5 ms·

This is a neat idea but it doesn't implement the main reason I use separate profiles in Chromium - different security contexts based on how much you trust a sit

by nikcub 10y ago

This is a neat idea but it doesn't implement the main reason I use separate profiles in Chromium - different security contexts based on how much you trust a site. Example: my main general browsing profile has flash, PDFs and all plugins disabled, absolutely all handlers switched off, all hardware access off, WebGL switched off, no account logins and uBlock Origin set to aggressively block most third-party requests. My second most used context is for personal sites I login for - with access to third-party cookies (for those sites) and running most third-party requests with standard uBlock rules. I have yet other contexts (Chrome profiles) where Flash is enabled if I need that, then a separate browser for Java etc. I'd like to see these security levels built into browsers where the contexts are built around permissions and site trust rather than access to the user store (which is also important) I don't think it's realistic for most users to do this right now with profiles, as it requires a lot of discipline - it needs to be in the UI. Browsers have become as sophisticated as operating systems and we're accessing more and more of our personal data using them, yet the model of 'every site has access to everything' be it a site you trust, like Gmail, or a random URL you're clicking on - has somehow survived. It's the equivalent of the old days where everyone would run their local systems with an admin account for everything. I really think browsers need a rethink along these lines where websites are treated like apps and you can apply a trust group to each.

TheDong 10y ago
The firefox feature of `--no-remote -P` is the way to do that, which has existed since before the chrome browser did. Old feature. This feature is not meant to solve that use-case since if your case is security, you need separate browsers/contexts/proceses anyways. Separate profiles in firefox implement separate profiles (which may all be independently open side-by-side in different windows). This exchanges less secure/strong separation with better UX by intermingling. Firefox is just choosing to support either set of tradeoffs there.
- mverwijs 10y ago
  Old perhaps, but userfriendly this is not.
  - drc0 10y ago
    there are extensions like switchy that handle the UX part in a reasonable way.
  - hackuser 10y ago
    I wonder how many users understand the concept of profiles and the session isolation they provide, want to use them, yet find the command line too difficult to use.
    - TheDong 10y ago
      Since they're akin to user accounts on windows, I'd assume a decent number of users understand them. Even though people don't use multiple-user-accounts too much anymore, it's still usually present in schools and in older family computers. Conceptually they're very similar.
    - exadeci 10y ago
      Most user won't even be aware of the possibility of using profiles, ask any of your relatives. While if you had a "Create a new profile" button that does it in one step and that they would advertise on install much more people would be using it, even if it's just for family members separation.
      - WorldMaker 10y ago
        Old Netscape/Firefox builds used to start with the Profile creation/selection screen by default (which is the -ProfileManager CLI option that remains today) and someone can correct me if I am wrong, but the consensus seemed to be that it confused people more than it helped them. The majority of people already separate family members with different user accounts on the machine or mostly just don't seem to care. This seems to be the interesting UX compromise that the new "Container Tabs" is trying to meet "where they live": the users that could use some of the advantages of profiles without the full overhead of using multiple profiles. It will be interesting to see if the compromise is picked up by average users. (Fwiw, I've used multiple profiles in Firefox off and on for decades but have yet to find a relative I'd recommend that to.)
vosper 10y ago
I'm genuinely not trolling here: what are you worried could happen if you didn't do all of this stuff with the extensions and settings in your various profiles? What does it mean to trust a website?
- jolux 10y ago
  I turn all of those Chrome features off everywhere anyways. I find the handlers to be especially annoying. Why the fuck would I want that? There's a reason I use Mail.app and it's not because I love using email in web views.
  - homakov 10y ago
    Isn't mailto: opening Mail.app for you?
    - jolux 10y ago
      yes, but Chrome bugs me about switching it to Gmail every time.
- mememachine 10y ago
  Chances are he is either insane or is accessing a lot of very important information
- thenomad 10y ago
  From past experience, and the reason I browse with some fairly aggressive security settings (not the OP): I'm worried I could acquire a nasty rootkit-level virus. I'm worried about that because I used to browse with no Noscript/similar, and then I got a infected by a rootkit, which I traced back to a new site I'd visited. Since I didn't enjoy having to nuke my entire computer environment from orbit, I now have a rather locked-down browser.
nsgi 10y ago
You can already disable flash, javascript and cookies by site. That covers pretty much everything from site logins to WebGL.
gcb0 10y ago
you are using the wrong tool. install NoScript in firefox and allow flash/etc per domain temporarily or permanently. profiles/context tab is all about tracking. You just happen to successfully abuse one tool to your ends in one case.
- sametmax 10y ago
  NoScript is a pain to use and configure. And you need to finely tune it. With this profile method, you can have a "all-in" profile, and a "safe" one. This makes things much easier to manager.
  - gcb0 10y ago
    1. install it. and close the annoying tab. 2. visit a site, click the noscript icon 3. allow the domains you trust. no step 4. how is this hard? you only have to click the icon again if some site is not working.
    - sametmax 10y ago
      > you only have to click the icon again if some site is not working. And then you start realizing that blocking all scripts is a pain. You want just this script to work, but not this one. So you start filtering and it takes so much time. Then often, a site is not working exactly right, and you don't know no-script screw you. Sometime you realize it after 10 minutes looking for something no-script removed. Waste of time. Then you for some time you want it one for a site, then off for the same site. And on. And off. And you have 30 tabs, then you have to jungle with the state of it.
- hackuser 10y ago
  I'd take a look at uMatrix, which is easier and more granular than NoScript (but lacks the more in-depth security features). It allows you to block/allow cookies, css, images, plugins, scripts, frames, and more on local/remote host basis. For example, when visiting example.com you could allow scripts from example.com but not from gstatic.com, analyticshost.com, or shadylookingdomain.com. Yet at domain.com you could allow gstatic.com scripts and images because it embeds Google Maps. It's all done in an amazing, quick GUI that provides a visualization of the rules. I wish all firewalls would adopt the UI.
qrco 10y ago
where do you set those configurations? (handlers, hardware access, flash, pdf, webgl) do you have a link to an official chrome help page? also what chromium do you use? and where did you get it? sorry for my ignorance.
rsync 10y ago
"I'd like to see these security levels built into browsers where the contexts are built around permissions and site trust rather than access to the user store (which is also important)" I want to take it all the way to eleven and 'jail' a gui process (in this case, the web browser - any web browser). It gets its own filesystem root and its own IP BUT I don't have to pay the penalties of firing up a full blown virtual machine. This isn't easy to do in the way that, for instance, jailing a daemon is easy to do ... Further, even if I did have a workable recipe to jail a chrome process (and all of it's children) it would certainly only be for X. Maybe there's some recipe for that in OSX but it would be profoundly different. OSX doesn't even have the 'jail' command (although it does have chroot ...)
- d33 10y ago
  For a partial solution, have a look at "sandbox -X" (man 8 sandbox).
  - db48x 10y ago
    Agreed, although be aware that this is only available when you're using SELinux. By default that's Fedora/Centos/RHEL, not Debian/Ubuntu.
- raesene9 10y ago
  depending on your OS of choice, desktop containers using something like docker (e.g. https://blog.jessfraz.com/post/docker-containers-on-the-desktop/ https://blog.jessfraz.com/post/docker-containers-on-the-desk...) can achieve it and are a reasonably straightforward (for a certain value of straightforard) option (linux only unfortunately...)
  - the_why_of_y 10y ago
    > The images work by mounting the X11 socket into the container! Yippeeeee! Well, yippee, now the application can read all keyboard input from that X11 socket, there goes your "sandbox"... You really need Wayland to get a practical security benefit for GUI applications from containers.
234dd57d2c8db 10y ago
Don't forget about firejail. No reason your browser process should be able to read your ssh keys.

by nikcub 10y ago

TheDong 10y ago

The firefox feature of `--no-remote -P` is the way to do that, which has existed since before the chrome browser did. Old feature. This feature is not meant to solve that use-case since if your case is security, you need separate browsers/contexts/proceses anyways. Separate profiles in firefox implement separate profiles (which may all be independently open side-by-side in different windows). This exchanges less secure/strong separation with better UX by intermingling. Firefox is just choosing to support either set of tradeoffs there.

mverwijs 10y ago
Old perhaps, but userfriendly this is not.
- drc0 10y ago
  there are extensions like switchy that handle the UX part in a reasonable way.
- hackuser 10y ago
  I wonder how many users understand the concept of profiles and the session isolation they provide, want to use them, yet find the command line too difficult to use.
  - TheDong 10y ago
    Since they're akin to user accounts on windows, I'd assume a decent number of users understand them. Even though people don't use multiple-user-accounts too much anymore, it's still usually present in schools and in older family computers. Conceptually they're very similar.
  - exadeci 10y ago
    Most user won't even be aware of the possibility of using profiles, ask any of your relatives. While if you had a "Create a new profile" button that does it in one step and that they would advertise on install much more people would be using it, even if it's just for family members separation.
    - WorldMaker 10y ago
      Old Netscape/Firefox builds used to start with the Profile creation/selection screen by default (which is the -ProfileManager CLI option that remains today) and someone can correct me if I am wrong, but the consensus seemed to be that it confused people more than it helped them. The majority of people already separate family members with different user accounts on the machine or mostly just don't seem to care. This seems to be the interesting UX compromise that the new "Container Tabs" is trying to meet "where they live": the users that could use some of the advantages of profiles without the full overhead of using multiple profiles. It will be interesting to see if the compromise is picked up by average users. (Fwiw, I've used multiple profiles in Firefox off and on for decades but have yet to find a relative I'd recommend that to.)

vosper 10y ago

I'm genuinely not trolling here: what are you worried could happen if you didn't do all of this stuff with the extensions and settings in your various profiles? What does it mean to trust a website?

jolux 10y ago
I turn all of those Chrome features off everywhere anyways. I find the handlers to be especially annoying. Why the fuck would I want that? There's a reason I use Mail.app and it's not because I love using email in web views.
- homakov 10y ago
  Isn't mailto: opening Mail.app for you?
  - jolux 10y ago
    yes, but Chrome bugs me about switching it to Gmail every time.
mememachine 10y ago
Chances are he is either insane or is accessing a lot of very important information
thenomad 10y ago
From past experience, and the reason I browse with some fairly aggressive security settings (not the OP): I'm worried I could acquire a nasty rootkit-level virus. I'm worried about that because I used to browse with no Noscript/similar, and then I got a infected by a rootkit, which I traced back to a new site I'd visited. Since I didn't enjoy having to nuke my entire computer environment from orbit, I now have a rather locked-down browser.

nsgi 10y ago

You can already disable flash, javascript and cookies by site. That covers pretty much everything from site logins to WebGL.

gcb0 10y ago

you are using the wrong tool. install NoScript in firefox and allow flash/etc per domain temporarily or permanently. profiles/context tab is all about tracking. You just happen to successfully abuse one tool to your ends in one case.

sametmax 10y ago
NoScript is a pain to use and configure. And you need to finely tune it. With this profile method, you can have a "all-in" profile, and a "safe" one. This makes things much easier to manager.
- gcb0 10y ago
  1. install it. and close the annoying tab. 2. visit a site, click the noscript icon 3. allow the domains you trust. no step 4. how is this hard? you only have to click the icon again if some site is not working.
  - sametmax 10y ago
    > you only have to click the icon again if some site is not working. And then you start realizing that blocking all scripts is a pain. You want just this script to work, but not this one. So you start filtering and it takes so much time. Then often, a site is not working exactly right, and you don't know no-script screw you. Sometime you realize it after 10 minutes looking for something no-script removed. Waste of time. Then you for some time you want it one for a site, then off for the same site. And on. And off. And you have 30 tabs, then you have to jungle with the state of it.
hackuser 10y ago
I'd take a look at uMatrix, which is easier and more granular than NoScript (but lacks the more in-depth security features). It allows you to block/allow cookies, css, images, plugins, scripts, frames, and more on local/remote host basis. For example, when visiting example.com you could allow scripts from example.com but not from gstatic.com, analyticshost.com, or shadylookingdomain.com. Yet at domain.com you could allow gstatic.com scripts and images because it embeds Google Maps. It's all done in an amazing, quick GUI that provides a visualization of the rules. I wish all firewalls would adopt the UI.

qrco 10y ago

where do you set those configurations? (handlers, hardware access, flash, pdf, webgl) do you have a link to an official chrome help page? also what chromium do you use? and where did you get it? sorry for my ignorance.

rsync 10y ago

"I'd like to see these security levels built into browsers where the contexts are built around permissions and site trust rather than access to the user store (which is also important)" I want to take it all the way to eleven and 'jail' a gui process (in this case, the web browser - any web browser). It gets its own filesystem root and its own IP BUT I don't have to pay the penalties of firing up a full blown virtual machine. This isn't easy to do in the way that, for instance, jailing a daemon is easy to do ... Further, even if I did have a workable recipe to jail a chrome process (and all of it's children) it would certainly only be for X. Maybe there's some recipe for that in OSX but it would be profoundly different. OSX doesn't even have the 'jail' command (although it does have chroot ...)

d33 10y ago
For a partial solution, have a look at "sandbox -X" (man 8 sandbox).
- db48x 10y ago
  Agreed, although be aware that this is only available when you're using SELinux. By default that's Fedora/Centos/RHEL, not Debian/Ubuntu.
raesene9 10y ago
depending on your OS of choice, desktop containers using something like docker (e.g. https://blog.jessfraz.com/post/docker-containers-on-the-desktop/ https://blog.jessfraz.com/post/docker-containers-on-the-desk...) can achieve it and are a reasonably straightforward (for a certain value of straightforard) option (linux only unfortunately...)
- the_why_of_y 10y ago
  > The images work by mounting the X11 socket into the container! Yippeeeee! Well, yippee, now the application can read all keyboard input from that X11 socket, there goes your "sandbox"... You really need Wayland to get a practical security benefit for GUI applications from containers.

234dd57d2c8db 10y ago

Don't forget about firejail. No reason your browser process should be able to read your ssh keys.