4 ms·

Isn't it possible to have a "per TLD" container addon? I'm fine to be logged into Google and even have Google collect information when I'm using any of their se

Isn't it possible to have a "per TLD" container addon? I'm fine to be logged into Google and even have Google collect information when I'm using any of their services (same for Facebook). What I'm really after is a way to sandbox every site to only have information I explicitly grant it while using their service.

sirn 8y ago
I believe First Party Isolation is what you're looking for. To enable, change `privacy.firstparty.isolate` to `true`. See also previous discussion[1] [1]: https://news.ycombinator.com/item?id=17944991 https://news.ycombinator.com/item?id=17944991
- sleavey 8y ago
  I've been using first party isolation ever since it was ported from Tor. It's excellent, but be aware that it breaks stuff, usually JavaScript, on about 5% of websites (anecdata). I find this to be well worth it, especially to find out which sites do the worst tracking. I have a separate Firefox profile I use for rare occasions when I need to allow third party tracking in order to do something.
ocdtrekkie 8y ago
Google has... literally hundreds of domains. Just assuming *.google.com would miss things like googleusercontent.com or googleapis.com or doubleclick.net. The Facebook container basically grabs "all domains by Facebook" and sandboxes them together (so they can still interoperate amongst themselves), while isolating it off from other sites you visit. Sure, you could do a lot of this yourself with different browsers/browser profiles/containers, but it'd be far better to have someone provide that list as a prebuilt addon.
- baroffoos 8y ago
  I really hate websites that do this because I have to go and whitelist the hundreds of domains that important resources are coming from.
  - judge2020 8y ago
    I would say it's both a blessing and a curse. Yes, it makes it harder for first party isolation scripts to sandbox a service, but the separation of domain based on the service (doubleclick for ads, googlevideo.com for video, etc) makes it easier for ad/content blocker list maintainers to block only the domains and services it should be blocking.
    - quaker5567 8y ago
      All IPs used by Google have PTR records to the 1e100.net zone so it is straightforward to determine whether any given domain is a Google domain. e.g. googlevideo.com resolves to 172.217.4.196 and the PTR for that IP is lga15s48-in-f196.1e100.net They even have a faq for this: https://support.google.com/faqs/answer/174717?hl=en https://support.google.com/faqs/answer/174717?hl=en
    - pferde 8y ago
      Yes, but they are supposed to be using subdomains for that (e.g. usercontent.google.com, video.google.com, apis.google.com, ...), instead of what is essentially DNS spam (guesswhetherthisdomainalsobelongstogoogle.com). DNS has been made hierarchic for this reason.
      - baroffoos 8y ago
        I was told this may have been because older browsers limited the number of simultaneous connections to a domain name and you could work around it by having multiple domain names.
    - freeopinion 8y ago
      So when a site relies on resources from ytimg.com, are those ads or videos? What about ggpht.com, gstatic.com, branch.io, unpkg.com, or any of the hundreds of CDNs? Most sites I visit these days--even super common sites like medium.com--have dozens (or even the hundreds alluded to above) of dependencies from seemingly unrelated sites. I have no idea if those are CDNs for common js libs, analytics libs, spammer libs, tracking libs, or what. I recognize things like CDN links for jQuery, Bootstrap, React, etc. I see many that seem to be Facebook tracking. Of course, blocking many of these breaks the page. I have started to avoid sites that break without access to urls I can't identify. But this is both laborious to vet, and isolating. There is no longer such a thing as easy, anonymous, inclusive web browsing.
- raimue 8y ago
  To trigger the switch to a container, only the user-visible URL in the address bar is relevant. Other URLs for resources on the page do not matter at all, as they will only be loaded after you are already in the corresponding container.
tjoff 8y ago
For me personally a per window container would work pretty well. Does that exist?

sirn 8y ago

I believe First Party Isolation is what you're looking for. To enable, change `privacy.firstparty.isolate` to `true`. See also previous discussion[1] [1]: https://news.ycombinator.com/item?id=17944991 https://news.ycombinator.com/item?id=17944991

sleavey 8y ago
I've been using first party isolation ever since it was ported from Tor. It's excellent, but be aware that it breaks stuff, usually JavaScript, on about 5% of websites (anecdata). I find this to be well worth it, especially to find out which sites do the worst tracking. I have a separate Firefox profile I use for rare occasions when I need to allow third party tracking in order to do something.

ocdtrekkie 8y ago

Google has... literally hundreds of domains. Just assuming *.google.com would miss things like googleusercontent.com or googleapis.com or doubleclick.net. The Facebook container basically grabs "all domains by Facebook" and sandboxes them together (so they can still interoperate amongst themselves), while isolating it off from other sites you visit. Sure, you could do a lot of this yourself with different browsers/browser profiles/containers, but it'd be far better to have someone provide that list as a prebuilt addon.

baroffoos 8y ago
I really hate websites that do this because I have to go and whitelist the hundreds of domains that important resources are coming from.
- judge2020 8y ago
  I would say it's both a blessing and a curse. Yes, it makes it harder for first party isolation scripts to sandbox a service, but the separation of domain based on the service (doubleclick for ads, googlevideo.com for video, etc) makes it easier for ad/content blocker list maintainers to block only the domains and services it should be blocking.
  - quaker5567 8y ago
    All IPs used by Google have PTR records to the 1e100.net zone so it is straightforward to determine whether any given domain is a Google domain. e.g. googlevideo.com resolves to 172.217.4.196 and the PTR for that IP is lga15s48-in-f196.1e100.net They even have a faq for this: https://support.google.com/faqs/answer/174717?hl=en https://support.google.com/faqs/answer/174717?hl=en
  - pferde 8y ago
    Yes, but they are supposed to be using subdomains for that (e.g. usercontent.google.com, video.google.com, apis.google.com, ...), instead of what is essentially DNS spam (guesswhetherthisdomainalsobelongstogoogle.com). DNS has been made hierarchic for this reason.
    - baroffoos 8y ago
      I was told this may have been because older browsers limited the number of simultaneous connections to a domain name and you could work around it by having multiple domain names.
  - freeopinion 8y ago
    So when a site relies on resources from ytimg.com, are those ads or videos? What about ggpht.com, gstatic.com, branch.io, unpkg.com, or any of the hundreds of CDNs? Most sites I visit these days--even super common sites like medium.com--have dozens (or even the hundreds alluded to above) of dependencies from seemingly unrelated sites. I have no idea if those are CDNs for common js libs, analytics libs, spammer libs, tracking libs, or what. I recognize things like CDN links for jQuery, Bootstrap, React, etc. I see many that seem to be Facebook tracking. Of course, blocking many of these breaks the page. I have started to avoid sites that break without access to urls I can't identify. But this is both laborious to vet, and isolating. There is no longer such a thing as easy, anonymous, inclusive web browsing.
raimue 8y ago
To trigger the switch to a container, only the user-visible URL in the address bar is relevant. Other URLs for resources on the page do not matter at all, as they will only be loaded after you are already in the corresponding container.

tjoff 8y ago

For me personally a per window container would work pretty well. Does that exist?