11 ms·

This is why I use 'browser isolation', which is a way to separate different types of surfing activity into different buckets. Currently the best way to do this

This is why I use 'browser isolation', which is a way to separate different types of surfing activity into different buckets. Currently the best way to do this in Firefox is to create multiple profiles, or in Chrome, you can simply add a different user/persona. Having one profile, or even an entire dedicated browser just for Twitter/FB ensures the login is not spilled over into other sites. If you're surfing the web heavily, I would recommend spawning a new private window so cookies, and other artefacts are not bleeding into your session. It sounds like common sense, but many people have cookies and login information persisting for years at a time in their browsing sessions. The Mozilla Firefox team are planning to introduce a feature which makes compartmented surfing sessions a lot more user-friendly by separating sessions into tabs. Currently, the 'profiles' feature of Firefox is not user friendly and requires a bit of tinkering with the filesystem.

spacemanmatt 10y ago
I was horrified to find I'm logged in to FB with my 'common' cookie jar. At least that explains the recently increased accuracy of its targeted ads.
- to3m 10y ago
  I only ever log in to Facebook in private browsing mode.
  - GirlsCanCode 10y ago
    Facebook is among the worst for stalking you. For the once a quarter I log into Facebook (mostly for an occasional friendly note to highschool/college friends from 30+ years ago), I use a private session. And I have a plugin that blocks facebook tracking.
  - tankenmate 10y ago
    I only ever log into Facebook via a VPN to a remote VPS using a private window on a browser I don't use for anything else. And also... Chain OUTPUT (policy ACCEPT 6309 packets, 599K bytes) pkts bytes target prot opt in out source destination 330 19800 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 match-set block-facebook-ips dst reject-with icmp-port-unreachable I have an ipset that matches FB networks.
    - welanes 10y ago
      Yikes. Sounds easier just to not use Facebook.
      - tankenmate 10y ago
        There in lies the problem, all those Facebook widgets on various 3rd party websites are used to track you. If you block FB's network ranges then it gets much harder for them to do that. In effect you are "using" Facebook whether you want to or not; this is the issue some people have with shadow FB profiles.
    - sliverstorm 10y ago
      Careful, too strict and you'll start to be identifiable from your conspicuous lack of identifiable information ;)
  - spacemanmatt 10y ago
    I always use incognito mode but apparently I must have inadvertently logged in to a regular frame at some point. Horrified!
daleharvey 10y ago
Its only in testing right now, but Firefox Nightly has "Containers" so you can exactly have different "buckets" for different types of browsing - https://wiki.mozilla.org/Security/Contextual_Identity_Project/Containers https://wiki.mozilla.org/Security/Contextual_Identity_Projec...
- mahyarm 10y ago
  What I really want is something like this and it opening containers automatically based on url sets. So going to facebook would go to the facebook set automatically and isolate facebook. But I don't have to manually open the "facebook profile" to do the switch. Same with twitter, amazon, google*, youtube, apple, etc. If you have multiple accounts, you can have the interface pop up a "choose your subcontainer" automatically with the new google container or whatever. All browsing in that container would then stay in that subcontainer until you close it.
  - ethbro 10y ago
    After Firefox adds this, wouldn't that be a relatively simple plug-in? Just maintain a list of known info greedy URLs? (Note, not a tracker blocklist)
    - deleted 10y ago
      [deleted]
  - Normal_gaussian 10y ago
    and deny other containers from embedding facebook urls?
    - mahyarm 10y ago
      If you want. Put it as a checkmark option?
  - ufmace 10y ago
    Yeah, as long as it only activates that container based on typing in facebook or going to a bookmark, not just any random site hitting that URL. Which would then probably break following links to those sites - could you trigger it based on a normal navigation to that domain, but not based on some other site trying to fetch an image from it out of the blue?
mark_l_watson 10y ago
Great advice. I use Chrome for Google, twitter, and Facebook, and another browser for everything else. This isn't quite as good as your approach, but gives me some web platforms isolation.
b101010 10y ago
For anyone wanting to do this, the profile and no-remote command line options[1] may be useful if you want to create shortcuts to launch specific profiles You might also want to consider using a different theme[2] in each profile to help avoid mixing them up if your running multiple instances simultaneously. My initial use case for this was adding the lets encrypt staging certificate authority to the trusted root certificate authorities in a profile only used for testing. [1] https://developer.mozilla.org/en-US/docs/Mozilla/Command_Line_Options#-ProfileManager_or_-P https://developer.mozilla.org/en-US/docs/Mozilla/Command_Lin... [2] https://addons.mozilla.org/en-US/firefox/themes/ https://addons.mozilla.org/en-US/firefox/themes/
whamlastxmas 10y ago
Slightly easier way is to use the Disconnect/Privacy Badger extensions, along with uBlock Origin. It does a lot to prevent cookies from leaking across sites.
- jlarocco 10y ago
  Yeah. I use those, and this site doesn't do anything AFAICT.
- dwiel 10y ago
  I use all 3 of those and a few others, yet it still detected quite a few sites I was logged in to.
  - e_proxus 10y ago
    If you're still worried, I'd take the time to learn and use uMatrix (https://github.com/gorhill/uMatrix https://github.com/gorhill/uMatrix) in addition to uBlock. For me, uMatrix has replaced Privacy Badger and other similar addons because they're no longer needed. It requires a bit more effort to maintain though.
deleted 10y ago
[deleted]
givinguflac 10y ago
This seems like a good plan. However I find it funny that one would use Chrome and be concerned about sites gathering information about you.
aquilaFiera 10y ago
Firefox Nightly has container tabs available right now and they are fantastic! Only thing missing is a shortcut / better way to open a different type of container tab.
necessity 10y ago
Or you can enable basic privacy settings on about:config, NoScript, etc. I get "No platform" both on my phone and Desktop (though I don't have any social networks, I created a Facebook account to test).
j_s 10y ago
I use the http://qupzilla.com/ http://qupzilla.com/ browser because each private window is a new session, no cookies are shared between windows.
staticelf 10y ago
I also use seperate browsers for some stuff, but these two addons is a must: https://addons.mozilla.org/sv-SE/firefox/addon/self-destructing-cookies/ https://addons.mozilla.org/sv-SE/firefox/addon/self-destruct... together with https://addons.mozilla.org/sv-se/firefox/addon/i-dont-care-about-cookies/ https://addons.mozilla.org/sv-se/firefox/addon/i-dont-care-a...
Bartweiss 10y ago
At risk of being depressing, it's worth knowing that a dedicated profiler can reconcile accounts across all of the protections you've mentioned - not just as a targeted attack, but algorithmically. There are a lot of fingerprinting tricks which transcend cookie restrictions and user profiles. The battery percent/value one will reconcile all accounts on one device (as will several other like fonts). If you log into one bucket on multiple devices, it becomes possible to traverse devices and reconcile one-device profiles via the shared profile. If I were truly paranoid, I would only trust "separation" if it involved a clean account on a clean device on a clean network. None of which is to say that you shouldn't do this! I do lots of privacy things which aren't bulletproof, and I think other people should also. Fighting common tracking structures is still progress, and tools like bucketing and Privacy Badger are great ways to do this. It's just also worth noting that dedicated profiling will break all but the most pathological defensive measures.
- antocv 10y ago
  Indeed. Another trick is to change or settle for one very common user-agent across all browsers, and to run them with differently sized windows.
  - nitrogen 10y ago
    Be sure to use a common window size, though. If you pick a nice size with your mouse (as I always do), your window size is almost certainly unique when paired with just a few more bits of info.
  - emodendroket 10y ago
    At this point you may as well just go full rms and use wget to download pages which you then read offline.
    - andai 10y ago
      Would it be possible to make a browser plugin to do exactly that?
vacri 10y ago
> It sounds like common sense, but many people have cookies and login information persisting for years at a time in their browsing sessions. If it requires quite a bit of domain knowlege (almost everything in security does), it's not 'common sense'.
joosters 10y ago
Shouldn't disabling 3rd party cookies also prevent this kind of attack? The request for the facebook/twitter favicon is being made from a non-FB/TW page and so the login cookie won't be sent. This would depend upon how the browser implements its 3rd party cookie blocking. If it only blocks setting cookies, but still allows existing cookies to be sent, then there would be no protection.
i2shar 10y ago
Lately I've been using Opera Incognito with free builtin VPN for all general browsing and I highly recommend it. (I use Chrome to stay logged in to email).
Ankaios 10y ago
I've had a fantasy of not just using different browser profiles (effectively) for each site, but routing requests for each site through a different personally-run cloud-hosted proxy. Someday maybe I'll get around to setting it up. Maybe.

spacemanmatt 10y ago

I was horrified to find I'm logged in to FB with my 'common' cookie jar. At least that explains the recently increased accuracy of its targeted ads.

to3m 10y ago
I only ever log in to Facebook in private browsing mode.
- GirlsCanCode 10y ago
  Facebook is among the worst for stalking you. For the once a quarter I log into Facebook (mostly for an occasional friendly note to highschool/college friends from 30+ years ago), I use a private session. And I have a plugin that blocks facebook tracking.
- tankenmate 10y ago
  I only ever log into Facebook via a VPN to a remote VPS using a private window on a browser I don't use for anything else. And also... Chain OUTPUT (policy ACCEPT 6309 packets, 599K bytes) pkts bytes target prot opt in out source destination 330 19800 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 match-set block-facebook-ips dst reject-with icmp-port-unreachable I have an ipset that matches FB networks.
  - welanes 10y ago
    Yikes. Sounds easier just to not use Facebook.
    - tankenmate 10y ago
      There in lies the problem, all those Facebook widgets on various 3rd party websites are used to track you. If you block FB's network ranges then it gets much harder for them to do that. In effect you are "using" Facebook whether you want to or not; this is the issue some people have with shadow FB profiles.
  - sliverstorm 10y ago
    Careful, too strict and you'll start to be identifiable from your conspicuous lack of identifiable information ;)
- spacemanmatt 10y ago
  I always use incognito mode but apparently I must have inadvertently logged in to a regular frame at some point. Horrified!

daleharvey 10y ago

Its only in testing right now, but Firefox Nightly has "Containers" so you can exactly have different "buckets" for different types of browsing - https://wiki.mozilla.org/Security/Contextual_Identity_Project/Containers https://wiki.mozilla.org/Security/Contextual_Identity_Projec...

mahyarm 10y ago
What I really want is something like this and it opening containers automatically based on url sets. So going to facebook would go to the facebook set automatically and isolate facebook. But I don't have to manually open the "facebook profile" to do the switch. Same with twitter, amazon, google*, youtube, apple, etc. If you have multiple accounts, you can have the interface pop up a "choose your subcontainer" automatically with the new google container or whatever. All browsing in that container would then stay in that subcontainer until you close it.
- ethbro 10y ago
  After Firefox adds this, wouldn't that be a relatively simple plug-in? Just maintain a list of known info greedy URLs? (Note, not a tracker blocklist)
  - deleted 10y ago
    [deleted]
- Normal_gaussian 10y ago
  and deny other containers from embedding facebook urls?
  - mahyarm 10y ago
    If you want. Put it as a checkmark option?
- ufmace 10y ago
  Yeah, as long as it only activates that container based on typing in facebook or going to a bookmark, not just any random site hitting that URL. Which would then probably break following links to those sites - could you trigger it based on a normal navigation to that domain, but not based on some other site trying to fetch an image from it out of the blue?

mark_l_watson 10y ago

Great advice. I use Chrome for Google, twitter, and Facebook, and another browser for everything else. This isn't quite as good as your approach, but gives me some web platforms isolation.

b101010 10y ago

For anyone wanting to do this, the profile and no-remote command line options[1] may be useful if you want to create shortcuts to launch specific profiles You might also want to consider using a different theme[2] in each profile to help avoid mixing them up if your running multiple instances simultaneously. My initial use case for this was adding the lets encrypt staging certificate authority to the trusted root certificate authorities in a profile only used for testing. [1] https://developer.mozilla.org/en-US/docs/Mozilla/Command_Line_Options#-ProfileManager_or_-P https://developer.mozilla.org/en-US/docs/Mozilla/Command_Lin... [2] https://addons.mozilla.org/en-US/firefox/themes/ https://addons.mozilla.org/en-US/firefox/themes/

whamlastxmas 10y ago

Slightly easier way is to use the Disconnect/Privacy Badger extensions, along with uBlock Origin. It does a lot to prevent cookies from leaking across sites.

jlarocco 10y ago
Yeah. I use those, and this site doesn't do anything AFAICT.
dwiel 10y ago
I use all 3 of those and a few others, yet it still detected quite a few sites I was logged in to.
- e_proxus 10y ago
  If you're still worried, I'd take the time to learn and use uMatrix (https://github.com/gorhill/uMatrix https://github.com/gorhill/uMatrix) in addition to uBlock. For me, uMatrix has replaced Privacy Badger and other similar addons because they're no longer needed. It requires a bit more effort to maintain though.

deleted 10y ago

[deleted]

givinguflac 10y ago

This seems like a good plan. However I find it funny that one would use Chrome and be concerned about sites gathering information about you.

aquilaFiera 10y ago

Firefox Nightly has container tabs available right now and they are fantastic! Only thing missing is a shortcut / better way to open a different type of container tab.

necessity 10y ago

Or you can enable basic privacy settings on about:config, NoScript, etc. I get "No platform" both on my phone and Desktop (though I don't have any social networks, I created a Facebook account to test).

j_s 10y ago

I use the http://qupzilla.com/ http://qupzilla.com/ browser because each private window is a new session, no cookies are shared between windows.

staticelf 10y ago

I also use seperate browsers for some stuff, but these two addons is a must: https://addons.mozilla.org/sv-SE/firefox/addon/self-destructing-cookies/ https://addons.mozilla.org/sv-SE/firefox/addon/self-destruct... together with https://addons.mozilla.org/sv-se/firefox/addon/i-dont-care-about-cookies/ https://addons.mozilla.org/sv-se/firefox/addon/i-dont-care-a...

Bartweiss 10y ago

At risk of being depressing, it's worth knowing that a dedicated profiler can reconcile accounts across all of the protections you've mentioned - not just as a targeted attack, but algorithmically. There are a lot of fingerprinting tricks which transcend cookie restrictions and user profiles. The battery percent/value one will reconcile all accounts on one device (as will several other like fonts). If you log into one bucket on multiple devices, it becomes possible to traverse devices and reconcile one-device profiles via the shared profile. If I were truly paranoid, I would only trust "separation" if it involved a clean account on a clean device on a clean network. None of which is to say that you shouldn't do this! I do lots of privacy things which aren't bulletproof, and I think other people should also. Fighting common tracking structures is still progress, and tools like bucketing and Privacy Badger are great ways to do this. It's just also worth noting that dedicated profiling will break all but the most pathological defensive measures.

antocv 10y ago
Indeed. Another trick is to change or settle for one very common user-agent across all browsers, and to run them with differently sized windows.
- nitrogen 10y ago
  Be sure to use a common window size, though. If you pick a nice size with your mouse (as I always do), your window size is almost certainly unique when paired with just a few more bits of info.
- emodendroket 10y ago
  At this point you may as well just go full rms and use wget to download pages which you then read offline.
  - andai 10y ago
    Would it be possible to make a browser plugin to do exactly that?

vacri 10y ago

> It sounds like common sense, but many people have cookies and login information persisting for years at a time in their browsing sessions. If it requires quite a bit of domain knowlege (almost everything in security does), it's not 'common sense'.

joosters 10y ago

Shouldn't disabling 3rd party cookies also prevent this kind of attack? The request for the facebook/twitter favicon is being made from a non-FB/TW page and so the login cookie won't be sent. This would depend upon how the browser implements its 3rd party cookie blocking. If it only blocks setting cookies, but still allows existing cookies to be sent, then there would be no protection.

i2shar 10y ago

Lately I've been using Opera Incognito with free builtin VPN for all general browsing and I highly recommend it. (I use Chrome to stay logged in to email).

Ankaios 10y ago

I've had a fantasy of not just using different browser profiles (effectively) for each site, but routing requests for each site through a different personally-run cloud-hosted proxy. Someday maybe I'll get around to setting it up. Maybe.