites running their script that were visited by the tracked individual.

That’s the sort of privacy-invading behavior that led browser makers like Apple, Brave, Mozilla, and others to block third-party cookies by default. But doing so has created problems by interfering with applications that rely on third-party cookies to deliver services across domain contexts.

The browser security model is based on the distinction between first-party and third-party contexts. When an individual visits a specific web domain, that domain operates in a first party context; services available at other domains are considered third-party and face various limitations on what they can do.

Source…

Yes, This Site Uses Cookies, Because Nearly All Sites Use Cookies, And We’re Notifying You Because We’re Told We Have To

If you’re visiting our site today (and I guess, forever into the future if you don’t click “got it”) you will now see a notification at the bottom of the site saying that this site uses cookies. Of course, this site uses cookies. Basically any site uses cookies for all sorts of useful non-awful, non-invasive purposes. We use cookies, for example, to track your preferences (including when you turn off ads on the site, which we let you do for free). In order to make sure those ads are gone, or whatever other preferences stay in place, we use cookies.

For the last few years, of course, you’ve probably seen a bunch of sites pop up boxes “notifying” you that they use cookies. For the most part, this has to do with various completely pointless EU laws and regulations that probably make regulators feel good, but do literally nothing to protect your privacy. Worst are the ones that suggest that by continuing on the site you’ve made some sort of legal agreement with the site (come on…). These cookie notification pop ups do not help anyone. They don’t provide you particularly useful information, and they don’t lead you to a place that is more protective of your actual privacy. They just annoy people, and so people ignore them, leave the site, or (most commonly) just “click ok” to get the annoying bar or box out of the way to get to the content they wanted to see in the first place.

Here’s the stupendously stupid thing about all of this: you are already in control. If you don’t like cookies, your browser gives you quite a lot of control over which ones you keep, and how (and how often) you get rid of them. Some browsers, like Mozilla’s Firefox Focus browser, automatically discard cookies as soon as you close a page (it’s great for mobile browsing, by the way). Of course, that leads to some issues if you want to remain logged in on certain pages, or to have them remember preferences, but for those you can use a different browser or change various settings. It’s nice that the power to handle cookies is very much up to you. We here at Techdirt like it when the control is pushed out to the ends of the network, rather than controlled in the middle.

But, because it makes some privacy regulators feel like they’ve “done something”, they require such a pointless “cookie notification” on sites. Recently, one of our ad providers told us that we, too, needed to include such a cookie notification, or else we’d lose the ability to serve any ads from Google, who (for better or for worse) is one of the major ad providers out there. We did not get a clear explanation for why we absolutely needed to add this annoying notification that doesn’t really help anyone, but the pleas were getting more and more desperate, with all sorts of warnings. We even asked if we could just turn off the ads entirely (which would, of course, represent something of a financial hit) and they seemed to indicate that because we still use other types of cookies (again, including cookies to say “don’t show this person any ads”), we had to put up the notification anyway.

The last thing we were told is that if we didn’t put up a cookie notification within a day, Google would “block us globally.” I’m honestly not even sure what this means. But, either way, we’re now showing you a cookie notification. It’s silly and annoying and I don’t think it serves your interests at all. It serves our interests only inasmuch as it gets our partner to stop bugging us. Don’t you feel better?

You can click “got it” and make it go away. You can not click it and it will stay. You can block cookies in your browser, or you can leave them. You can toss out your cookies every day or every week (not necessarily a bad practice sometimes). You’re in control. But we have to show you the notification, and so we are.

Techdirt.

Yahoo reveals more breachiness to users victimized by forged cookies [Updated]

(credit: Clever Cupcakes)

Yahoo has sent out another round of notifications to users, warning some that their accounts may have been breached as recently as last year. The accounts were affected by a flaw in Yahoo’s mail service that allowed an attacker—most likely a “state actor,” according to Yahoo—to use a forged “cookie” created by software stolen from within Yahoo’s internal systems to gain access to user accounts without a password.

Yahoo informed some users in e-mails this week that “Based on the ongoing investigation, we believe a forged cookie may have been used in 2015 or 2016 to access your account.” The messages are regarding possible breaches using the cookie vulnerability in 2014.

The Associated Press’ Raphael Satter reports that a Yahoo spokesperson acknowledged the company was notifying users of the potential breach of their accounts, but would not disclose how many users were affected.

Read 6 remaining paragraphs | Comments

Technology Lab – Ars Technica