7 ms·
I would like to be able to configure my browser to open every URL in a domain-specific "container", unless I say otherwise. Say site www.a.org includes an imag
by rlpb 10y ago
I would like to be able to configure my browser to open every URL in a domain-specific "container", unless I say otherwise.
Say site www.a.org includes an image from www.evilcorp.org, and www.evilcorp.org sets a cookie. When I then go to www.b.org and it includes an image from www.evilcorp.org, I don't expect the cookie to be sent back.
In other words, the cookie should be tied to www.a.org, even though it actually came from www.evilcorp.org. It should only be sent if my URL bar says www.a.org AND the image is coming from www.evilcorp.org.
I feel that this is how browsers should have been designed in the first place. I welcome this Container Tabs feature, but I don't think it quite goes far enough to restore my privacy.
- chii 10y agohow would you do oauth (or openid style login) with this then?
- rlpb 10y agoI would be happy to whitelist the sites with which I use oauth/openid to log in. If I didn't, it would still work; I'd just have to reauthenticate once for every site.
- bwilliams18 10y agoyou could even just whitelist oauth/openid to work across all sites.
- diafygi 10y agoNitpick: OAuth doesn't require cookies. You can track someone through the state parameter in the redirect url.
- oftenwrong 10y agoI generally disable third party cookies. Causes very few problems ime.
- pbhjpbhj 10y agoAs someone else intimated, isn't that just disabling 3rd party cookies, which has been a browser feature for ages?
- cornstalks 10y agoNo, because when you disable 3rd party cookies, then www.evilcorp.org can't even set its cookie on www.a.org.
- chei0iaV 10y agoSo, mission accomplished? I disabled 3rd party cookies ever since the option appeared in Firefox, and never had any issues.
- cornstalks 10y agoI disable 3rd party cookies too, but I've had several websites that have failed to work properly because of it. So now I've had to whitelist certain 3rd party cookies (e.g. accounts.google.com, payments.google.com, etc.). But since these domains are whitelisted, they can set their cookies from any website I visit. With the idea rlpb proposed, each website (and its permitted 3rd party cookies) would at least be in its own container.
- x1798DE 10y agoIf it were me, I'd like entire essentially unconnected sub-profiles, restricted by sites - different caches, potentially different extensions, etc. Even with third-party cookies disabled, you end up with little tricks to authenticate and track people across domains.
- the8472 10y ago> I would like to be able to configure my browser to open every URL in a domain-specific "container", unless I say otherwise. Sadly, that is currently not possible, not even with addons, because the containers can only be assigned when creating tabs, not when navigating them. There is a related feature (1st party isolation) but that is always-on, so it fails the unless I say otherwise aspect. I have filed a bug explaining my use-cases [0], but it does not seem to be a priority at the moment. (other addon devs signalling interest might help) [0] https://bugzilla.mozilla.org/show_bug.cgi?id=1323873 https://bugzilla.mozilla.org/show_bug.cgi?id=1323873
- tinus_hn 10y agoIt's more difficult than one might think to specify exactly while navigating where the old page goes away and the new one starts. Especially considering things like frames. Also if you start a new context every time you navigate you can't for instance log into Google.
- the8472 10y agoAddons get the necessary information. They can distinguish top level navigation from frames. And they could easily impose rules that keep google on the same container when needed. That's the point of having an addon API instead of fixed behavior, to implement logic around such complications.
- tinus_hn 10y agoIt's actually quite a difficult problem for the browsers themselves and they have all the information that's available. There have been a lot of issues with showing the new URL while the old page is still in the browser, for instance. Having special cases for every exception doesn't scale. What about Outlook Web Access using Microsoft accounts or domain accounts? Are you going to build an add on for every webmail installation?
- deleted 10y ago[deleted]
- SAI_Peregrinus 10y agoYou'd probably like Self-Destructing Cookies[1]. It's an addon that deletes all cookies set by a page after you close the tab by default, though you can change it per-page to delete only on closing the browser or never. It doesn't prevent the cookies from being set, but it does effectively prevent tracking if you close tabs frequently. [1] https://addons.mozilla.org/en-US/firefox/addon/self-destructing-cookies/ https://addons.mozilla.org/en-US/firefox/addon/self-destruct...
- 3minus1 10y agothis is just like browsing in incognito mode
- hobarrera 10y agoNot entirely, but it has it's similarities. Differences are: * History (Personally, can't live without it). * Whitelist (HN's cookies, for example, I keep). * Saving submitted form data (for auto-complete). * 10-seconds remorse time to reopen that tab and have it stay as it is!
- cpeterso 10y agoFirefox is integrating a cookie feature from Tor called first-party isolation or double-key cookies. It will separate third-party cookies for each first-party site, so evilcorp.org cookies for evilcorp.org images on a.org will not be set for evilcorp.org images on a.org. Blocking third-party cookies can break some site that rely on third-party resources, but first-party isolation should allow each site to work without cookie "crosstalk". You can test first-party isolation now by flipping the about:config pref "privacy.firstparty.isolate" to true. Beware that there are still bugs that break some sites, which is why the feature is not enabled by default yet. If you find bugs, please report them in Bugzilla! Here is the Firefox bug tracking the integration and known bugs: https://bugzilla.mozilla.org/show_bug.cgi?id=1299996 https://bugzilla.mozilla.org/show_bug.cgi?id=1299996
- gcb0 10y agobest thing that happened to mozilla was losing the money from google. yahoo pays them almost the same and does not meddle on anti tracking features. note how every single privacy feature came after google-money. during google-money what did we got? third party cookies accepted as default. good riddance, google.
- shostack 10y agoI'd love to know how those corporate conversations go exactly. Is it so blatant as saying "no you won't work on these anti tracking features?" Or is it more "this will be so you focus on" which conveniently excludes undesirable stuff?
- tomaskafka 10y agoThis. And, what is really Google paying them for? Ensuring that there is no mainstream browser left that would complicate things for ad/tracking sponsored web (and so never creating an incentive + ecosystem for any alternative)?
- hackuser 10y agoCould you provide some examples? That's a serious allegation. I remember, as a volunteer, debating some privacy issue with a Google dev in Bugzilla. They made some crack about looking a gift horse in the mouth, but the discussion was out in the open. I don't recall evidence that Google was influencing Firefox improperly, but OTOH absence of evidence is not evidence of absence ...
- sturmeh 10y agoAlternatively you can just block third-party cookies.
- hobarrera 10y agoSelf destructing cookies (Firefox plugin) is probably the closes you can get to that nowadays. Not really the same, but the end result is really similar.