
If you ever listen to the most excellent podcast Security Now! hosted by Leo Laporte and Steve Gibson, you would be familiar with their recommendation to disable 3rd party cookies. Check out the GRC website (Gibson Research Corporation) on this topic for more detailed information.
If you don’t know what cookies are, then in very brief terms they are small files that reside in your temporary internet folder on your computer, they are sent to you by a web site you visit and stored by the web browser. They are then sent back to that same web site each and every time you revisit that same site. The concept is to allow identifiable information to be sent back to the web site so that they know its you returning. Now this likely isn’t like your bank account information, but say your logon ID so that when you next return to Facebook you don’t have to login again.
3rd party cookies are nasty buggers that do the same thing, but they don’t come from the site you are visiting, but say from an ad on that website that really comes from another server. See, it doesn’t have to be the same site you are on where the cookie comes from, even that page you are visiting can trigger your browser to talk to another site to get an image (like an ad) and thus a new cookie is dropped on your computer.
Now if that same ad or site where the image comes from turns up on another website, well now they cookie is sent back from your computer to that site thus linking the two sites together, and thus to you.
You can think of that as nefariously as you want, I personally just disable my browser from allowing 3rd party cookies. For the most part this is harmless.
Now today when I was on the Windows Live site poking around, I clicked the Logout link at the top right. I was running Ubutnu 9.10 using FireFox 3.5, but it probably doesn’t matter. I also tried it on my Mac Snow Leopard running Safari 4, same thing.
The message is pictured above, and likely most people don’t see it unless they have 3rd party cookies turned off. By default they are turned ON.
Somehow the logout process on the Live sites uses them and causes the above message which just seems unlikely to be something you would expect. When I tried to access the Live services again, I had to login so I wasn’t worried there that my session was invalidated. But it begs the question what that cookie is needed for.
I think 3rd party cookies and Flash cookies (also nasty, and I’ll explain later when I get over this one) are going to increase in awareness over time and I think its best that sites stop having reliance on them like the Live one. Of course, sites make money on ads which will still work, just the tracking aspect would be gone.
Want to know how to turn off 3rd party cookies?
Visit www.aboutcookies.com and find your operating system and browser to learn how