if you disable all third-party cookies in your browser (like where Site A is never allowed to use cookies from Site B), have you noticed that it breaks anything?

[viss@mastodon.social]

@b0rk mortgage websites, banking websites, some types of cloud provider stuffs - its been a while since i did it, but tons of shit breaks because places use auth options like 'login with google' and whatnot, and aaaaalll that shit falls over

[oleschri@chaos.social]

@b0rk I have been doing this for at least 5 years. These days most things work but in the beginning it was more like most things didn't work right.

[bosh@infosec.exchange]

@Viss @b0rk social logins are a mistake and people who like them should be ashamed.

[holothuroid@rollenspiel.social]

@b0rk Some news sites insist they give me cookies. Which often makes me rethink my urge to read that article.

[hylomorphism@mastodon.me.uk]

@b0rk I've had 3rd party cookies disabled for years, and I use Vivaldi with full blocking turned on and very little breaks. Anything I come across which doesn't work properly I just don't use.

[b0rk@social.jvns.ca]

@Viss thanks, I really need to learn how why login with google needs third-party cookies exactly

[frank@frankwiles.social]

@hylomorphism @b0rk same use Vivaldi and maybe have a site a quarter I have to exempt for some reason.

[dmerej@mamot.fr]

@oleschri @b0rk

basically *everything* from Microsoft breaks (from Teams to Outlook to Azure)

[jscholes@dragonscave.space]

@b0rk Most things on my mobile carrier's website that involve payments, paying for stuff at a popular department store here in Mexico, and hCaptcha's shitty accessibility cookie solution.

I keep a separate profile in my browser for these.

[jscholes@dragonscave.space]

@b0rk Also possibly my primary bank, and booking a British Airways flight. But those could've just been broken in a more general way.

[cthos@mastodon.cthos.dev]

@b0rk @Viss In the OIDC/OAuth sense it doesn't, and for a while there Google stopped using them on its own auth flow (using some redirect trickery to get youtube.com to work properly) when they were actively working on disabling them in Chrome (which they backed off of because advertising).

[oleschri@chaos.social]

@dmerej @b0rk

No. That is not true anymore.

[viss@mastodon.social]

@b0rk well it'd be for things like if you go to like, i dunno, stackoverflow or somewhere else, and you get that popup that says 'login with google'. im not sure if facebook or twitter are still popular methods for this, but those would also fall into the same category. also any place using stuff like okta or nextcloud for auth are gonna suffer the same way

[nonnihil@hachyderm.io]

@b0rk It used to break a whole lot of things, but these days everything except banks and sites not updated since 2003 works just fine.
I think this is mostly because of clever allowlisting from the browsers to make single sign-on work? I don't quite understand how SSO works tbh.

[cthos@mastodon.cthos.dev]

@b0rk @Viss There are some flows that were a lot easier if you have access to 3rd party cookies (magically being logged in across domains, being one) that become harder to implement if you don't have them, though - which is why a lot of sites relied on them and may/may not have ever bothered to reimplement an SSO/SLO flow that doesn't need them.

[b0rk@social.jvns.ca]

@Viss i guess i don't understand why because I've implemented basic OAuth login before and I don't remember any cookies being involved. Definitely there's just something basic I'm missing though.

[cthos@mastodon.cthos.dev]

@b0rk @Viss You're not! You don't need 3rd party cookies to do basic OIDC/OAuth, that's one of the main points of it.

[dmerej@mamot.fr]

@oleschri @b0rk ah. Glad to know they fixed it

[viss@mastodon.social]

@b0rk im suspecting it's going to vary from vendor to vendor. auth is just the first thing that came to mind. in building orbital (my asm platform) we tried to use 0auth to do 2fa and there were big problems in firefox and chrome with respect to third party cookies. we ended up going entirely local for 2fa after they changed their pricing model so it stopped being an issue

[duncan_lithgow@mastodon.social]

@dmerej
I find I often have to log in again for different parts of the Microsoft 'experience' but that's no big deal with a password manager (#bitwarden in my case)
@oleschri @b0rk