Google plans to add support for two new privacy and security features to Chrome: Same-site cookies and anti-fingerprinting protection.
Both features were announced today at the company's I/O 2019 developer conference, and no release dates have been announced yet. But let's take a look at what the new features will do
Same-site cookies
The biggest change that Google plans to implement concerns how it will manage cookies.
The new controls will be based on a new IETF standard that Chrome and Mozilla developers have been proposing for more than three years.
This new IETF specification describes a new attribute that can be set through HTTP headers. It is called “SameSite”, and it should be set by the website owner. The new header should describe how cookies of a site can be loaded.
For example, a SameSite header set to “strict” will mean that the cookie can only be loaded on the “same site.” Definitions of “ lax” or “none” will allow cookies to be loaded on other sites.
In simple words, the above feature will create a dividing line between cookies, which can be same-site cookies or cross-site cookies.
Google hopes that website owners will update their sites and convert old cookies they use for sensitive functions, such as login functions and managing settings per site, to same-site cookies.
All old cookies that do not have a SameSite header will automatically be set to “none” and Chrome will treat them as cross-site cookies or tracking cookies.
Google also announced that it plans to add options to Chrome settings so users can see “how websites use cookies,” as well as “simpler controls for same-site cookies.”.
We don't know if these "simpler controls" will allow users to block all cookies altogether, but Google has promised to release a preview of these features later in 2019.
Firefox has added support for cross-site cookies since April 2018, with the release of Firefox 60. Chrome has supported same-site cookies since 2016, but the browser will start requiring this feature later this year.
It should be noted that websites that use same-site cookies will be protected from a number of attacks, such as cross-site request forgery (CSRF) attacks. The use of same-site cookies means that malicious code placed on a third-party website will not be able to pick up and read a cookie from another domain – because the “SameSite: strict” attribute present in the page header will prevent it.
Anti-fingerprint protection
Google engineers announced a second privacy-protecting feature in Chrome at the I/O 2019 developer conference.
According to Google, the company plans to add support for blocking certain types of fingerprinting that are abused by online advertisers.
Google didn't provide many details about the types of fingerprinting it plans to block. It's worth mentioning that there are many, from scanning locally installed system fonts, abusing the HTML5 canvas element, measuring the screen size of the user's device, to identifying installed extensions.
The first browser to block fingerprinting scripts was the Tor browser, which had to do so to hide the identity of its users. This feature was later used by the Firefox browser.
So at this year's I/O, Google announced that Chrome will also use an anti-fingerprinting feature.
Why?
Many may wonder why Google – a company that derives most of its revenue from advertising and user tracking – wants to add these privacy features, which are expected to have a big impact on its profits.
The answer is simple. Ad blocker extensions take a scorched earth approach to blocking tracking scripts, blocking them all. Google will deliver the new security features to Chrome, but it will also try to control the potential decline in online advertising revenue.
The company already offers basic ad blocking in Chrome, but avoids universal ad blockers.
So this is an opportunity for Google to cut its losses by offering solid control over privacy and ad blocking features through Chrome's settings.
