43 ms·

Facebook Container Extension: Take control of how you’re being tracked

854 points by sanatgersappa 9y ago

deleted 9y ago
[deleted]
Mougatine 9y ago
Privacy Badger is already able to prevent Facebook from tracking you right? And it's doing way more than just that. Or am I missing something?
- justicezyx 9y ago
  Competitors (obvious and non-obvious) are going to capitalize on FB's incidents. Business world is not technical.
  - gregknicholson 9y ago
    I'm glad Mozilla is finally recognising Facebook as an opponent of the open web.
- proaralyst 9y ago
  Privacy Badger is attempting to prevent Facebook from tracking you by blocking URLs known to load tracking code or pixel trackers etc. This extension isolates your Facebook login cookies while you're browsing on non-Facebook websites, hence making it harder for those tracking techniques to identify you.
  - aembleton 9y ago
    How can you load Facebook login cookies from third party websites? I thought they set a cookie on facebook and used that to track you between sites. Third parties add Facebook scripts to their sites that then read the tracking cookie around the web. Privacy Badger prevents the cookie being sent back to Facebook from these third party websites.
spacehome 9y ago
This is a good start. It's close to the way I've been (infrequently) using Facebook for the past few years: in a private browsing session through a VPN. It's worth noting that with this extension Facebook still gets your IP address.
- deleted 9y ago
  [deleted]
QasimK 9y ago
Multi-account containers are great. The only issue I’ve encountered is opening links outside of your container (e.g. a link to a website that you are logged in outside the container will mean you are logged out). Just need to train my muscle memory to “right click > open in container...” rather than just clicking!
InTheArena 9y ago
I already use the multi-container accounts to do this. It works fantastically, and is the biggest reason that Chrome is gone from my mac. Why is this different from Privacy Badger? This allows you to segregate all facebook toxicity to a single container. This allows you to fully use facebook, and places like login via facebook, without exposing other things to facebook in the first place. That said, this really doesn't address either the Cambridge situation, or the fact that Facebook themselves allowed the Obama campagin to pull demographic information in violation of their own polices, which was arguably impacted far more people (https://www.investors.com/politics/editorials/facebook-data-scandal-trump-election-obama-2012/ https://www.investors.com/politics/editorials/facebook-data-... && http://www.dailymail.co.uk/news/article-5520303/Obama-campaign-director-reveals-Facebook-ALLOWED-data.html http://www.dailymail.co.uk/news/article-5520303/Obama-campai...). The only solution to that is to #DeleteFacebook. Facebook is a surveillance as a service provider. The only way to keep them from monetizing you for commercial, social or political reasons is to firewall them off. You can also associate this with a VPN, if you want to deny them the IP address your home machine is using.
- unethical_ban 9y ago
  Yes, this was the first thing I did when I installed multi-container tabs. I use it for Facebook and banking.
  - dralley 9y ago
    I don't use it for banking but I do contain Amazon as well.
  - cryptonector 9y ago
    Every account should get its own container.
    - MaupitiBlue 9y ago
      Everyone should use the firefox multi-account containers. Each account you use should have a separate container. The new versions allow you to associate bookmarks to containers. Fabulous!
ape4 9y ago
I guess it doesn't stop info trading behind the scenes.
- diggan 9y ago
  No, obviously it can't. But, that's what "DNT" (Do Not Track) header was supposed to fix, but there is no incentive for companies to adhere to it, except good-will.
- drak0n1c 9y ago
  That's a much more manual and difficult B2B contractual process. A completely different level than automated data sharing via tightly integrated plugins.
louismillette 9y ago
Another good tool is DuckDuckGo's tracker blocker. Facebook got a lot of attention, but google, comscore, twitter, and others are doing the exact same thing. https://techcrunch.com/2018/01/23/duckduckgo-adds-tracker-blocking-to-help-curb-the-wider-surveillance-web/ https://techcrunch.com/2018/01/23/duckduckgo-adds-tracker-bl...
- Vinnl 9y ago
  Note that it includes "energy labels" for terms of services that allow you to assess their impact at a glance. Those labels are provided by Terms of Service; Didn't Read, and they're currently crowdfunding with the help of DuckDuckGo, who donate to the project depending on the amount raised: https://www.crowdrise.com/o/en/campaign/tosdr https://www.crowdrise.com/o/en/campaign/tosdr
nimbius 9y ago
but youre still sniffing my DNS traffic in the nightlies right? https://www.theregister.co.uk/2018/03/20/mozilla_firefox_test_of_privacy_mechanism_prompts_privacy_worries/ https://www.theregister.co.uk/2018/03/20/mozilla_firefox_tes...
- dralley 9y ago
  1. Chrome uses Google DNS for ALL users, and doesn't delete the records after 24 hours. 2. The study is optional. 3. DNS over HTTPS is a net benefit to privacy.
- Vinnl 9y ago
  Practically irrelevant to the above article, but for those still coming across this: view the top comments at [0] to see why it's not that big a deal. [0] https://news.ycombinator.com/item?id=16653889 https://news.ycombinator.com/item?id=16653889
- cpeterso 9y ago
  "Still"? That one-week experiment with Firefox Nightly user was proposed but not started at this time, as user feedback is being considered.
- bzbarsky 9y ago
  Since you asked: No.
diggan 9y ago
> The next time you navigate to Facebook it will load in a new blue colored browser tab (the “Container”). Why does not browsers (eh, Firefox) do this by default for every origin? 3rd party cookies would be broken I assume, but overall it would lead to less tracking across origins.
- Yoric 9y ago
  Because that would break many things on the web, in particular the ability to `Like`, to `Log-in with Google`, etc. Also, the definition of 3rd party is sometimes complicated.
  - alkonaut 9y ago
    But zero people in the history of the web has deliberately “liked” anything while knowing the privacy implications. Liking and logging in with google should show a similar warning as an untrusted or malicious site and then send the cookies
- Sylos 9y ago
  The Tor Browser does do that by default, by the way.
sp332 9y ago
Edit: ignore the below, I didn't realize the new container had the opposite behavior from other Firefox containers, described here https://addons.mozilla.org/en-US/firefox/addon/multi-account-containers/ https://addons.mozilla.org/en-US/firefox/addon/multi-account... This has a real limitation, which is that if you click an external link on your Facebook newsfeed, the new website will also be in the FB container. On the one hand, that keeps your FB-related browsing from "contaminating" your other web cookies. On the other hand, all the websites in that container get to link you to your FB account just like normal.
- the_watcher 9y ago
  Doesn't the post explicitly contradict this? > If you click on a non-Facebook link or navigate to a non-Facebook website in the URL bar, these pages will load outside of the container. Or am I misunderstanding?
spac 9y ago
Can someone explain how this would prevent fingerprinting? IP, user-agent, window-size and other details can reliably identify most of the the other http sessions anyway. Blocking trackers seems as important to me.
- proaralyst 9y ago
  It won't, but it'll still help with the low-hanging fruit of just giving you a cookie.
- Vinnl 9y ago
  It wouldn't. It merely makes it more difficult for Facebook to track you on third-party websites, as fingerprinting is more difficult and error-prone than simply re-using your cookie.
  - spac 9y ago
    My question was rhetorical :-). I agree with you that it is harder and noisier to perform fingerprinting, but I still wish for Mozilla to evangelize a more complete solution. The current one creates a somewhat sense of false security, in my opinion.
    - Vinnl 9y ago
      For them to evangelise it, it has to exist :) That said, they are incorporating anti-fingerprinting features as part of the Tor Uplift project. (See e.g. https://www.deepdotweb.com/2016/07/10/mozilla-implementing-tor-privacy-features-firefox-builds/ https://www.deepdotweb.com/2016/07/10/mozilla-implementing-t... )
- 411mrc 9y ago
  It does not. I'd guess it hardly makes a dent in their tracking. The only sure way to block completely is to use a custom router on your network - an outgoing firewall. Via a custom dns server on my router, all requests from any device, browser, app, etc for the facebook or any ad or tracking domains never leave my network. This is powerful. Windows 10 intrusive spying can be blocked as well. Basically anything that I can't figure out what it is is blocked, and it's a lot. If I ever acquire malware that phones home, it should detect as well. The great thing is when you block all that, your internet is much faster.
fenwick67 9y ago
Remember Facebook probably tracks your IP address and user-agent anyway, I'd be skeptical that Facebook doesn't put two and two together.
- Macha 9y ago
  After using containers to isolate my Google activity in a similar fashion, I can confirm Google at least does. I see recommendations to watch other videos from the same channels I watch on YouTube in my Google container if I end up on YouTube in my normal browsing container.
  - newscracker 9y ago
    Are you logged out of (or never logged in to) any of the Google properties/platforms in these two modes? If yes, then Google's behavior here doesn't match user expectations and is tainted.
    - Macha 9y ago
      Yes, I've never logged into Google anything in the default container.
      - walterbell 9y ago
        Now we need per-container VPN/proxy.
- bluGill 9y ago
  There is one silver lining in carrier grade NAT. combine that and all facebook ends up with is you are one of a few hundred firefox users in some geographical area.
  - beager 9y ago
    Not necessarily! Other fingerprinting details can surface identity even when user agent and IP are unreliable. If you've got a specific screen resolution, you're tagged. If you've got a specific version of some piece of software (Flash, for instance) you're tagged.
intopieces 9y ago
I like this a lot, but I won’t use it because I resent the need to contain different personas online. Too much work.
- patrickbolle 9y ago
  This literally does all of the work for you. You just click "install" and then you don't need to worry about 'containing different personas online' at all. It's ridiculously easy.
  - intopieces 9y ago
    I don't worry about containing different personas online because I have only one social media account (HN). Therefore, only one persona. That + ublock origin is sufficient for me.
billysielu 9y ago
I don't understand why the default behavior isn't to isolate every website from every other website? Why is least privacy the default?
- proaralyst 9y ago
  That is mostly the case. However, other websites may ask your browser to make requests to Facebook domains (to load in social buttons or tracking scripts/pixels). Those requests will include any cookies your browser has for Facebook as they're direct to Facebook domains. This extension gives Firefox selective amnesia: if you're in a Facebook container tab, it'll remember and send those cookies. If you're not, it won't! An alternative solution is to never make those third party requests in the first place, but you might need some of them for content you're actually interested in viewing. Using both a blocking extension and this container extension should improve your privacy towards Facebook.
  - throwawayReply 9y ago
    There's a "Same-Site" cookie flag that helps prevent CSRF by preventing cookies being sent in that scenario. Can the browser be made to treat all cookies as "same-site" for a quick 'fix' to this issue? Obviously this would need a white-list (and a pair<from,to> whitelist, not just "this domain is OK list) to allow SSO scenarios.
    - tscs37 9y ago
      Simply set the configuration value privacy.firstparty.isolate in your about:config. This will treat every first party domain as it's own container for cookies and other stuff.
    - UncleMeat 9y ago
      Yes, but as you say this breaks a large number of applications. The web browsers aren't super likely to break existing behavior since people simply blame the browser that whatever thing doesn't work.
  - 9y ago
Vinnl 9y ago
Multi-account containers are great. I just wish switching to one wasn't as jarring as the tab closing immediately after opening and then re-opening in the correct container - I'm assuming that's still how this extension works? Of course, I can appreciate that such behaviour is technically far more challenging. It's merely as a user that it's disappointing, and it makes Temporary Containers [0] practically unusable. [0] https://addons.mozilla.org/en-GB/firefox/addon/temporary-containers/ https://addons.mozilla.org/en-GB/firefox/addon/temporary-con...
- daveFNbuck 9y ago
  I just tried the Facebook container and it doesn't do that.
- diafygi 9y ago
  I believe this is an issue with redirecting domains. For example, if you have set foo.com to automatically open in a specific container, and you enter www.foo.com into your default tabs, it will try to load www.foo.com in the default tab, then get redirected to foo.com, then realize it needs to be open in a specific container, then open a new tab in that specific container with foo.com. A good workaround for this could be to let users add arbitrary domains to their container whitelists (so you could manually add www.foo.com), but I haven't found a way to do that yet.
- kovrik 9y ago
  That's exactly the reason why I stopped using Multi Account Containers. Very annoying. Are they planning to fix it somehow?
- t3ra 9y ago
  tip : you can assign sites to specific containers - so amazon always opens in shopping
  - Vinnl 9y ago
    Right, that's the way the described minor annoyance occurs: configure Amazon to open in the Shopping container, open a new tab, enter the Amazon URL and press Enter, then the tab closes and a new tab opens in the Shopping Container that visits the URL.
thotaway 9y ago
This is cute, but does little to address tracking via IP and basic behavioral sniffing. Facebook buys lots of third party datasets, including data from ISPs (actually, it is given to them).
walterbell 9y ago
Dear Apple, Please design an iOS identity isolation UX for Mobile Safari, Apple Mail and third-party apps. Currently we have to use several different iOS web browsers to achieve isolation of browser logins/cookies, but Apple Mail opens all links in Safari. Ideally, there would be an OS enforced, per-app setting which defines which web browser (or Mobile Safari identity context) will be used to open a URL.
- r00fus 9y ago
  I'd prefer creating a throwaway container/context every time. Safari allows you to store pwds.
  - walterbell 9y ago
    You can get that by entering Private Mode in Safari. A URL clicked in Apple Mail will then open in a private tab.
askatwork 9y ago
This article disappoints me because Mozilla seems to be spinning the current facebook disdain to sell their offerings rather than providing clarity/solutions on this issue.
- 908087 9y ago
  I didn't realize that Mozilla started charging people for Firefox.
AdmiralAsshat 9y ago
Another nice thing to have, although Firefox already has extensions like Self-Destructing Cookies or Cookie Auto Delete to remove cookies as soon as the tab is closed. In which case, Facebook should have nothing to look at.
stephenr 9y ago
The amount of effort that goes in to making it 'safer' for people to use ridiculously abusive services like this is ridiculous. This is the tech world's equivalent of a "how to take a punch" class for victims of domestic violence.
- Sylos 9y ago
  Well, yeah, because the law does jackshit to protect people.
- lainga 9y ago
  That would make sense if the abuse was between individual actors. Domestic violence victims can, in theory, defend themselves with weapons and legal means. This is (to really stretch the analogy) more "how to hide from drones" for targets of a giant, state-tolerated PMC.
  - stephenr 9y ago
    Sorry, but no. People know that (facebook|their partner) is abusing them (privacy-wise|physically) and they choose to continue the relationship. That's it. No one chooses a relationship with a drone, and to date Facebook haven't found a way to force people to create accounts and continue to use them, at gun-point.
    - lainga 9y ago
      I chose to stop the relationship. It probably still has all my information in a shadow account, and might be collecting SMS messages I exchange with people who maintain FB accounts. Facebook doesn't have to force people to do anything -- are you going to cut off contact with everyone you suspect might possibly have an account, to prevent them from creating a shadow account on you?
      - stephenr 9y ago
        The topic is about a browser extension to block them tracking first party activity. That does literally nothing to solve the scenario you described. It's also no coincidence that their SMS harvesting shenanigans are only possible on Android, the poster child for "fuck privacy I want free shit from a giant creepy company". Sure, on some level there should be laws about privacy. But this is fucking America we're talking about - it's practically the third world when it comes to the state of basic protections for citizens.
frenchpress 9y ago
With this extension, Facebook still knows that those non-Facebook links were clicked on because of the outgoing redirects they add to all URLs under the guise of 'safety'.
ocdtrekkie 9y ago
"Facebook Container leverages the Containers feature that is already built in to Firefox." I appreciate this. I was aware Firefox already had a container system, but didn't want to employ the effort to set it up. A one-off for Facebook though, feels easy to work with.
- ronjouch 9y ago
  Exactly! This addon has no new exciting tech. It's just specialized/preconfigured UX around an existing feature, and opportunity-grasping marketing after the recent Facebook privacy barfs. I'm happy to recommend/install it to friends I install uBlock Origin for. Great job Mozilla :) . More of this.
deleted 9y ago
[deleted]
barell 9y ago
Does this extension work more or less like every URL you would open in a new incognito mode separate window? Or is there some other more sophisticated solution in the background?
- groovecoder 9y ago
  It works similarly to Private Browsing Mode - it actually uses the same architecture. But the Facebook container retains your Facebook cookies (and therefore your login) after restarts.
andy-wu 9y ago
Is there any way to make the standalone Messenger open in the FB Container? The way I see it, the two are intrinsically linked since using Messenger requires an FB login. Edit: After playing around, this also breaks the back button. If anyone from Mozilla is here, I think it would be better if an FB page opened in a new tab while keeping the original open.
- groovecoder 9y ago
  Disclosure: I'm the author of the add-on mentioned in the story. We tried a few different UXs and none of them felt ideal. We have an open issue to add Messenger to the list of FB domains that are contained. https://github.com/mozilla/contain-facebook/issues/45 https://github.com/mozilla/contain-facebook/issues/45
  - vmarsy 9y ago
    Great work! I love multi-accounts containers on desktop. Is it coming to the Android browser as well?
hitlin37 9y ago
this is really good...timely release.
randomerr 9y ago
I'm guessing the Mozilla Foundation just lost all it's funding from Facebook.
- gkoberger 9y ago
  They don't get any funding from Facebook, as far as I know. In the US, it's almost entirely from Google (source: I'm an ex employee)
  - jgmac1106 9y ago
    Furthermore I am sure the extension came from the Mozilla Corporation side and not the Foundation side. Based on the last audit (2016-2015) if I read it correctly 52K was brought in through "receivables" which includes search engine deal revenues
thewarrior 9y ago
PSA: Safari does this by default.
- ChrisLTD 9y ago
  Do you have a link with more information about Safari's approach?
  - groovecoder 9y ago
    Disclosure: I'm the author of the add-on mentioned in the story. I'm also interested in this claim. If you're referring to Intelligent Tracking Prevention, I don't think it does this.
    - thewarrior 9y ago
      The ultimate aim is the same.
      - groovecoder 9y ago
        The aim is the same, but ITP only strips cookies after a 24-hour period when you HAVE NOT visited the site. So ITP does nothing to protect a user who visits facebook.com every day. Which is most of Facebook's user-base.
kristianc 9y ago
There is something unintentionally hilarious about the title 'Take control of how you are being tracked.'
DireFox 9y ago
Remember that Mozilla is basically a fiefdom of google - like the recent industry denouncements of fb this is all about opportunism and corporate power struggles with the users still being the commodity traded. Also can someone explain what this container does that disabling third-party cookies doesn't (assuming you don't have other malware like flash installed) ?
DireFox 9y ago
Remember that Mozilla is basically a google fiefdom and like the industry "denouncements" of fb this is all about opportunism, corporate power struggles with the users still the commodity being traded. Also can someone explain what this container does that disabling third-party cookies doesn't ? (assuming you don't have other malware like flash installed)
skybrian 9y ago
I use a separate Chrome profile to isolate Facebook. I'm wondering how Firefox does things differently?
- groovecoder 9y ago
  This is essentially a light-weight version of that.
- atarian 9y ago
  It never occurred to me to try this. Great idea!
xenophonf 9y ago
This makes it harder for Facebook to track your activity on other websites via third-party cookies. Why not bundle uBlock Origin into every Firefox install and make it impossible for Facebook to track everyone's activity on other web sites?
fny 9y ago
I really think programmers need a basic lesson in probability, because most of these solutions are complete nonsense with respect to information theory. Skynet still knows enough about you and everyone else even if you alone leave Facebook, and we need to figure out how to curb the powers that come with amassed data more generally. 1. Models don't need everyones data, they just need enough data. Facebook, Google, et al have more than enough data for a lot of applications even if they only had 5-10% of the population. So at best, this ship jumping will limit Facebook's ability to "micro-target" certain populations. In this case, P(whatever | privacy concerned individual) will be a bit noisier, but Facebook will still have a really damn good idea about P(whatever | still a Facebook user) 2. Facebook can still use/sell the models it develops against its user base to target you even if you're not on the platform unless you really think P(depressed), P(bad employee), P(insurance risk), P(easily influenced by a specific type of marketing) has anything to do with the fact that you're not on Facebook. The minute someone asks a few questions about you in any setting, they'll be able to infer a ton more from the models alone. Lack of information about you will only add noise, and to make things worse, Facebook has enough data on privacy conscious individuals anyway to where they can reasonably fill in the privacy conscious holes in their data with a reasonable model. 3. P(privacy concerned) may be correlated with P(not manipulable), so you jumping ship isn't going change the systemic issues everyone is concerned with, namely Facebook and third-party customers' ability to morph society in the means they see fit. 4. You can replace Facebook with Google/Amazon/Spotify/Chase/Bank of America/Hospital System/Government and all of the above is true within the domain of data they control.
johnchristopher 9y ago
Nice. Can I have the same one for Google ?
- groovecoder 9y ago
  Check out https://addons.mozilla.org/firefox/addon/multi-account-containers/ https://addons.mozilla.org/firefox/addon/multi-account-conta...
  - johnchristopher 9y ago
    I know about the multi-account container extension. A google one would be so much easier for setting-up and forget it. The facebook one is really nice because once installed it auto logs out then automatically puts facebook.com into its own container everytime I type the url or visit it (even if the active tab is in another container). With the multi-account extension I have to actively manage containers which becomes annoying quite fast.
    - stordoff 9y ago
      It's a little more setup, but I believe you can accomplish that in Multi-account Container extension by setting "Always open in <container>" for the Google domains.
      - johnchristopher 9y ago
        Thanks ! It seems to do the trick.
amanzi 9y ago
Blocking third party cookies goes a long way to achieving the same thing, and also prevents Google and others to track your movements across the web. The occasional site may break if it relies on third party cookies, but this is easy to work around when it happens.
chicob 9y ago
Wouldn't adding hashed query strings to urls linking to sites outside of Facebook circumvent any effort put into containing de-anonymizing data? The wrong hash would lead nowhere, and the right one would give you away. Facebook would only have to edit a specific field in users' posts' urls related to certain domains, so that different users access unique urls that link them to Facebook in a specific context. Once outside the container, a user is traceable back to a Facebook profile. I don't know if this is possible, but people don't really check urls, let alone human-unreadable ones. I imagine that this could break navigation, but directing wrong queries to a default page would solve this. Anyway, they could still try their luck.
- groovecoder 9y ago
  That's an interesting threat model for this particular defense. Cliqz has done some interesting research in this area of detecting (and stripping) unsafe data elements. http://josepmpujol.net/public/papers/pujolTrackingTheTrackers.pdf http://josepmpujol.net/public/papers/pujolTrackingTheTracker...
- dannyw 9y ago
  I hope that gets Facebook fined 4% of their turnover for violating the GDPR. If most users don't pay attention to URLs (which is true), users cannot give informed consent, a core tenant of GDPR.
SkeptinenSpede5 9y ago
I just read news, when some women had 8800 A4 papers full of information from facebook. Full sms and contact list of 10 years. WTF? RTF? How much these services have to violate peoples privacy before its simply enough ? I wonder..
xwvvvvwx 9y ago
This is cool, but please make Firefox work like this for every webpage now. I don’t see a reason to allow any cross domain tracking from any website at all. Facebook is probably just the most visible offender rather than the worst offender in this regard.
- pseudosavant 9y ago
  It can basically. 1. Go to Options->Privacy 2. Go to History and change it to use custom settings 3a. You can either disable third-party cookies 3b. Or you could go a bit further and check "Always use private browsing mode"
cronix 9y ago
This is great, and will probably save me a lot of time. Currently I use an ubuntu desktop vm (vagrant) that I use for sites like facebook, that I destroy when done and recreate when needed so it's like a brand new clean pc each time.
jfrankamp 9y ago
This for every site by default!
hulton 9y ago
Best solution = deactivate and delete your Facebook account.
- WA 9y ago
  No, because you are still tracked via Like and Share buttons and all of that goes in your shadow profile. Best solution = block all of Facebooks IPs via hosts file or a plugin like uBlock Origin
awiesenhofer 9y ago
Too bad the extension doesn't work on mobile - does anyone know if there are any plans to change that?
dogruck 9y ago
I took control by never signing on to Facebook.
testbigoooo 9y ago
Jaha dette er noe dritt

854 points by sanatgersappa 9y ago

deleted 9y ago

[deleted]

Privacy Badger is already able to prevent Facebook from tracking you right? And it's doing way more than just that. Or am I missing something?

justicezyx 9y ago
Competitors (obvious and non-obvious) are going to capitalize on FB's incidents. Business world is not technical.
- gregknicholson 9y ago
  I'm glad Mozilla is finally recognising Facebook as an opponent of the open web.
proaralyst 9y ago
Privacy Badger is attempting to prevent Facebook from tracking you by blocking URLs known to load tracking code or pixel trackers etc. This extension isolates your Facebook login cookies while you're browsing on non-Facebook websites, hence making it harder for those tracking techniques to identify you.
- aembleton 9y ago
  How can you load Facebook login cookies from third party websites? I thought they set a cookie on facebook and used that to track you between sites. Third parties add Facebook scripts to their sites that then read the tracking cookie around the web. Privacy Badger prevents the cookie being sent back to Facebook from these third party websites.

spacehome 9y ago

This is a good start. It's close to the way I've been (infrequently) using Facebook for the past few years: in a private browsing session through a VPN. It's worth noting that with this extension Facebook still gets your IP address.

deleted 9y ago
[deleted]

QasimK 9y ago

Multi-account containers are great. The only issue I’ve encountered is opening links outside of your container (e.g. a link to a website that you are logged in outside the container will mean you are logged out). Just need to train my muscle memory to “right click > open in container...” rather than just clicking!

InTheArena 9y ago

I already use the multi-container accounts to do this. It works fantastically, and is the biggest reason that Chrome is gone from my mac. Why is this different from Privacy Badger? This allows you to segregate all facebook toxicity to a single container. This allows you to fully use facebook, and places like login via facebook, without exposing other things to facebook in the first place. That said, this really doesn't address either the Cambridge situation, or the fact that Facebook themselves allowed the Obama campagin to pull demographic information in violation of their own polices, which was arguably impacted far more people (https://www.investors.com/politics/editorials/facebook-data-scandal-trump-election-obama-2012/ https://www.investors.com/politics/editorials/facebook-data-... && http://www.dailymail.co.uk/news/article-5520303/Obama-campaign-director-reveals-Facebook-ALLOWED-data.html http://www.dailymail.co.uk/news/article-5520303/Obama-campai...). The only solution to that is to #DeleteFacebook. Facebook is a surveillance as a service provider. The only way to keep them from monetizing you for commercial, social or political reasons is to firewall them off. You can also associate this with a VPN, if you want to deny them the IP address your home machine is using.

unethical_ban 9y ago
Yes, this was the first thing I did when I installed multi-container tabs. I use it for Facebook and banking.
- dralley 9y ago
  I don't use it for banking but I do contain Amazon as well.
- cryptonector 9y ago
  Every account should get its own container.
  - MaupitiBlue 9y ago
    Everyone should use the firefox multi-account containers. Each account you use should have a separate container. The new versions allow you to associate bookmarks to containers. Fabulous!

ape4 9y ago

I guess it doesn't stop info trading behind the scenes.

diggan 9y ago
No, obviously it can't. But, that's what "DNT" (Do Not Track) header was supposed to fix, but there is no incentive for companies to adhere to it, except good-will.
drak0n1c 9y ago
That's a much more manual and difficult B2B contractual process. A completely different level than automated data sharing via tightly integrated plugins.

louismillette 9y ago

Another good tool is DuckDuckGo's tracker blocker. Facebook got a lot of attention, but google, comscore, twitter, and others are doing the exact same thing. https://techcrunch.com/2018/01/23/duckduckgo-adds-tracker-blocking-to-help-curb-the-wider-surveillance-web/ https://techcrunch.com/2018/01/23/duckduckgo-adds-tracker-bl...

Vinnl 9y ago
Note that it includes "energy labels" for terms of services that allow you to assess their impact at a glance. Those labels are provided by Terms of Service; Didn't Read, and they're currently crowdfunding with the help of DuckDuckGo, who donate to the project depending on the amount raised: https://www.crowdrise.com/o/en/campaign/tosdr https://www.crowdrise.com/o/en/campaign/tosdr

nimbius 9y ago

but youre still sniffing my DNS traffic in the nightlies right? https://www.theregister.co.uk/2018/03/20/mozilla_firefox_test_of_privacy_mechanism_prompts_privacy_worries/ https://www.theregister.co.uk/2018/03/20/mozilla_firefox_tes...

dralley 9y ago
1. Chrome uses Google DNS for ALL users, and doesn't delete the records after 24 hours. 2. The study is optional. 3. DNS over HTTPS is a net benefit to privacy.
Vinnl 9y ago
Practically irrelevant to the above article, but for those still coming across this: view the top comments at [0] to see why it's not that big a deal. [0] https://news.ycombinator.com/item?id=16653889 https://news.ycombinator.com/item?id=16653889
cpeterso 9y ago
"Still"? That one-week experiment with Firefox Nightly user was proposed but not started at this time, as user feedback is being considered.
bzbarsky 9y ago
Since you asked: No.

diggan 9y ago

> The next time you navigate to Facebook it will load in a new blue colored browser tab (the “Container”). Why does not browsers (eh, Firefox) do this by default for every origin? 3rd party cookies would be broken I assume, but overall it would lead to less tracking across origins.

Yoric 9y ago
Because that would break many things on the web, in particular the ability to `Like`, to `Log-in with Google`, etc. Also, the definition of 3rd party is sometimes complicated.
- alkonaut 9y ago
  But zero people in the history of the web has deliberately “liked” anything while knowing the privacy implications. Liking and logging in with google should show a similar warning as an untrusted or malicious site and then send the cookies
Sylos 9y ago
The Tor Browser does do that by default, by the way.

sp332 9y ago

Edit: ignore the below, I didn't realize the new container had the opposite behavior from other Firefox containers, described here https://addons.mozilla.org/en-US/firefox/addon/multi-account-containers/ https://addons.mozilla.org/en-US/firefox/addon/multi-account... This has a real limitation, which is that if you click an external link on your Facebook newsfeed, the new website will also be in the FB container. On the one hand, that keeps your FB-related browsing from "contaminating" your other web cookies. On the other hand, all the websites in that container get to link you to your FB account just like normal.

the_watcher 9y ago
Doesn't the post explicitly contradict this? > If you click on a non-Facebook link or navigate to a non-Facebook website in the URL bar, these pages will load outside of the container. Or am I misunderstanding?

spac 9y ago

Can someone explain how this would prevent fingerprinting? IP, user-agent, window-size and other details can reliably identify most of the the other http sessions anyway. Blocking trackers seems as important to me.

proaralyst 9y ago
It won't, but it'll still help with the low-hanging fruit of just giving you a cookie.
Vinnl 9y ago
It wouldn't. It merely makes it more difficult for Facebook to track you on third-party websites, as fingerprinting is more difficult and error-prone than simply re-using your cookie.
- spac 9y ago
  My question was rhetorical :-). I agree with you that it is harder and noisier to perform fingerprinting, but I still wish for Mozilla to evangelize a more complete solution. The current one creates a somewhat sense of false security, in my opinion.
  - Vinnl 9y ago
    For them to evangelise it, it has to exist :) That said, they are incorporating anti-fingerprinting features as part of the Tor Uplift project. (See e.g. https://www.deepdotweb.com/2016/07/10/mozilla-implementing-tor-privacy-features-firefox-builds/ https://www.deepdotweb.com/2016/07/10/mozilla-implementing-t... )
411mrc 9y ago
It does not. I'd guess it hardly makes a dent in their tracking. The only sure way to block completely is to use a custom router on your network - an outgoing firewall. Via a custom dns server on my router, all requests from any device, browser, app, etc for the facebook or any ad or tracking domains never leave my network. This is powerful. Windows 10 intrusive spying can be blocked as well. Basically anything that I can't figure out what it is is blocked, and it's a lot. If I ever acquire malware that phones home, it should detect as well. The great thing is when you block all that, your internet is much faster.

fenwick67 9y ago

Remember Facebook probably tracks your IP address and user-agent anyway, I'd be skeptical that Facebook doesn't put two and two together.

Macha 9y ago
After using containers to isolate my Google activity in a similar fashion, I can confirm Google at least does. I see recommendations to watch other videos from the same channels I watch on YouTube in my Google container if I end up on YouTube in my normal browsing container.
- newscracker 9y ago
  Are you logged out of (or never logged in to) any of the Google properties/platforms in these two modes? If yes, then Google's behavior here doesn't match user expectations and is tainted.
  - Macha 9y ago
    Yes, I've never logged into Google anything in the default container.
    - walterbell 9y ago
      Now we need per-container VPN/proxy.
bluGill 9y ago
There is one silver lining in carrier grade NAT. combine that and all facebook ends up with is you are one of a few hundred firefox users in some geographical area.
- beager 9y ago
  Not necessarily! Other fingerprinting details can surface identity even when user agent and IP are unreliable. If you've got a specific screen resolution, you're tagged. If you've got a specific version of some piece of software (Flash, for instance) you're tagged.

intopieces 9y ago

I like this a lot, but I won’t use it because I resent the need to contain different personas online. Too much work.

patrickbolle 9y ago
This literally does all of the work for you. You just click "install" and then you don't need to worry about 'containing different personas online' at all. It's ridiculously easy.
- intopieces 9y ago
  I don't worry about containing different personas online because I have only one social media account (HN). Therefore, only one persona. That + ublock origin is sufficient for me.

billysielu 9y ago

I don't understand why the default behavior isn't to isolate every website from every other website? Why is least privacy the default?

proaralyst 9y ago
That is mostly the case. However, other websites may ask your browser to make requests to Facebook domains (to load in social buttons or tracking scripts/pixels). Those requests will include any cookies your browser has for Facebook as they're direct to Facebook domains. This extension gives Firefox selective amnesia: if you're in a Facebook container tab, it'll remember and send those cookies. If you're not, it won't! An alternative solution is to never make those third party requests in the first place, but you might need some of them for content you're actually interested in viewing. Using both a blocking extension and this container extension should improve your privacy towards Facebook.
- throwawayReply 9y ago
  There's a "Same-Site" cookie flag that helps prevent CSRF by preventing cookies being sent in that scenario. Can the browser be made to treat all cookies as "same-site" for a quick 'fix' to this issue? Obviously this would need a white-list (and a pair<from,to> whitelist, not just "this domain is OK list) to allow SSO scenarios.
  - tscs37 9y ago
    Simply set the configuration value privacy.firstparty.isolate in your about:config. This will treat every first party domain as it's own container for cookies and other stuff.
  - UncleMeat 9y ago
    Yes, but as you say this breaks a large number of applications. The web browsers aren't super likely to break existing behavior since people simply blame the browser that whatever thing doesn't work.
- 9y ago

Vinnl 9y ago

Multi-account containers are great. I just wish switching to one wasn't as jarring as the tab closing immediately after opening and then re-opening in the correct container - I'm assuming that's still how this extension works? Of course, I can appreciate that such behaviour is technically far more challenging. It's merely as a user that it's disappointing, and it makes Temporary Containers [0] practically unusable. [0] https://addons.mozilla.org/en-GB/firefox/addon/temporary-containers/ https://addons.mozilla.org/en-GB/firefox/addon/temporary-con...

daveFNbuck 9y ago
I just tried the Facebook container and it doesn't do that.
diafygi 9y ago
I believe this is an issue with redirecting domains. For example, if you have set foo.com to automatically open in a specific container, and you enter www.foo.com into your default tabs, it will try to load www.foo.com in the default tab, then get redirected to foo.com, then realize it needs to be open in a specific container, then open a new tab in that specific container with foo.com. A good workaround for this could be to let users add arbitrary domains to their container whitelists (so you could manually add www.foo.com), but I haven't found a way to do that yet.
kovrik 9y ago
That's exactly the reason why I stopped using Multi Account Containers. Very annoying. Are they planning to fix it somehow?
t3ra 9y ago
tip : you can assign sites to specific containers - so amazon always opens in shopping
- Vinnl 9y ago
  Right, that's the way the described minor annoyance occurs: configure Amazon to open in the Shopping container, open a new tab, enter the Amazon URL and press Enter, then the tab closes and a new tab opens in the Shopping Container that visits the URL.

thotaway 9y ago

This is cute, but does little to address tracking via IP and basic behavioral sniffing. Facebook buys lots of third party datasets, including data from ISPs (actually, it is given to them).

walterbell 9y ago

Dear Apple, Please design an iOS identity isolation UX for Mobile Safari, Apple Mail and third-party apps. Currently we have to use several different iOS web browsers to achieve isolation of browser logins/cookies, but Apple Mail opens all links in Safari. Ideally, there would be an OS enforced, per-app setting which defines which web browser (or Mobile Safari identity context) will be used to open a URL.

r00fus 9y ago
I'd prefer creating a throwaway container/context every time. Safari allows you to store pwds.
- walterbell 9y ago
  You can get that by entering Private Mode in Safari. A URL clicked in Apple Mail will then open in a private tab.

askatwork 9y ago

This article disappoints me because Mozilla seems to be spinning the current facebook disdain to sell their offerings rather than providing clarity/solutions on this issue.

908087 9y ago
I didn't realize that Mozilla started charging people for Firefox.

AdmiralAsshat 9y ago

Another nice thing to have, although Firefox already has extensions like Self-Destructing Cookies or Cookie Auto Delete to remove cookies as soon as the tab is closed. In which case, Facebook should have nothing to look at.

stephenr 9y ago

The amount of effort that goes in to making it 'safer' for people to use ridiculously abusive services like this is ridiculous. This is the tech world's equivalent of a "how to take a punch" class for victims of domestic violence.

Sylos 9y ago
Well, yeah, because the law does jackshit to protect people.
lainga 9y ago
That would make sense if the abuse was between individual actors. Domestic violence victims can, in theory, defend themselves with weapons and legal means. This is (to really stretch the analogy) more "how to hide from drones" for targets of a giant, state-tolerated PMC.
- stephenr 9y ago
  Sorry, but no. People know that (facebook|their partner) is abusing them (privacy-wise|physically) and they choose to continue the relationship. That's it. No one chooses a relationship with a drone, and to date Facebook haven't found a way to force people to create accounts and continue to use them, at gun-point.
  - lainga 9y ago
    I chose to stop the relationship. It probably still has all my information in a shadow account, and might be collecting SMS messages I exchange with people who maintain FB accounts. Facebook doesn't have to force people to do anything -- are you going to cut off contact with everyone you suspect might possibly have an account, to prevent them from creating a shadow account on you?
    - stephenr 9y ago
      The topic is about a browser extension to block them tracking first party activity. That does literally nothing to solve the scenario you described. It's also no coincidence that their SMS harvesting shenanigans are only possible on Android, the poster child for "fuck privacy I want free shit from a giant creepy company". Sure, on some level there should be laws about privacy. But this is fucking America we're talking about - it's practically the third world when it comes to the state of basic protections for citizens.

frenchpress 9y ago

With this extension, Facebook still knows that those non-Facebook links were clicked on because of the outgoing redirects they add to all URLs under the guise of 'safety'.

ocdtrekkie 9y ago

"Facebook Container leverages the Containers feature that is already built in to Firefox." I appreciate this. I was aware Firefox already had a container system, but didn't want to employ the effort to set it up. A one-off for Facebook though, feels easy to work with.

ronjouch 9y ago
Exactly! This addon has no new exciting tech. It's just specialized/preconfigured UX around an existing feature, and opportunity-grasping marketing after the recent Facebook privacy barfs. I'm happy to recommend/install it to friends I install uBlock Origin for. Great job Mozilla :) . More of this.

deleted 9y ago

[deleted]

barell 9y ago

Does this extension work more or less like every URL you would open in a new incognito mode separate window? Or is there some other more sophisticated solution in the background?

groovecoder 9y ago
It works similarly to Private Browsing Mode - it actually uses the same architecture. But the Facebook container retains your Facebook cookies (and therefore your login) after restarts.

andy-wu 9y ago

Is there any way to make the standalone Messenger open in the FB Container? The way I see it, the two are intrinsically linked since using Messenger requires an FB login. Edit: After playing around, this also breaks the back button. If anyone from Mozilla is here, I think it would be better if an FB page opened in a new tab while keeping the original open.

groovecoder 9y ago
Disclosure: I'm the author of the add-on mentioned in the story. We tried a few different UXs and none of them felt ideal. We have an open issue to add Messenger to the list of FB domains that are contained. https://github.com/mozilla/contain-facebook/issues/45 https://github.com/mozilla/contain-facebook/issues/45
- vmarsy 9y ago
  Great work! I love multi-accounts containers on desktop. Is it coming to the Android browser as well?

hitlin37 9y ago

this is really good...timely release.

randomerr 9y ago

I'm guessing the Mozilla Foundation just lost all it's funding from Facebook.

gkoberger 9y ago
They don't get any funding from Facebook, as far as I know. In the US, it's almost entirely from Google (source: I'm an ex employee)
- jgmac1106 9y ago
  Furthermore I am sure the extension came from the Mozilla Corporation side and not the Foundation side. Based on the last audit (2016-2015) if I read it correctly 52K was brought in through "receivables" which includes search engine deal revenues

thewarrior 9y ago

PSA: Safari does this by default.

ChrisLTD 9y ago
Do you have a link with more information about Safari's approach?
- groovecoder 9y ago
  Disclosure: I'm the author of the add-on mentioned in the story. I'm also interested in this claim. If you're referring to Intelligent Tracking Prevention, I don't think it does this.
  - thewarrior 9y ago
    The ultimate aim is the same.
    - groovecoder 9y ago
      The aim is the same, but ITP only strips cookies after a 24-hour period when you HAVE NOT visited the site. So ITP does nothing to protect a user who visits facebook.com every day. Which is most of Facebook's user-base.

kristianc 9y ago

There is something unintentionally hilarious about the title 'Take control of how you are being tracked.'

DireFox 9y ago

Remember that Mozilla is basically a fiefdom of google - like the recent industry denouncements of fb this is all about opportunism and corporate power struggles with the users still being the commodity traded. Also can someone explain what this container does that disabling third-party cookies doesn't (assuming you don't have other malware like flash installed) ?

DireFox 9y ago

Remember that Mozilla is basically a google fiefdom and like the industry "denouncements" of fb this is all about opportunism, corporate power struggles with the users still the commodity being traded. Also can someone explain what this container does that disabling third-party cookies doesn't ? (assuming you don't have other malware like flash installed)

skybrian 9y ago

I use a separate Chrome profile to isolate Facebook. I'm wondering how Firefox does things differently?

groovecoder 9y ago
This is essentially a light-weight version of that.
atarian 9y ago
It never occurred to me to try this. Great idea!

xenophonf 9y ago

This makes it harder for Facebook to track your activity on other websites via third-party cookies. Why not bundle uBlock Origin into every Firefox install and make it impossible for Facebook to track everyone's activity on other web sites?

fny 9y ago

I really think programmers need a basic lesson in probability, because most of these solutions are complete nonsense with respect to information theory. Skynet still knows enough about you and everyone else even if you alone leave Facebook, and we need to figure out how to curb the powers that come with amassed data more generally. 1. Models don't need everyones data, they just need enough data. Facebook, Google, et al have more than enough data for a lot of applications even if they only had 5-10% of the population. So at best, this ship jumping will limit Facebook's ability to "micro-target" certain populations. In this case, P(whatever | privacy concerned individual) will be a bit noisier, but Facebook will still have a really damn good idea about P(whatever | still a Facebook user) 2. Facebook can still use/sell the models it develops against its user base to target you even if you're not on the platform unless you really think P(depressed), P(bad employee), P(insurance risk), P(easily influenced by a specific type of marketing) has anything to do with the fact that you're not on Facebook. The minute someone asks a few questions about you in any setting, they'll be able to infer a ton more from the models alone. Lack of information about you will only add noise, and to make things worse, Facebook has enough data on privacy conscious individuals anyway to where they can reasonably fill in the privacy conscious holes in their data with a reasonable model. 3. P(privacy concerned) may be correlated with P(not manipulable), so you jumping ship isn't going change the systemic issues everyone is concerned with, namely Facebook and third-party customers' ability to morph society in the means they see fit. 4. You can replace Facebook with Google/Amazon/Spotify/Chase/Bank of America/Hospital System/Government and all of the above is true within the domain of data they control.

johnchristopher 9y ago

Nice. Can I have the same one for Google ?

groovecoder 9y ago
Check out https://addons.mozilla.org/firefox/addon/multi-account-containers/ https://addons.mozilla.org/firefox/addon/multi-account-conta...
- johnchristopher 9y ago
  I know about the multi-account container extension. A google one would be so much easier for setting-up and forget it. The facebook one is really nice because once installed it auto logs out then automatically puts facebook.com into its own container everytime I type the url or visit it (even if the active tab is in another container). With the multi-account extension I have to actively manage containers which becomes annoying quite fast.
  - stordoff 9y ago
    It's a little more setup, but I believe you can accomplish that in Multi-account Container extension by setting "Always open in <container>" for the Google domains.
    - johnchristopher 9y ago
      Thanks ! It seems to do the trick.

amanzi 9y ago

Blocking third party cookies goes a long way to achieving the same thing, and also prevents Google and others to track your movements across the web. The occasional site may break if it relies on third party cookies, but this is easy to work around when it happens.

chicob 9y ago

Wouldn't adding hashed query strings to urls linking to sites outside of Facebook circumvent any effort put into containing de-anonymizing data? The wrong hash would lead nowhere, and the right one would give you away. Facebook would only have to edit a specific field in users' posts' urls related to certain domains, so that different users access unique urls that link them to Facebook in a specific context. Once outside the container, a user is traceable back to a Facebook profile. I don't know if this is possible, but people don't really check urls, let alone human-unreadable ones. I imagine that this could break navigation, but directing wrong queries to a default page would solve this. Anyway, they could still try their luck.

groovecoder 9y ago
That's an interesting threat model for this particular defense. Cliqz has done some interesting research in this area of detecting (and stripping) unsafe data elements. http://josepmpujol.net/public/papers/pujolTrackingTheTrackers.pdf http://josepmpujol.net/public/papers/pujolTrackingTheTracker...
dannyw 9y ago
I hope that gets Facebook fined 4% of their turnover for violating the GDPR. If most users don't pay attention to URLs (which is true), users cannot give informed consent, a core tenant of GDPR.

SkeptinenSpede5 9y ago

I just read news, when some women had 8800 A4 papers full of information from facebook. Full sms and contact list of 10 years. WTF? RTF? How much these services have to violate peoples privacy before its simply enough ? I wonder..

xwvvvvwx 9y ago

This is cool, but please make Firefox work like this for every webpage now. I don’t see a reason to allow any cross domain tracking from any website at all. Facebook is probably just the most visible offender rather than the worst offender in this regard.

pseudosavant 9y ago
It can basically. 1. Go to Options->Privacy 2. Go to History and change it to use custom settings 3a. You can either disable third-party cookies 3b. Or you could go a bit further and check "Always use private browsing mode"

cronix 9y ago

This is great, and will probably save me a lot of time. Currently I use an ubuntu desktop vm (vagrant) that I use for sites like facebook, that I destroy when done and recreate when needed so it's like a brand new clean pc each time.

jfrankamp 9y ago

This for every site by default!

hulton 9y ago

Best solution = deactivate and delete your Facebook account.

WA 9y ago
No, because you are still tracked via Like and Share buttons and all of that goes in your shadow profile. Best solution = block all of Facebooks IPs via hosts file or a plugin like uBlock Origin

awiesenhofer 9y ago

Too bad the extension doesn't work on mobile - does anyone know if there are any plans to change that?

dogruck 9y ago

I took control by never signing on to Facebook.

testbigoooo 9y ago

Jaha dette er noe dritt