6 ms·

I think, and always thought of it as intuitive with the way I use browsers, that sessions should work as a tree. So only child tabs in that tree should see the

by rplnt 8y ago

I think, and always thought of it as intuitive with the way I use browsers, that sessions should work as a tree. So only child tabs in that tree should see the contents of parent's session. If I open a new tab, it's a new tree. Bookmarks could create permanent root node.

Disp4tch 8y ago
The Tree Style Tabs add-on supports this behavior with Firefox's containers, it is awesome.
- bpye 8y ago
  Damn I'm gonna have to give that a go.
- rplnt 8y ago
  That's awesome, thanks. I've tried the Tree Style Tabs in the past, it made a lot of sense to me, but unfortunately I had other issues with FF back then. Now with the containers support there's more incentive to try it again.
- dave_pascua 8y ago
  I found "Tree Style Tab", which doesn't mention anything about containers. You have a link and/or author for the add-on to which you're referring?
swift532 8y ago
Wouldn't you then have to log in twice to the same site if you have it opened in multiple tabs?
- mcny 8y ago
  Sounds like a feature to me. I'd love it if things worked that way.
  - folkrav 8y ago
    People who are aware of how pervasive tracking is wouldn't mind much indeed. The average user would be _infuriated_ of having to login every time they open a tab.
    - philipov 8y ago
      Average users know how to use multiple tabs?
    - Deinos 8y ago
      That's where LastPass, et. al. come to the rescue. Minimizes the annoyance of multiple logins, while increasing overall security if they didn't already use a password manager.
      - diminoten 8y ago
        Minimizes, but does not remove. I'll stick to Chrome when I want my browser to not lose my sessions constantly.
    - gowld 8y ago
      Even if credentials were stored in browser (ideally has a revocable token, not a password) and login was one-click?
    - pessimizer 8y ago
      There's only so long that all those angry, multi-tabbing, somehow-simultaneously-both-ignorant-and-power users will be infuriated at every single website before they forget it ever wasn't like that.
- 7h3kk1d 8y ago
  Possibly add a merge trees feature?
- teovoinea 8y ago
  You can choose to “always open this site in this container” and have the cookie persist.
- TheRealPomax 8y ago
  you can "reopen this tab in container: ..." by right clicking on a tab, so yes, but going "oh I needed google creds" is two clicks.
1024core 8y ago
A long time ago, there used to be a browser called "Athena", which did exactly this.
unqueued 8y ago
I wrote something that launches a new instance of the Firefox engine for specific profiles. https://github.com/unqueued/foxbox https://github.com/unqueued/foxbox But I never got around to polishing it and making it more accessible. The thing that really prompted me was peeking at what financial websites were doing, trying to connect to data mining sites like ru4.com and refusing to load if they couldn't connect to facebook.com and twitter.com. My script also fixes paths in profile folders so that the roboforms extension will still work, because it is the only password manager that I have found that is able to completely automate my logins, despite the best efforts of UX designers. I also couldn't order food from seamless.com unless I allowed a script on their site to connect to facebook.com. So, now seamless.com gets its own empty sandbox. And because you're using your filesystem to store a browser profile, you can have specific extensions or settings for each profile. So whenever I want to do financial stuff, it just connects over an autossh tunnel to my home, so it will never trigger any any stupid re-authentications when I'm connecting from a cellphone or work.
derefr 8y ago
The problem with this (and the reason browsers don't already do things this way) is that it breaks Single Sign-On flows like OAuth. When your browser redirects a tab from example.com to accounts.google.com to do an OAuth login, the Google OAuth login cookie that gets set by accounts.google.com under that tab, needs to also be visible later on to any other tab whose "root node" navigates to accounts.google.com. Maybe you can make an exception for just SSO providers—but won't other nefarious uses (e.g. analytics providers) then just pretend to be SSO flows? And maybe you can just whitelist the existing SSO providers—but that's an instant oligopoly.
- deno 8y ago
  Let’s break it and have the browser handle auth flow itself.
  - jovial_cavalier 8y ago
    But then you have state shared between tabs and that breaks OPs whole idea, because it kills the sandboxing.
    - deno 8y ago
      See BrowserID. It’s based on cryptographic proof and would work with any backend, including offline.
- esotericn 8y ago
  That's not a bug, that's the point. "Single sign on" means "contact centralised provider with identifying information plus site browsed". The explicit desire here is to stop that tracking. Tracking _is_ single sign on with the "sign on" being invisible to the user.
  - derefr 8y ago
    You're thinking of consumer SSO. There's also enterprise SSO. Per-tab cookie isolation would break pretty much every bigcorp's Intranet, because they're composed of a bunch of different services that all rely on a centralized IAM provider. (Mind you, Google themselves are working to move enterprises away from this model, with their https://cloud.google.com/beyondcorp/ https://cloud.google.com/beyondcorp/ effort avoiding the "Intranet as a bunch of services on separate internal domains" model, in favor of a "Intranet as a bunch of services all living under smart proxies that make them look like one domain and handle IAM for you" model. But enterprises would need to move first, before complete tab isolation could be workable for them.) There's also even-more-enterprise SSO, i.e. SAML and its "using your bank as an SSO provider to prove your identity to government services" use-cases. This actually isn't SSO at all—there are more identity providers than there are services. The point here is to federate proofs-of-identity by allowing many different (whitelisted) agencies to vouch for your identity, so that the government doesn't need to issue you some centralized proof-of-identity. This would also break under complete tab isolation, and I don't think there's any good replacement in this case.
jammygit 8y ago
From a UX perspective, that sounds confusing to me. How do you know which subtree from 2 weeks ago each tab is from? It might be an alright tradeoff for 'power' users though
pkamb 8y ago
A new tab should be able to go "back" to its parent. Kind of weird that no browser has implemented this yet.
- moosingin3space 8y ago
  There is (was?) a prototype built on top of Servo and browser.html for this: https://medium.freecodecamp.org/lossless-web-navigation-with-trails-9cd48c0abb56 https://medium.freecodecamp.org/lossless-web-navigation-with... Not sure if it has any traction anymore.
- krishicks 8y ago
  If I understand you correctly, Safari does this on both iOS and macOS. If you click a link that opens a new tab and swipe back from that new tab, Safari closes the new tab and shows you the previous tab. I’m not exactly sure of the behavior when you open a new tab, then go to another tab, then back to the tab that was opened and then swipe back, though.
  - pkamb 8y ago
    Safari for iOS has kind of a "grace period" where the back gestures do work from the new tab. But I think this is more to aid the confusion for people who don't understand that a new tab has even been created. If you switch tabs, or close the app, or do anything other than somewhat immediately go back, that back history is lost. And if you do use the shortcut to go back, the new tab is destroyed. There's no ability to open a bunch of tabs and then in each of them independently navigate back to the parent.

by rplnt 8y ago

Disp4tch 8y ago

The Tree Style Tabs add-on supports this behavior with Firefox's containers, it is awesome.

bpye 8y ago
Damn I'm gonna have to give that a go.
rplnt 8y ago
That's awesome, thanks. I've tried the Tree Style Tabs in the past, it made a lot of sense to me, but unfortunately I had other issues with FF back then. Now with the containers support there's more incentive to try it again.
dave_pascua 8y ago
I found "Tree Style Tab", which doesn't mention anything about containers. You have a link and/or author for the add-on to which you're referring?

swift532 8y ago

Wouldn't you then have to log in twice to the same site if you have it opened in multiple tabs?

mcny 8y ago
Sounds like a feature to me. I'd love it if things worked that way.
- folkrav 8y ago
  People who are aware of how pervasive tracking is wouldn't mind much indeed. The average user would be _infuriated_ of having to login every time they open a tab.
  - philipov 8y ago
    Average users know how to use multiple tabs?
  - Deinos 8y ago
    That's where LastPass, et. al. come to the rescue. Minimizes the annoyance of multiple logins, while increasing overall security if they didn't already use a password manager.
    - diminoten 8y ago
      Minimizes, but does not remove. I'll stick to Chrome when I want my browser to not lose my sessions constantly.
  - gowld 8y ago
    Even if credentials were stored in browser (ideally has a revocable token, not a password) and login was one-click?
  - pessimizer 8y ago
    There's only so long that all those angry, multi-tabbing, somehow-simultaneously-both-ignorant-and-power users will be infuriated at every single website before they forget it ever wasn't like that.
7h3kk1d 8y ago
Possibly add a merge trees feature?
teovoinea 8y ago
You can choose to “always open this site in this container” and have the cookie persist.
TheRealPomax 8y ago
you can "reopen this tab in container: ..." by right clicking on a tab, so yes, but going "oh I needed google creds" is two clicks.

1024core 8y ago

A long time ago, there used to be a browser called "Athena", which did exactly this.

unqueued 8y ago

I wrote something that launches a new instance of the Firefox engine for specific profiles. https://github.com/unqueued/foxbox https://github.com/unqueued/foxbox But I never got around to polishing it and making it more accessible. The thing that really prompted me was peeking at what financial websites were doing, trying to connect to data mining sites like ru4.com and refusing to load if they couldn't connect to facebook.com and twitter.com. My script also fixes paths in profile folders so that the roboforms extension will still work, because it is the only password manager that I have found that is able to completely automate my logins, despite the best efforts of UX designers. I also couldn't order food from seamless.com unless I allowed a script on their site to connect to facebook.com. So, now seamless.com gets its own empty sandbox. And because you're using your filesystem to store a browser profile, you can have specific extensions or settings for each profile. So whenever I want to do financial stuff, it just connects over an autossh tunnel to my home, so it will never trigger any any stupid re-authentications when I'm connecting from a cellphone or work.

derefr 8y ago

The problem with this (and the reason browsers don't already do things this way) is that it breaks Single Sign-On flows like OAuth. When your browser redirects a tab from example.com to accounts.google.com to do an OAuth login, the Google OAuth login cookie that gets set by accounts.google.com under that tab, needs to also be visible later on to any other tab whose "root node" navigates to accounts.google.com. Maybe you can make an exception for just SSO providers—but won't other nefarious uses (e.g. analytics providers) then just pretend to be SSO flows? And maybe you can just whitelist the existing SSO providers—but that's an instant oligopoly.

deno 8y ago
Let’s break it and have the browser handle auth flow itself.
- jovial_cavalier 8y ago
  But then you have state shared between tabs and that breaks OPs whole idea, because it kills the sandboxing.
  - deno 8y ago
    See BrowserID. It’s based on cryptographic proof and would work with any backend, including offline.
esotericn 8y ago
That's not a bug, that's the point. "Single sign on" means "contact centralised provider with identifying information plus site browsed". The explicit desire here is to stop that tracking. Tracking _is_ single sign on with the "sign on" being invisible to the user.
- derefr 8y ago
  You're thinking of consumer SSO. There's also enterprise SSO. Per-tab cookie isolation would break pretty much every bigcorp's Intranet, because they're composed of a bunch of different services that all rely on a centralized IAM provider. (Mind you, Google themselves are working to move enterprises away from this model, with their https://cloud.google.com/beyondcorp/ https://cloud.google.com/beyondcorp/ effort avoiding the "Intranet as a bunch of services on separate internal domains" model, in favor of a "Intranet as a bunch of services all living under smart proxies that make them look like one domain and handle IAM for you" model. But enterprises would need to move first, before complete tab isolation could be workable for them.) There's also even-more-enterprise SSO, i.e. SAML and its "using your bank as an SSO provider to prove your identity to government services" use-cases. This actually isn't SSO at all—there are more identity providers than there are services. The point here is to federate proofs-of-identity by allowing many different (whitelisted) agencies to vouch for your identity, so that the government doesn't need to issue you some centralized proof-of-identity. This would also break under complete tab isolation, and I don't think there's any good replacement in this case.

jammygit 8y ago

From a UX perspective, that sounds confusing to me. How do you know which subtree from 2 weeks ago each tab is from? It might be an alright tradeoff for 'power' users though

pkamb 8y ago

A new tab should be able to go "back" to its parent. Kind of weird that no browser has implemented this yet.

moosingin3space 8y ago
There is (was?) a prototype built on top of Servo and browser.html for this: https://medium.freecodecamp.org/lossless-web-navigation-with-trails-9cd48c0abb56 https://medium.freecodecamp.org/lossless-web-navigation-with... Not sure if it has any traction anymore.
krishicks 8y ago
If I understand you correctly, Safari does this on both iOS and macOS. If you click a link that opens a new tab and swipe back from that new tab, Safari closes the new tab and shows you the previous tab. I’m not exactly sure of the behavior when you open a new tab, then go to another tab, then back to the tab that was opened and then swipe back, though.
- pkamb 8y ago
  Safari for iOS has kind of a "grace period" where the back gestures do work from the new tab. But I think this is more to aid the confusion for people who don't understand that a new tab has even been created. If you switch tabs, or close the app, or do anything other than somewhat immediately go back, that back history is lost. And if you do use the shortcut to go back, the new tab is destroyed. There's no ability to open a bunch of tabs and then in each of them independently navigate back to the parent.