Party cookies - web analytics

In my post Party cookies - first or third-context i discovered how IE distinguish between first- and third-party cookies. A very common use for third party cookies is/was for tracking users on websites, but that is challenged by how both browsers and users react to cookies (both first and third part).

JupiterResearch did a study on cookie deletion in 2005, covered in Study: Consumers Delete Cookies at Surprising Rate which found that 17 percent of Internet users delete cookies on a weekly basis. Approximately 12 percent do so on a monthly basis, and 10 percent make it a daily habit

The problem with it is that:

The key finding is that a lot of companies have placed a lot of reliance on cookies for audience measurement and the cookie is at risk as a mechanism for tracking people over time," said Eric Petersen, the lead analyst on the report. That made similar reactions in other medias with titles like Faster Migration to First-Party Cookies Urged and 3rd Party Cookies Are Dead. This got addressed by tracking software like opentracker in All About (third-party) Cookies and recommeded best practice like WebTrends Advises Sites to Move to First-Party Cookies Based on Four-Fold Increase in Third-Party Cookie Rejection Rates and Best Practices for Accurate Web Analytics Avoiding Third-Party Cookie Rejection and Deletion.

In a more recent press release by ComScore Cookie-Based Counting Overstates Size of Web Site Audiences has the headline Frequent Cookie Deletion by 3 out of 10 U.S. Internet Users Leads to Overstatements in Audience Sizes by a Factor as High as 2.5. The difference here is that it's not just third party cookies that are being deleted (as expected) but also first party cookies There is a common perception that third-party cookie deletion rates should be significantly higher than first-party cookie deletion rates but there is almost no difference.

MYMOTECH has an analysis of the press release called Pass the Cookies: Interpreting Comscores Cookie Press Release.

Google Analytics that I user here at my blog (very very low traffic) should be using first party cookies, which is something I'll look into later.

Party cookies - first or third-context

Internet Explorer 6+ (IE) has default privacy policy to block third party cookies in ex. iframe's. How exactly is first and third party defined and thereby how can this obstacle be overcome?

In the Microsoft Windows XP article Understanding cookies the description is:

A first-party cookie either originates on or is sent to the Web site you are currently viewing. These cookies are commonly used to store information, such as your preferences when visiting that site.

A third-party cookie either originates on or is sent to a Web site different from the one you are currently viewing. Third-party Web sites usually provide some content on the Web site you are viewing. For example, many sites use advertising from third-party Web sites and those third-party Web sites may use cookies. A common use for this type of cookie is to track your Web page use for advertising or other marketing purposes. Third-party cookies can either be persistent or temporary.

The definition for first-party is the Web site you are currently viewing, and reading it like this it seems that there is just one first-party and the rest i third-party. But that's not true, well that depends on how you interpret it, because the most precise definition that I've found is in Privacy in Internet Explorer 6 in the section First and Third-Party Context:

Internet Explorer 6 defines first-party content as content associated with the host domain. Third-party content originates from any other domain. For example, suppose a user visits www.wideworldimporters.com by typing this URL in the address bar, and www.wingtiptoys.com has a banner ad on this page. If these two sites set cookies, the cookies from www.wideworldimporters.com are in a first-party context while the cookies from www.wingtiptoys.com are in a third-party context.

Often commercial Web pages are an amalgamation of first- and third-party content. The Internet Explorer 6 privacy features distinguish between first- and third-party content. The underlying assumption is that users have a different relationship with first parties than with third parties. In fact, users might not be aware of the third party or be given a choice of whether to have a relationship with it. For this reason, default privacy settings for third parties are more stringent than for first parties.

but it's in the associated note it's written crystal clear:

The URLs www.wideworldimporters.com and toys.wideworldimporters.com both contain the same minimal domain, wideworldimporters.com. Content that shares the same minimal domain as the host domain is considered first-party content. Likewise, cookies set from these domains are considered first-party cookies. Minimal domains must have the same top-level domain (TLD). Some common examples of TLDs are .com, .net, and .org.

I haven't heard the term minimal domain before but it's ituitive to understand. It matches (sort of) the definition of a domain cookie as defined in RFC 2965 - HTTP State Management Mechanism:

Host names can be specified either as an IP address or a HDN string. Sometimes we compare one host name with another. (Such comparisons SHALL be case-insensitive.) Host A's name domain-matches host B's if

• their host name strings string-compare equal; or
• A is a HDN string and has the form NB, where N is a non-empty name string, B has the form .B', and B' is a HDN string. (So, x.y.com domain-matches .Y.com but not Y.com.)

It's fair enough to expect the owner of a domain to take responsibility of all webservers/hosts on that domain, making it a domain of trust. Though be aware that the P3P privacy policy is per host (and/or subdomain) and not per minimal domain as illustrated in spywarewarrior's Internet Privacy w/ IE6 & P3P: A Summary of Findings the section First-Party vs. Third-Party.

Next I'll have a quick look at P3P.

WS-RX hopefully on it's way to become an OASIS standard

It's been a long journey even though or maybe just because it started out with two specifications. Paul Freemantle wrote about the reason for the last delay of WS-RX but now the Balloting for OASIS Standard - WS-ReliableMessaging 1.1 is on. The critical number of affirmative votes required to approve this ballot is 51, and right now the status page gives a count of 43 positive votes of a potential total of 337, so with more than a week left it finally looks like the last child of the WS-*X family will succeed.

Danish eGovernment Federation standard makes Microsoft support SAML 2.0 Token format

The fight between SAML 2.0 and WS-Federation has been present in Danish eGovernment for some time, and here the choice has fallen on SAML 2.0, being an OASIS standard with a fair product support. There's more background information on that on Denmarks choice of SAML as the federation standard.

Newly the Danish National IT and Telecom Agency (DNITA) has announced an agreement with Microsoft about partial support for SAML 2.0. The central part of the quote from the agreement is:

To support interoperability between WS-Federation and SAML 2.0 based products Microsoft has agreed to support the SAML 2.0 token format in the future release of Active Directory Federation Services code-named Active Directory Federation Services 2.

So it's only the Token format and it's not until the next version of ADFS, but god news is always welcome. It also mentions that WS-Federation has recently been submitted to OASIS, and adds:

This step further enables interoperability between federated environments that deploy SAML 2.0-based products and those that deploy WS-Federation-based products.

Well I'll say the jury is still out on that one as I've touch on in Federation power fight in the backyard of OASIS. As for the prior fight between SAML 2.0 and WS-Federation, I've found some articles like Microsoft Backs Web Services-Federation Against SAML 2.0 For Identity Federation and Vendors team on WS-Federation standard

Federation power fight in the backyard of OASIS

First there was the clash of reliable web services messaging in OASIS. Second the outlook for a potential double ISO standard for document formats and now the next power fight looks to be on federation standards inside Oasis.

About a month ago OASIS let the word out with a Call for Participation on Web Services Federation. So what's the party about? you might ask, well you can start by reading the complete mail - it's long, so at a glance it looks like a lot of work has to be done, I guess it's a draft for the TC charter. The reason I write looks like is that the work kicks off on a version 1.1 of the WS-Federation specification, and I can't tell how close a match there is between the charter and the latest specification. One evil thought is that since the description is so detailed it could look like an attempt to rubber stamp the submitted specification, but a bit more on that later.

Version 1.0

The two versions of the specification can be found on the IBM WS-Federation site. The first version of Web Services Federation Language (WS-Federation) from July 8 2003 is 41 pages. The WSDL has 9 wsdl:message's:

• SignOutMsg
• RequestSSOMessagesMsg
• CancelSSOMessagesMsg
• GetPseudonymMsg
• GetPseudonymResponseMsg
• SetPseudonymMsg
• SetPseudonymResponseMsg
• DeletePseudonymMsg
• DeletePseudonymResponseMsg

and 12 wsdl:operation's (spread over 6 wsd:portType's ):

• SignOut
• RequestSSO
• CancelSSO
• GetPseudonymResponse
• SetPseudonymResponse
• DeletePseudonymResponse
• GetPseudonymRequest
• SetPseudonymRequest
• DeletePseudonymRequest
• GetPsuedonym
• SetPsuedonym
• DeletePsuedonym

This initial version was developed by

• BEA Systems, Inc.
• IBM Corporation
• Microsoft Corporation
• RSA Security, Inc.
• Verisign, Inc.

Version 1.1

Web The second version (Version 1.1) is from December 2006 and has triple the original size with 124 pages. This version has some new participants and RSA missing (the new ones in bold):

• BEA Systems, Inc.
• BMC Software
• CA, Inc.
• International Business Machines Corporation
• Layer 7 Technologies
• Microsoft Corporation, Inc.
• Novell, Inc.
• VeriSign, Inc.

As for the WSDL for version 1.1 it's a bit strange. There's only one wsdl:message called SignOut and two wsdl:operation's in seperate wsdl:portType's. I haven't dived into the specification yet, so maybe all the former operations stick, though not likely and in Appendix I - WSDL there's an example with the text The following illustrates the WSDL for the Web service methods described in this specification and it references 5 specifications whereof only one is a standard:

• WS-Trust (OASIS Standard)
• WS-MEX
• WS-Eventing (W3C Member Submission 15 March 2006)
• WS-Transfer (W3C Member Submission 27 September 2006)
• WS-ResourceTransfer

one conclusion could be that since 2003 there has been a massive convergence (and spread over new WS-Star specs) that the majority of operations are defined in other specifications.

Counting points - the fight is on

In the mix of paranoia, conspiracy and facts it's interesting to read the comments resolution log (pdf). There has already been said and written a lot about this, here are a couple of my picks: Burton Group, Eve Maler and Tim Bray. As usual the coverpages has a great collection of resources.