Google has plans to deprecate cookies over http

[ZiiS]

>> Should we special-case the cookie value "OPT_OUT"? It would be unfortunate indeed if removing old cookies meant that users who had opted out of interest-based advertising started being targeted again. Perhaps excluding the special value OPT_OUT (and asking advertisers to standardize on it?) is justifiable.

Still suggesting the Evil Bit? https://www.ietf.org/rfc/rfc3514.txt

[_verandaguy]

To be fair, the evil bit's a great idea; it just failed to get much support from the malware developer community.

[whoisburbansky]

Shouldn't the title have 'deprecate' instead of 'depreciate'?

[jasonkostempski]

One of my earliest memories of professional programming was talking to another dev, many years my senior in experience, about a "deprecated" API. They insisted the word was "depreciated". I didn't push it for the conversation, but afterwards triple-double-checked I wasn't crazy. Nearly 20 years later, I still feel I might be using the word wrong.

[bencollier49]

They want them to last for less time. Perhaps that's the right word.

[tarboreus]

Yes.

[m90]

Can we change the clickbaity headline? This is a Google employee, but there is no evidence in that repo that supports the claim that "Google has plans".

[eganist]

Speaking with some amount of experience working with people on that team: his role at Google is precisely what you see him doing here—deprecating insecure fundamental components of the web.

A proposal like this wouldn't have been approved for public release if the rest of the Chromium security team didn't see merit to it.

Everyone keeps calling him "some guy." Mike West is attached to a number of similar RFCs.

That all being said, I wouldn't immediately discount the idea even if it only turns out to be a research exercise.

[pimterry]

This is the background explainer for "Intent to Deprecate: Nonsecurely delivered cookies", from the official Blink mailing list ( https://groups.google.com/a/chromium.org/forum/#!topic/blink...).

Technically yes, it's the Blink team that has plans to deprecate, but that is effectively Google.

[giovannibajo1]

This went to blink-dev: https://groups.google.com/a/chromium.org/forum/m/#!topic/bli...

I’m not familiar with their workflow but it looks like something that the development team is considering, not random babbling from a random employee.

[nmjohn]

See the Intent to Deprecate on blink-dev: https://groups.google.com/a/chromium.org/d/msg/blink-dev/r0U...

[angrygoat]

Discussion thread on the blink-dev list here:

https://groups.google.com/a/chromium.org/forum/#!topic/blink...

[sbr464]

Might cause an issue for WiFi access portals in short term. Not really related, more of a side effect of poor implementations. Some use cookies to route around settings, I’ve had trouble with in past.

[lousken]

next step: disable javascript served over http

[vultour]

next step: disable javascript

[ToFab123]

plan? No, some guy has suggested it. That does not equal to plan.

[LinuxBender]

Should there be an official Google update or blog on this?