Cookies Having Independent Partitioned State (CHIPS)

[DCtheTall]

Guten TAG!

I am requesting a review of Cookies Having Independent Partitioned State (a.k.a. CHIPS), a proposal for opt-in cookie jar partitioning by top-level site.

This proposal introduces a new Set-Cookie header attribute, Partitioned, which servers can use to opt-in to having their cross-site cookies partitioned by top-level site.

• Explainer¹ (minimally containing user needs and example code): https://github.com/WICG/CHIPS
• Security and Privacy self-review²: https://github.com/WICG/CHIPS/blob/main/TAG-S%26P-questionnaire.md
• Primary contacts (and their relationship to the specification):
  • Kaustubha Govind (@krgovind), Google
  • Dylan Cutler (@DCtheTall), Google
• Organization/project driving the design: Google
• External status/issue trackers for this feature (publicly visible, e.g. Chrome Status): https://chromestatus.com/features/5179189105786880

Further details:

• I have reviewed the TAG's Web Platform Design Principles
• The group where the incubation/design work on this is being done (or is intended to be done in the future): WICG
• The group where standardization of this work is intended to be done ("unknown" if not known): IETF HTTP WG or WebAppSec WG
• Existing major pieces of multi-stakeholder review or discussion of this design: https://github.com/WICG/CHIPS/issues
• Major unresolved issues with or opposition to this design: https://github.com/WICG/CHIPS/issues
• This work is being funded by: Google

We'd prefer the TAG provide feedback as (please delete all but the desired option):

🐛 open issues in our GitHub repo for each point of feedback

[thezedwards]

Would it be correct to frame this as a side channel of the Google Privacy Sandbox being built to support specific usecases?

How is this impacted by CNAME mapping and efforts to muddle 1st party context? Will IDs stored in this storage be accessible to Javascript for 3rd party triangle syncs and therefore any IDs stored in this partition be ~100% open to be used as a cross-site ID? The answers @ https://github.com/WICG/CHIPS/blob/main/TAG-S%26P-questionnaire.md seem to not hide how dangerous this proposal is.....

Have other browsers considered this? It seems there are clear risks from this proposal, that it's a step in the wrong direction for any privacy sandboxes, and the fact that this proposal doesn't seem to even hide that it's a step backwards, it's unclear why this is being proposed, and how this aligns to rhetoric that Google has communicated about the so-called Privacy Sandbox being built into Chromium.

[wanderview]

I believe perhaps there is a misunderstanding about what the quoted text in section 3.5 above says. It does not say CHIPS creates a new side channel. It says that if a previously existing side channel is used to create an identifier, then CHIPS provides a place to store that identifier. This is, however, no different from the numerous other places that can be used to store state on the web platform (and all that storage is being partitioned).

[krgovind]

Would it be correct to frame this as a side channel of the Google Privacy Sandbox being built to support specific usecases?

No, this proposal does not introduce any side channels. The explainer and the S&P questionnaire explicitly discuss potential side channels, and where applicable, solutions for preventing them. We decided to address these head-on, because similar side-channel attacks were discussed in the context of other partitioning work, and we wanted to make sure that these were given consideration

How is this impacted by CNAME mapping and efforts to muddle 1st party context? Will IDs stored in this storage be accessible to Javascript for 3rd party triangle syncs and therefore any IDs stored in this partition be ~100% open to be used as a cross-site ID?

Could you expand upon the attack you are envisioning? By definition, identifiers stored in partitioned cookies are available to the owning domain/host only within the same top-level context that makes up the partition key. This is what prevents their use for tracking across sites.

Have other browsers considered this?

Yes. In fact, Firefox and Safari are currently either shipping or discussing partitioning of third-party cookies. In short, there is cross-browser alignment that this is a useful semantic for the web, the differences are in the syntactical/deployment approaches.

[thezedwards]

Thanks for a bunch of people chiming in from Google so quickly.

1. As mentioned, yes this is a side channel. It may use "existing side channels" - but this is Google saying, "we aren't getting rid of 3rd party cookies, we are actually going to evolve them, but going to not mention the evolution or the overall 3rd party cookie deprecation when explaining this new proposal)."

1a) Please explain in these types of proposals HOW they relate to other proposals. This should be communicated as, "The CMA told us we needed to evolve 3rd party cookie deprecations, so we looked at what FireFox is doing for half-measures, and are modeling that. We still intend to keep the 3rd party deprecation timetable that we've discussed, and when the privacy sandbox is deployed, these techniques will no longer work - we are proposing an interim measure that would provide new/slightly safer tracking methods for 18-24 months, and assuming that FireFox stops their practice, Google may follow that. But for now, the company Google is paying billions to default Google search for, is acting like a policy blocker for one of our worst data sharing proposals in 2021 that conflicts with other privacy sandbox messaging."

2. A double key cookie does NOTHING if that cookie is accessible to an entity via Javascript, because they can read the cookie, and then fire off a request with that value back to the 1st party or other new 3rd party partners. If CNAME mapping protections aren't deployed with this, and other JS restrictions for the value stored in a double-keyed cookie, then it might as well be a single key -- this doesn't stop the partner who controls the key from sharing that value with new partners. In fact, the specs @ https://github.com/WICG/CHIPS#partitioning-model literally mention First Party Data sets, which is a CNAME-tracking-loophole, the middle ground to make it slightly safer, but not a solution at internet-scale at all.

2a) It's 2021 and Google and other browsers are still pretending like "Corporate Entity Lists associated to which browsers they own is a safe practice for building internet policies" -- first party lists and efforts to give special data sharing access to major corporations who own dozens/hundreds of domains, proves that Google is favoring itself and companies exactly like itself.

3. I hope regulators are watching how these proposals are shared in a a place like github, with tons of details missing, when the folks at the CMA and other regulatory bodies have asked for Google to be extremely clear about these proposals, the timelines, what each if shifting, and also requiring that these proposals be viewed through the lens of other public promises from Google about efforts to stop tracking.

3a) These types of proposals are market manipulation, and when this proposal "Gets press" - a bunch of "Open Internet" stocks will jump up at the news that Google is looking at half-measures all of a sudden, and not only has shifted from the timetable for full 3rd party cookie deprecation, but ya'll are now looking at policies that FireFox deployed, largely because it's a far weaker data protection policy than full 3rd party cookie blocking.

4. Looks like data privacy activists need to start focusing their attention on Firefox and the "half measures" that have been deployed there, which are now being used as policy blockers for Google to deploy similarly less safe half measures.

I'll let other folks ask questions and dig into this -- Google should stop putting huge policy shifts like this behind "proposals" and put them on the corporate google.com blog pages. It's clear this "3rd party cookie deprecation half measure" will be deployed, ya'll aren't asking for feedback or going through any standards reviews that could keep this from being deployed, and as mentioned, stocks are going to jump from this news, and many folks at Google and working at Google Ventures would know about these shifts and how they would impact competitor stock prices.

[torgo]

Hi @thezedwards. While we appreciate and welcome spirited debate and community contribution to our design reviews repo, can I please remind you that (a) this is a the technical architecture group and any discussion in these issues should focus on the technical design of the specifications and technologies being reviewed (and not stray into policy/legal/regulatory) and (b) we operate under the W3C Code of Conduct and Professional Ethics and as such can I please ask that you keep your remarks respectful and professional.

[thezedwards]

howdy @torgo - thanks for that link and your work.

The technical design of cross site cookie restrictions are part of a larger political and policy discussion. I know many engineers wish that this work was completely in a bubble where they didn't need to think about privacy laws or competition frameworks, or ongoing legal guidance from orgs like the CMA (https://www.gov.uk/government/news/cma-to-have-key-oversight-role-over-google-s-planned-removal-of-third-party-cookies), but that's not the world we live in.

If G$ or any company wants to keep proposing technical changes to data architecture for the Chromium open source product in open discussion groups like the w3c, using the rules of the w3c as cover to push their bad policy proposals through, then I'm not sure why regulators and elected officials are allowing this type of regulatory capture of a technical standards process without also getting involved in the process. But they don't seem to be involved here much, so here I am, reminding people in this thread that there is an agreement between the UK CMA (A government entity) and the corporation whose engineers are proposing these changes in this thread, and the changes being proposed were specifically addressed in the UK CMA agreement requiring specific public notice and a commitment to analyze any updated proposals through both a privacy and market-access lens.

It's unclear to me whether the w3c believes that the UK CMA's framework for cookie changes should be ignored, or if folks in the w3c groups are supposed to pretend like legal rulings and regulations aren't happening around us that specifically focus on the work being done here with cookie deprecations and cookie access changes. In just this past 6 months there have been huge impacts on real businesses in the stock market merely from "cookie proposals" - so mentioning these concerns maybe is "off topic" to some people, but to the companies being gutted by unexpected changes, this is not off topic, and many governments and people in government agree with this sentiment. Constantly changing proposals creates financial bubbles, and uncertainty in markets, and when one company is leading a large portion of these proposals, and the negative impacts are mostly falling on their competitors, we should not keep ignoring this as new cookie proposals are casually dropped in open standards groups.

Should we all pretend like we didn't have such a big problem with cookie deprecation policies that an entire government had to intervene in this process? Do folks think that speaks highly of the w3c process?

I'm not sure why bringing up the fact that Partitioned Cookies is a half-measure to full third party cookie blocking, and the political implications of that decision, are somehow off-topic, but that seems to be part of the regulatory capture that certain corporations rely upon when pushing features through these standard groups. There should be more people pointing out that some of these data flow changes conflict with other public promises to other market players, yet that hasn't happened yet. But tone and topic policing, we've got plenty of that.

If folks involved with the W3c think talking about companies and market access concerns when specific companies propose changes to global data architecture, is "off topic" - feel free to continue this tone policing or attempt to ban folks. Chromium is an open source product, the changes being made in Chromium are being regulated and investigated by governments across the world, and more people should be talking about the responsibilities to communicate the full scope of a cookie change, in the context of all the other changes, anytime and every time one of these cookie change proposals are pushed forward -- but especially so when the proposal comes from Google.

All future cookie changes in Chromium (Again, an open source project, not owned by any corporation), when proposed through the w3c, should also be viewed through the lens of this UK CMA requirement: "A commitment to develop and implement the proposals in a way that avoids distortions to competition and the imposition of unfair terms on Chrome users. This includes a commitment to involve the CMA and the ICO in the development of the Proposals to ensure this objective is met." https://www.gov.uk/government/news/cma-to-have-key-oversight-role-over-google-s-planned-removal-of-third-party-cookies

I likely won't have anything else to say on this thread, but I wanted to make sure it was clear that when a proposal says "This work is being funded by: Google" (see above in original post now) --- yet folks don't raise questions in the context of larger market agreements, then it's just ongoing proof that the w3c is a captured entity, and unable to regulate the Chromium proposals.