4 ms·

Thanks for sharing the script! This is a more "complete" version of Firefox Multi-Account Containers. Is there any concrete advantage in doing this versus openi

by QasimK 9y ago

Thanks for sharing the script! This is a more "complete" version of Firefox Multi-Account Containers. Is there any concrete advantage in doing this versus opening Firefox in a new profile? For example, do Firefox profiles share some browser download caches?

hazeii 9y ago
I'm not familiar with Firefox Multi-account containers; do they use separate Unix accounts? (since my approach means Firefox is running as a completely diffrent user, a simple firefox compromise or bug shouldn't be able to access anything sensitive on the main account - like SSH keys, say).
- regecks 9y ago
  They're not containers as in Linux containers, they're "contextual identities" within the same Firefox process, that isolate things like cookies. Much weaker isolation (technologically) than process/user privilege separation, but OTOH highly usable. (Well, there's the e10s process separation, but nothing anything extra for multi-account containers, as far as I understand). What things it isolates are listed here: https://wiki.mozilla.org/Security/Contextual_Identity_Project/Containers#Implementation_Details https://wiki.mozilla.org/Security/Contextual_Identity_Projec... FWIW they work great.
- QasimK 9y ago
  I don't think they offer much in the way of security, but they do let you isolate the websites you choose from each other. I wrote a very small blog post about them: http://iamqasimk.com/2017/11/21/firefox-containers/ http://iamqasimk.com/2017/11/21/firefox-containers/
Santosh83 9y ago
AFAIK Firefox profiles should give you the same kind of privacy as running them under different user accounts.
- hazeii 9y ago
  Indeed, that's the approach I use to run multiple copies of Thunderbird. Using a separate account does add protection against browser exploits though (if visiting an interesting-but-risky site, the 'guest' account approach prevents access to the main account - at least as long as a browser exploit doesn't then lead to a privilege escalation).
  - tinus_hn 9y ago
    Although exploitation is more difficult, all programs that run in an X session have complete access to all the other programs in it, regardless of user ids or for that matter the host the program is running on.
    - mikedelfino 9y ago
      You can use xauth to get an Xauthority cookie for untrusted clients, so they can't meddle with other X clients. The biggest downside is that you lose access to the X clipboard - which is also good, so its data doesn't get compromised.
      - tinus_hn 9y ago
        I did not know that. Turns out it’s a bit weak though, all untrusted clients have full access to all other untrusted clients. So you only have two levels. Still, better than nothing.
    - hazeii 9y ago
      As a simple demo of this, running 'gimp' as a 'guest' user allows you to take screenshots of windows owned by the user who started the session. Thus, a compromised copy of firefox on the 'guest' account could, for example, easily capture the contents of any window on the system. Still, the main reason I run the browser as a different user is to isolate it for privacy; there are some security benefits too, but I agree it's not something that would defeat a targetted attack.

by QasimK 9y ago

hazeii 9y ago

I'm not familiar with Firefox Multi-account containers; do they use separate Unix accounts? (since my approach means Firefox is running as a completely diffrent user, a simple firefox compromise or bug shouldn't be able to access anything sensitive on the main account - like SSH keys, say).

regecks 9y ago
They're not containers as in Linux containers, they're "contextual identities" within the same Firefox process, that isolate things like cookies. Much weaker isolation (technologically) than process/user privilege separation, but OTOH highly usable. (Well, there's the e10s process separation, but nothing anything extra for multi-account containers, as far as I understand). What things it isolates are listed here: https://wiki.mozilla.org/Security/Contextual_Identity_Project/Containers#Implementation_Details https://wiki.mozilla.org/Security/Contextual_Identity_Projec... FWIW they work great.
QasimK 9y ago
I don't think they offer much in the way of security, but they do let you isolate the websites you choose from each other. I wrote a very small blog post about them: http://iamqasimk.com/2017/11/21/firefox-containers/ http://iamqasimk.com/2017/11/21/firefox-containers/

Santosh83 9y ago

AFAIK Firefox profiles should give you the same kind of privacy as running them under different user accounts.

hazeii 9y ago
Indeed, that's the approach I use to run multiple copies of Thunderbird. Using a separate account does add protection against browser exploits though (if visiting an interesting-but-risky site, the 'guest' account approach prevents access to the main account - at least as long as a browser exploit doesn't then lead to a privilege escalation).
- tinus_hn 9y ago
  Although exploitation is more difficult, all programs that run in an X session have complete access to all the other programs in it, regardless of user ids or for that matter the host the program is running on.
  - mikedelfino 9y ago
    You can use xauth to get an Xauthority cookie for untrusted clients, so they can't meddle with other X clients. The biggest downside is that you lose access to the X clipboard - which is also good, so its data doesn't get compromised.
    - tinus_hn 9y ago
      I did not know that. Turns out it’s a bit weak though, all untrusted clients have full access to all other untrusted clients. So you only have two levels. Still, better than nothing.
  - hazeii 9y ago
    As a simple demo of this, running 'gimp' as a 'guest' user allows you to take screenshots of windows owned by the user who started the session. Thus, a compromised copy of firefox on the 'guest' account could, for example, easily capture the contents of any window on the system. Still, the main reason I run the browser as a different user is to isolate it for privacy; there are some security benefits too, but I agree it's not something that would defeat a targetted attack.