{"id":26654,"date":"2019-09-23T16:46:24","date_gmt":"2019-09-23T20:46:24","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=26654"},"modified":"2019-09-25T14:16:05","modified_gmt":"2019-09-25T18:16:05","slug":"intelligent-tracking-prevention-2-3","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2019\/09\/23\/intelligent-tracking-prevention-2-3\/","title":{"rendered":"Intelligent Tracking Prevention 2.3"},"content":{"rendered":"<p><a href=\"https:\/\/webkit.org\/blog\/9521\/intelligent-tracking-prevention-2-3\/\">John Wilander<\/a>:<\/p>\n<blockquote cite=\"https:\/\/webkit.org\/blog\/9521\/intelligent-tracking-prevention-2-3\/\">\n<p>By limiting the ability to use <em>any<\/em> script-writeable storage for cross-site tracking purposes, ITP 2.3 makes sure that third-party scripts cannot leverage the storage powers they have gained over all these websites.<\/p>\n<p>[&#8230;]<\/p>\n<p>Our research has found that trackers, instead of decorating the link of the destination page, decorate their own referrer URL and read the tracking ID through <code>document.referrer<\/code> on the destination page.<\/p>\n<p>ITP 2.3 counteracts this by downgrading <code>document.referrer<\/code> to the referrer&rsquo;s eTLD+1 if the referrer has link decoration and the user was navigated from a classified domain. Say the user is navigated from social.example to website.example and the referrer is <code>https:\/\/sub.social.example\/some\/path\/?clickID=0123456789<\/code>. When social.example&rsquo;s script on website.example reads <code>document.referrer<\/code> to retrieve and store the click ID, ITP will make sure only <code>https:\/\/social.example<\/code> is returned.<\/p>\n<p>[&#8230;]<\/p>\n<p>Safari on macOS Catalina now has ITP Debug Mode.<\/p>\n<p>[&#8230;]<\/p>\n<p>Our blog post on <a href=\"https:\/\/webkit.org\/blog\/8613\/intelligent-tracking-prevention-2-1\/\">ITP 2.1<\/a> provided guidance on how to protect cookies. We specifically encourage the use of <a href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/HTTP\/Cookies#Secure_and_HttpOnly_cookies\">Secure and HttpOnly cookies<\/a>.<\/p>\n<\/blockquote>\n\n<p>Previously:<\/p>\n<ul>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2019\/08\/19\/webkit-tracking-prevention-policy\/\">WebKit Tracking Prevention Policy<\/a><\/li>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2019\/04\/30\/intelligent-tracking-prevention-2-2\/\">Intelligent Tracking Prevention 2.2<\/a><\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"<p>John Wilander: By limiting the ability to use any script-writeable storage for cross-site tracking purposes, ITP 2.3 makes sure that third-party scripts cannot leverage the storage powers they have gained over all these websites. [&#8230;] Our research has found that trackers, instead of decorating the link of the destination page, decorate their own referrer URL [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"apple_news_api_created_at":"2019-09-23T20:46:27Z","apple_news_api_id":"80c518b8-e968-4bdc-b3f7-1365c475afa6","apple_news_api_modified_at":"2019-09-25T18:16:10Z","apple_news_api_revision":"AAAAAAAAAAAAAAAAAAAAAA==","apple_news_api_share_url":"https:\/\/apple.news\/AgMUYuOloS9yz9xNlxHWvpg","apple_news_coverimage":0,"apple_news_coverimage_caption":"","apple_news_is_hidden":false,"apple_news_is_paid":false,"apple_news_is_preview":false,"apple_news_is_sponsored":false,"apple_news_maturity_rating":"","apple_news_metadata":"\"\"","apple_news_pullquote":"","apple_news_pullquote_position":"","apple_news_slug":"","apple_news_sections":"\"\"","apple_news_suppress_video_url":false,"apple_news_use_image_component":false,"footnotes":""},"categories":[2],"tags":[31,1667,30,1666,355,103,96,328],"class_list":["post-26654","post","type-post","status-publish","format-standard","hentry","category-technology","tag-ios","tag-ios-13","tag-mac","tag-macos-10-15","tag-privacy","tag-safari","tag-web","tag-webkit"],"apple_news_notices":[],"_links":{"self":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/26654","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/comments?post=26654"}],"version-history":[{"count":1,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/26654\/revisions"}],"predecessor-version":[{"id":26655,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/26654\/revisions\/26655"}],"wp:attachment":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/media?parent=26654"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/categories?post=26654"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/tags?post=26654"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}