8 ms·
I used Firefox's containers for about a day, and then I discovered the privacy.firstparty.isolate option (in about:config), which effectively gives every site i
by 07d046 8y ago
I used Firefox's containers for about a day, and then I discovered the privacy.firstparty.isolate option (in about:config), which effectively gives every site its own container with no user effort. That, combined with Cookie AutoDelete, seems to work well.
- 6ak74rfy 8y agonice, I wish there were a dedicated checkbox for this in the settings page. I didn't know about this until now.
- vvanders 8y agoYup, this is how I thought containers would work like at first. 9/10 times I navigate off a link from one container and boom I've pulled in everything in that new container by ctrl+l reflex.
- forapurpose 8y agoAny problems? For example, CDNs are in different domains. Some ecommerce sites use payment services from other domains.
- guelo 8y agoThings will break like logging in with Google/Facebook/other OAuths that use popup window redirects, iframe services like Disqus or Facebook comments, Google's captcha will become more annoying, less local caching will happen which means slower browsing in general.
- mehrdadn 8y agoYet another reason why you should avoid using service to log into another as much as possible.
- ams6110 8y agoI'm really of two minds about this. On the one hand you can use Facebook or Google to log in and then have them know what sites you log into. Or you can use a site's native login and be pretty sure that at some point you're going to get a "we take security very seriously" notice after they screw up and expose all their user data.
- mehrdadn 8y agoI don't really see how logging in with a different system prevents your user data from being exposed?
- deleted 8y ago[deleted]
- waterbomb0 8y agoIf you use a password manager with different passwords for each site it doesn't matter (much). Either they steal your password (usually hashed), or your OAuth information. The minor difference is that with OAuth they cannot log-in to the site pretending to be you, but if they don't hash the passwords, or use weak method to do it, then it's possible. Regarding other user data stored in the DB (which is usually more valuable than just the passwords) there is no difference between the login method.
- saltcured 8y agoWhen you say login would break, what do you mean? Just that it would be less convenient, i.e. you have to login to your identity provider once for each first party? Or are you suggesting that the redirect flow for OpenID Connect or oauth wouldn't work at all?
- loeg 8y agoI've definitely run into problems with ecommerce sites (really just Tarsnap) and embedded iframes from 3rd party payment services, while using the Chrome equivalent of this Firefox setting.
- andai 8y agoHow do you do this in Chrome?
- mirthflat83 8y agoUsing profiles I guess
- loeg 8y agochrome://flags/#enable-site-per-process Strict site isolation > Enable.
- cperciva 8y agoIn case it's useful: This was due to a bug in Chrome which has since been fixed. (Chrome was losing the "POST" flag when sending a redirect message between processes.)
- loeg 8y agoAny idea what version of Chrome fixed it? I refill my Tarsnap balance only occasionally.
- cperciva 8y agoThe bug was fixed on January 26th and was being merged to older supported branches expeditiously -- I don't know the exact version numbers but I'm sure that any releases they rolled after mid-February would have the fix.
- loeg 8y agoI guess 65.0.3325.146 from March 5th probably works, then. Thanks!
- SparkyMcUnicorn 8y agoThis doesn't work for me. I have a "personal" container that I use for my Google/PayPal login, and sites that I use Google oauth with, same for a "work" container. If each site used it's own container, I couldn't sign in with Google without signing in multiple times (let alone the mess of signing out old sessions, which I do once in a while).
- Manishearth 8y agoGoogle logins still work, this is a different kind of container from the Firefox container tabs. I use this feature with container tabs and it's fine. There are so far one or two sites I've come across that this breaks, neither of them anything I care about.
- rattray 8y agoSorry, are you using `privacy.firstparty.isolate` or container tabs? I think SparkyMcUnicorn was saying the former would not work for them.
- Manishearth 8y agoBoth. I'm saying they work together fine, and isolate works fine with Google logins. It's not that strict.
- seanp2k2 8y agoFor those curious about how this actually works: https://bugzilla.mozilla.org/show_bug.cgi?id=1330467 https://bugzilla.mozilla.org/show_bug.cgi?id=1330467 Related: https://wiki.mozilla.org/Security/FirstPartyIsolation https://wiki.mozilla.org/Security/FirstPartyIsolation
- Aissen 8y agoIt doesn't work all the time. I tried it with Google login on Atlassian, it seems to rely on third-party cookies, and fails. There are a few bugs open on websites that don't work with this feature: https://wiki.mozilla.org/Security/FirstPartyIsolation#First_Party_Isolation_-_QA_Bugs https://wiki.mozilla.org/Security/FirstPartyIsolation#First_...
- minot 8y agoMy use case is multiple Google accounts. I can log in to multiple Google accounts at the same time in different containers and answer emails very easily.
- Someone1234 8y agoYou can be logged into multiple Google Accounts at the same time without the extension. Just click the little profile icon in the top right and click "Add Account." I'm logged into four, including a Gapps account.
- swsieber 8y agoHave they fixed the issues though where some of their apps only work with the primary account you're logged in with? (e.g. the first one)
- caro_douglos 8y ago+1 deal with this all the time on spreadsheets ===== fixed
- baddox 8y agoOver the years they have definitely fixed those one by one, but I’m not sure if they’ve fixed all of them. I believe the last problematic one I encountered was some ads-related developer console a year or two ago.
- imbur 8y agoThey fixed the big ones but there are still a bunch of edge cases where you have to log out, like one account is from US and one is from Canada.
- fphilipe 8y agoGoogle Play Console only works with your primary account.
- dredmorbius 8y ago
- chrischen 8y agoWouldn't setting your cookie settings to strict (block all third party cookies) do the same thing?
- guelo 8y agoIt's more thorough than just cookies including various caches and data stores.
- jakecopp 8y agoDoes the OP's method allow third party cookies while isolating them from other sites? That might be more usable than blocking third party cookies for sites that break because of SSO. Personally I use Containers and block third party cookies and I don't have any troubles.
- StavrosK 8y agoDoesn't Privacy Badger do about the same, but more granular and breaking fewer things?
- vidyesh 8y agoBy not breaking things, Privacy Badger will essentially let some cookies and trackers pass through which aren't cross tracking but these could leave behind a trail. Some will stay dormant until activated. CAD or any similar cookie deleting add-on will essentially kill any cookie that isn't required for your active tabs. This way nothing is left behind to track or trail you.
- epsilon_machine 8y agoWhat about browser fingerprinting (https://panopticlick.eff.org/ https://panopticlick.eff.org/)? Unless you are using the Tor browser, this appears "uncontainable" especially for folks not using Chrome over Windows 10 or another super generic combination.
- vidyesh 8y agoBlocking your canvas to avoid being fingerprinted/tracked is like walking under the CCTV with a hoodie and cap on. Unless everyone under the CCTV does the same you will not be detected but will be tracked. It might be hard to identify you but you will standout. So instead of standing out of the crowd why not disguise so well that the tracker doesn't know the real you. The idea is to use something that gives a fake readout of your fingerprint thus making you look normal but keep changing it occasionally so it leads no where for long time. Try Canvas blocker[1] and/or Canvas Defender for fake readout. [1]https://github.com/kkapsner/CanvasBlocker https://github.com/kkapsner/CanvasBlocker
- afx 8y ago> The idea is to use something that gives a fake readout of your fingerprint thus making you look normal but keep changing it occasionally so it leads no where for long time. What is "normal" in this case? One correct way to counter fingerprinting is to standardize the fake readouts to a specific value and not change it every so often. So if everyone's browser is reporting the same value for this feature that feature will become meaningless in the context of fingerprinting since its entropy is very low. That's what Tor Browser has been doing with font enumeration, reported windows size, screen resolution etc. - they all report the same value. On the other hand, you can correlate these values and identify Tor Browser users.
- vidyesh 8y agoI use containers to keep some activities limited to it. As my primary browsing is open all the time which. For each of these activities I use a separate container; shopping, work, research, banking, payments and social. I use uBO with dynamic filtering[1] + I've replaced 'CAD' with 'Forget Me Not'[2] works like a charm. [1]https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-quick-guide https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-qu... [2]https://github.com/Lusito/forget-me-not https://github.com/Lusito/forget-me-not
- rsync 8y ago"... and then I discovered the privacy.firstparty.isolate option (in about:config), which effectively gives every site its own container ..." But with its own IP, possibly a non-routable, private IP ? I think not ... and that's too bad because that is what we really need. We need the ability to chroot jail a GUI program just like we jail named or (whatever). A different root, a different IP, and no access (or knowledge) of the rest of the system. If I used facebook, that's the browser I would run it in.
- goatsi 8y agoThis is exactly what Qubes offers. Have as many separate browsers as you like, each originating from a different IP using VPN proxyVMs. Or just run everything through Tor using a Whonix gateway. https://www.qubes-os.org/intro/ https://www.qubes-os.org/intro/
- sametmax 8y agoYeah but you miss in the parallel session. Having several github and twitter accounts, it's very handy. I never disconnect from anything, i just open a non container tab. I never connect to anything on my laptop, i open the site in the desired account container. This website is in a state I don't want ? New container, and it's sees me as a new customer.