Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Why doesn't disabling Third Party Cookies block authentication sites, LiveID, OpenID, etc.

Trying to not make this political, but I need to explain my motivation to assist those who may answer this.

I had been watching the Google/Verizon anti-net neutrality power grab for awhile. Unhappy with their announcement I've decided it was time to not reward Google by passively opting into their data mining efforts.

My assumption was that switching search engines and turning off Third Party Cookies would be a good step.

What confuses me is that authentication sites like LiveID, OpenID, etc still work. Can someone explain why this is the case? I would have thought that as they're different domains it wouldn't work.

share|improve this question

2 Answers 2

up vote 4 down vote accepted

For openID cookie usage is up to the relying party. In general, it works like this:

  1. User submits URL to OpenID relying party
  2. Relying party checks URL for OpenID information
  3. Relying party detects Authenticating party, informs party that user wishes to authenticate.
  4. Authenticating party checks if user is authenticated (cookies: authenticating site checks their own cookies).

If the user is logged in, the relying site may issue their own cookies under their own domain.

If the user is not logged in:

  1. The user is forwarded to the Authenticating party's login page
  2. If the user logs in successfully, the Authenticating party sets any cookies they need to and informs the relying party that the user is authenticated.
  3. The relying party sets any cookies they need to and allows the user in.

Note the lack of any 3rd party cookies in any of this. It is my understanding that LiveID works in much the same way, with the LiveID authentication servers informing the 3rd party site that the user is successfully logged in and who they're logged in as, which allows the 3rd party server to interact with the user as if they'd logged in locally.

share|improve this answer
    
Thank you. So far so good. Doesn't really seem like I've lost any functionality by blocking third-party cookies. –  user12491 Aug 11 '10 at 22:47
    
It's a common enough setting that sites that need to use them have figured out that an embedded IFRAME from the right site is all they need to use. –  SysAdmin1138 Aug 12 '10 at 3:20

I think those sites use CERTIFICATES and shared credentials, not cookies. You can read more here.

share|improve this answer
    
Thank you for the link. –  user12491 Aug 11 '10 at 22:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.