The Future of Cookies
summary
Browsers are actively breaking third‑party cookies: Chrome made SameSite Lax the default in 2020 and is rolling out third‑party cookie blocking via the Privacy Sandbox (1% of users in January 2024), Safari enforces ITP, CNAME cloaking and IP-octet checks and applies a 7‑day interaction tolerance, Firefox isolates trackers with per‑site cookie jars, and there are new primitives like _Host/_Secure prefixes and the Federated Credential Management API. Result: cross‑site SSO and front‑channel logout break; solution trends are back‑channel logout and server‑side session stores with reference cookies.
AI-written summary · about
chapters (18)
- 0:00Welcome to cookies
- 1:12How cookies work
- 2:38Early cookie security issues
- 6:10Browser security features
- 10:06Same-site cookie attributes
- 14:25Secure and host-only prefixes
- 15:56SameSite default enforcement
- 17:43Third-party cookies and tracking
- 19:31Single sign-on reliance
- 22:50Safari blocks third-party cookies
- 25:23Safari CNAME cloaking and IP blocking
- 28:42Firefox total cookie protection
- 30:45Chrome delays third-party phase-out
- 35:03Privacy Sandbox and interest-based ads
- 37:56Federated Credential Management API
- 40:28Super cookies and tracking methods
- 41:13Future of cookies
- 43:44Q&A
related talks
50mThe Future of Cookies
53mThe Future of Cookies
13mPreparing for a more private web
16mOpen web standards with Privacy Sandbox
42mA Deep Dive Into SameSite Cookies, What They Are and Why They Matter
27mPatterns for privacy
27mWho Left Open the Cookie Jar? A Comprehensive Evaluation of Third-Party Cookie Policies
28mCookie Crumbles: Unveiling Web Session Integrity Vulnerabilities