10 ms·

Multi-Account Containers Add-on on Mozilla VPN

141 points by alexrustic 5y ago

mikece 5y ago
Multi-account containers are THE reason I cannot switch away from Firefox (not that I have a desire to do so). Tying in a custom VPN location to a container is very nice but I wish I could specify a different VPN provider per container. For example: to log into my email or MS Teams account for work connect to my employer's VPN; to connect to Gmail use the Mozilla VPN; to connect to favorite "free-range, independently sourced" videos website I would want yet another VPN... and TOR enabled. That said, what is so hard about Multi-account containers that Chromium doesn't have it?
- sorokod 5y ago
  Lost revenue most likely.
- georgyo 5y ago
  I use Firefox and don't use containers, but I have a friend who can't use Firefox because it doesn't have multiple profiles. Chrome can create multiple browser windows that are isolated from each other, making a very clear distinction of scope. Firefox has containers, chromium has profiles. They accomplish the same goals is sightly different ways.
  - buscoquadnary 5y ago
    Firefox does have multiple profiles.
  - BeefWellington 5y ago
    Firefox has both profiles and containers. However, the UX for Firefox's profiles feature is godawful. Lately though, I find I prefer not to trust the application to manage this and just launch separate profiles in their own separate app namespaces using things like firecracker, firejail, or similar (depending on need).
    - easrng 5y ago
      about:profiles isn't that bad. There's no reference to it in the UI though.
      - BeefWellington 5y ago
        It's gotten better but I wouldn't say it isn't bad. A big part of the problem is not having an easy way to access it. Similarly, -ProfileManager has existed for ages and that experience is also bad. If I have to go to the lengths of about:profiles or using the -ProfileManager or -P command-line switches, why not just sandbox the entire thing? It definitely needs a useability upgrade.
        jatone 5y ago
        i refuse to use it given how bad the ux is. which is unfortunate because its a killer feature and why I can't recommend firefox over chrome. basic ux.
        charcircuit 5y ago
        >A big part of the problem is not having an easy way to access it. I've never had any issues typing "about:profiles" into the URL bar. It even autocompletes.
  - peakaboo 5y ago
    about:profiles You can have as many as you want.
  - satysin 5y ago
    > but I have a friend who can't use Firefox because it doesn't have multiple profiles. Did you or your friend not even try and Google for "firefox profiles"? Because if you did you would have found the following link as the top result https://support.mozilla.org/en-US/kb/profile-manager-create-remove-switch-firefox-profiles https://support.mozilla.org/en-US/kb/profile-manager-create-... Profiles have been in Firefox for longer than I can remember. I am pretty sure longer than Chrome has existed.
    - andrecarini 5y ago
      Firefox's UI/UX for profiles is, unfortunately, very clunky and nowhere near as intuitive as Chrome's.
    - zamadatix 5y ago
      Needing to go to an internal page or create a custom shortcut to even see the feature exists has always been the problem, combined with the poor profile switching UI once you do know it exists. In Chrome it's an inherent part of the browser UI and the browser not only shows it to you but explains to you how to use them. Remember 2/3 of Firefox users don't even have an extension, expecting them to just accept this as the answer is laughable. I've always felt Chrome was missing proper containers and Firefox was missing proper profiles.
      - ipaddr 5y ago
        Just start with the -p flag
        zamadatix 5y ago
        Yep, and that alone is enough for it to be too much a PITA to the average user. Modify a shortcut? Oh you mean all of them? Oh the Start Menu is customizable? Well I'm on a Mac. Well sometimes it doesn't work... wait what do you mean other programs can have opened Firefox and I have to reopen it with the right profile? I'm in the other profile now but the wrong stuff is there! (they didn't manually customize the secondary profile to be visually distinct). "just start with the -p flag" avoids the user accessibility issue with the technical answer repeated. These are obviously answered problems for anyone on HN but not obvious problems for the majority of users that have never even installed an extension (even an adblocker). Chrome avoids all of these by automatically managing the shortcuts (clearly named), providing clear in-browser always visible UI about multiple profiles (also clearly marked), and explaining to the user how to make/manage them in app. This is before getting into problems Chrome shares with Firefox like not syncing local profiles or issues with the way things work on Android.
  - heavyset_go 5y ago
    Check out the Profiler Switcher for Firefox add-on[1]. [1] https://addons.mozilla.org/en-US/firefox/addon/profile-switcher/ https://addons.mozilla.org/en-US/firefox/addon/profile-switc...
    - commoner 5y ago
      I highly recommend the Profile Switcher for Firefox add-on. Its user experience is very similar to Chrome's profile switcher menu. Different profiles must be loaded in different windows (like Chrome), but different containers can be used in different tabs in the same window. With both profiles and containers in Firefox, you get different containers per profile, which can be a useful way to organize them.
  - newhotelowner 5y ago
    No. Firefox is way better. Firefox has profiles & containers. I just wish FF has a better support for PDF. I keep my NSFW Firefox profile in a veracrypt drive. Using about:profiles I can launch the profile that I want to use, and start from previous session.
- warent 5y ago
  Except that the behavior of creating a new tab via the + button vs. CMD+T (in Mac) is that one of them creates a tab in the active container and one of them does not. This is a dealbreaker for me and kills the hype. https://github.com/mozilla/multi-account-containers/issues/356 https://github.com/mozilla/multi-account-containers/issues/3...
  - red_trumpet 5y ago
    For me (Xubuntu 20.04), both behave the same: They open a new tab with no container (which could be considered the "standard container").
    - eikenberry 5y ago
      Check out the "Sticky Windows Container" add-on.. it makes the container of the left most tab the default for that window. It's a pretty decent way to manage multiple default containers.
- peakaboo 5y ago
  Because Google doesn't want you to have privacy and avoid tracking. They are in the camp that wants more of it, and they want to control it fully on the entire world wide Web.
- dblohm7 5y ago
  Containers are plumbed throughout Gecko. It's not trivial to add, but it's not intractable either. Somebody has to be willing to put in the effort, more than anything.
- javajosh 5y ago
  I suspect that account containers in Firefox has very, very low uptake. Why? Because it's a feature that is difficult to understand - it has nuance to it. Just understanding what it does for you requires a pretty sophisticated understanding of how browsers work, and how websites work. If uptake is low, it makes sense that Google would not prioritize the feature. As a happy coincidence, this also keeps the maintstream web in place, a relatively simpler mental model for ad tech software devs working on the web, where your starting point is a user browser capable of moving small strings between origins without the user's knowledge or consent. Which leads me to the idea that maybe the feature should be better motivated! Perhaps we can show the user a meaningful and well-defined number, comparing for example the sheer size of a normal request vs one made in a container. If necessary, you can dig deeper into the payload, and ask questions of the system like, "What are they saying about me and my activity, using my own browser as a communication channel?" This latter one could be quite fun and take community contributions, small code snippets that know how to parse a request and interpret and display the meaning to the user. This is where the imagination of a developer can be helpful, to basically characterize as completely as possible the patterns we expect to see. Because so far, that's a very low-level mechanism, and clearly there's more room for protocols - and given the nature of this problem, multiple, overlapping, dynamic protocols that are proprietary in nature. We can imagine origins that just suck everything in, doing unknown processing on that data, but giving us tools to measure aggregate engagement. The need to define an audience on something more than source IP becomes immediately apparent, and permissive 3rd party cookies have enabled a huge ecosystem to arise, and each persistent part of that is specialized in some way. But the money is in showing users ads, and showing them really useful ads. This means measuring the users and trying to anticipate their needs. We can base this on "identity" facts that don't vary much over time, or on "behavior" facts that vary a lot over time, albeit with lots of consistency for most of it. Both are used to predict what a user wants enough to spend money on. In particular, behavior, what are they asking about, learning about? What sorts of tools and supplies - things you can buy - are associated with the subject? TBH if this happened on the client side, I wouldn't find it creepy at all; I'd find it quite useful. There are really two problems with server side processing of identity and behavior: first, it quickly gets bigoted when people are asked to associate an identity with a consumer demand. Who gets to make this association? Are we okay with this being a self-reenforcing mechanism since we are pushing identities toward the behaviors we associate with their stereo-type? Second, it lets servers split the internet without our knowledge. The incentive to garner as much attention as possible leads inevitably to breaking our shared perception of the world. At least, back in the day, you could argue with someone over a book, and know you have read the same book. But now, the book is a screen, basically a browser, and it is very different for each individual, and no-one is fully aware of this truth. I'm being utterly serious when I say that these are the kinds of issues, technical and philosophical, that users need to be aware of before they can get excited about a feature like tab containers. Given the level of civic discourse in the wider world, my hope that people would be open to learning about it is slim to none. Heck, even most devs prefer not to think about it, and just make the changes the money wants to make, without regard to the users benefit. Then of course there is the secondary market for this data, law enforcement. You could probably get 80% of a panopticon by just hoovering Google analytics data for "alternative" processing. You get the rest by piggy-backing Cloudflare and the like. The interesting thing about CF and other CDNs is that they can provide an alternate, and unavoidable, surveillance function, since they can use access logs, and you cannot use the software without getting the bytes. This ends up being a strong argument in favor of content-addressable resources, rather than named resources: they would let a client rotate physical access, and these segmented logs would make it hard to recreate a coherent timeline. But not impossible: if enough sources cooperated, the could aggregate their logs and you'd lose your anonymity. No, what the world needs is not just a defensive thing like tab containers, but a more aggressive thing. Rather than isolate an account's data, why not provide all the connectivity it wants, but poison the well. Manipulate the messages sent out by your computer to mislead these trackers: shift identities, access different resources, do different things in those resources. It should look identical to ordinary host lookup traffic, but the messages will be different, noisy, worse than useless. Maybe call them "active defense containers".
- gigel82 5y ago
  You can use different VPN providers per-container-type; go to manage containers, select your container type, then click on Advanced proxy settings (last option); there you can input a proxy address. For testing, you can just type the SOCKS5 address from your VPN provider, but that's not very secure. In my case, I have a Pi running a few Dockers (with network pairs of OpenVPN/WireGuard + Socks5 proxies); it works decently enough, I can even use streaming services like Netflix / etc. if that's something you care about.
  - travisporter 5y ago
    Very cool! So if I assume that my ISP is recording/selling my browsing history, including which sites I visit, would this setup prevent me from being snooped on? I don't know if DNS goes over the socks5
    - gigel82 5y ago
      SOCKS5 does not encrypt traffic, so if you put in a public / internet SOCKS5 server address that won't prevent snooping. If you have a spare Raspberry Pi (perhaps running PiHole / AdGuard as well which takes care of DNS security and ad-blocking on top), or another server running you can spin up a Docker (or VM/or baremetal) with an OpenVPN / WireGuard client and a SOCKS5 proxy. For example, in my setup I use the "dperson/openvpn-client" and "serjs/go-socks5-proxy" docker images (set the socks5 container to use the network of the vpn client, and expose the socks5 port out of the vpn container). You should explore whatever option works best for your home and VPN setups.
      - TedDoesntTalk 5y ago
        SOCKS5 does support tunneling of DNS lookups. The FoxyProxy addon for Firefox has that option when you configure it to use a SOCKS5 server.
        gigel82 5y ago
        SOCKS5, the protocol, is not encrypted. Data is sent in clear text across the wire and can be intercepted at any time. Of course, the data is just TCP and UDP packets, so you could be running a HTTPS connection over it (or DOH for DNS) but from the ISP's point of view SOCKS5 or no SOCKS5 they can see just as much of your traffic. SOCKS5 to an external server is not solving encryption, you need a VPN for that; at most, it can solve anonymity (by hiding your IP address, presuming you trust the SOCKS5 server operator). In my case, I'm using SOCKS5 to another machine in my LAN which in turn connects to an external VPN provider over an encrypted channel (OpenVPN or WireGuard).
- brazzledazzle 5y ago
  Your work’s VPN might have a strict policy against split tunnel VPN clients. Or they might have narrowly defined lists of IP blocks they split for bandwidth purposes (e.g. Microsoft’s O365 blocks to reduce teams bandwidth). If you think about it a split VPN tunnel with a default route to the internet effectively makes your client a bridge between your internal corporate network and the rest of the world. A bridge that browses the web and installs downloaded binaries. Just something to look into since it could get you spanked by your net or sec team if your company has those.
- fomine3 5y ago
  Google have incentive not to implement it because of they earn $$$$$$ from tracking ads.
jimmaswell 5y ago
Ok, but where the hell are my Android extensions? It's been years, what possible excuse is there? Either admit you just don't care about extensions so I stop wasting my time, or stop wasting resources on pointless vanity projects and get your shit together. Every new random thing like this is an insult to longstanding users who are still wanting for the baseline experience they had years ago.
- kmeisthax 5y ago
  Still can't believe we live in a world where iOS has web extensions before Android does
  - celsoazevedo 5y ago
    Firefox for Android does support (proper) browser extensions. I have uBlock Origin, for example. The problem is that by default Mozilla only allows a small number of extensions since the redesign/new Firefox. There's a way to use the other extensions, but it requires FF nightly and our own list of extensions: https://blog.mozilla.org/addons/2020/09/29/expanded-extension-support-in-firefox-for-android-nightly/ https://blog.mozilla.org/addons/2020/09/29/expanded-extensio...
  - sudosysgen 5y ago
    Firefox on Android has had extensions for a while now. I'm using them everyday. It's just that you can't use all extensions on it as of now.
    - DoingIsLearning 5y ago
      > It's just that you can't use all extensions on it as of now. This is so incredibly misleading I struggle to take it seriously. They had _thousands_ of add-ons on firefox and any remotely popular add-on had a firefox-for-android release. If I open Nightly right now and disable custom add-ons I see a woping _18_ add-ons available and this is _3_ years after the first release with GeckoView. They made the design decision to change to GeckoView engine in firefox 79. They made this decision with the awareness that it would break all of these add-ons. They have made a very low design effort in the last 3 years to resolve this. Users went went from hundreds of add-ons and stabilished workflows to 18 add-ons after 3 years of rolling updates. Power users won't be stopped by this, as Celso mentioned you can add your custom collection on AMO, but it speaks volumes about how much lack of focus there is in FF and the lack of user voice in the current design decisions.
Nextgrid 5y ago
Another Mozilla PR piece regarding "privacy"... let me see, did they finally bundle (or reimplement) uBlock Origin as a standard feature of the browser? No. Did they make telemetry opt-in as required per the GDPR? No. Did they stop opening Mozilla webpages on first run which contain Google Analytics (also in breach of the GDPR)? No. Snark aside, this change (for once!) does have some benefits. Tracking using IP address & user-agent alone is pretty strong regardless of cookies/etc and can't be completely blocked client-side when you do need to load the requested resource (such as browsing the malicious website, or third-party websites using Google Fonts/ReCaptcha/etc), so containing these within their own VPN, separate from other browsing activity is an effective countermeasure.
- james-redwood 5y ago
  They derive nearly 90% of their revenue from allowing Google to be the default search engine. Default uBlock is an impossibility. If you’d like Firefox with that feature, try the LibreWolf fork.
  - Nextgrid 5y ago
    That doesn't prevent me from calling them out on their bullshit. You want to make money from ads? Fine, but don't go around shouting "PRIVACY" at every possible opportunity and giving people a false sense of security.
- probably_wrong 5y ago
  While I agree with most of your points, I don't want Firefox to implement uBlock Origin. Should Firefox prioritize compatibility with it? Yes. Should the uBlock Origin developers have the personal cell phone of Mozilla's CTO? Also yes. But there's nothing to be gained from absorbing it, and all we'll get is more bureaucracy. If anything, I'd like Firefox to focus more on their core product, not less.
  - Nextgrid 5y ago
    My argument is that Firefox should have functionality equivalent to uBlock Origin by default, so that less tech-savvy users who install the "privacy" focused browser actually get some without having to browse for extra add-ons and potentially install an inferior or outright malicious option.
DavideNL 5y ago
Note that you can also assign containers to a specific vpn (for example Mullvad) with Container Proxy: https://addons.mozilla.org/en-US/firefox/addon/container-proxy/ https://addons.mozilla.org/en-US/firefox/addon/container-pro...
- okanesen 5y ago
  Even though I'm using Container Proxy myself, you can almost do the same thing with the official plugin (Manage Containers -> Click any Container -> Advanced proxy settings).
anonymousab 5y ago
This seems a bit weird as containers still share history and other data between them. I get that they're not supposed to replace profiles, but this feature seems more suited to a per-profile basis than per-container because of said leakage. Of course, you can already do per-profile VPNs via split tunneling and a --profile specifier on startup, but it'd be nice to have a better UI within Firefox itself for the idea.
alexrustic 5y ago
See also: VPN by Google One comes to iOS https://news.ycombinator.com/item?id=30165696 https://news.ycombinator.com/item?id=30165696
surrTurr 5y ago
Absolutely loving FF containers & their VPN. Mozilla VPN integration was the reason why I gave their vpn service a try, and so far it’s been an absolute blast. I completely forget that I got an VPN running in the background, that‘s how fast it is. I made containers for all of the big tech companies. With the VPN settings per container, Google now thinks I moved to Swizerland lol.
rogers18445 5y ago
You could already do this with Mullvad. Use an extension such as Sideberry which allows different proxies for different containers. Then use Mullvad's socks5 set of endpoints.
- ersii 5y ago
  It's not mentioned in their post, but Mozilla VPN is a brand/browser integration of Mullvad, which is excellent, so that's what they're using underneath the branding.
tvanantwerp 5y ago
I gave up on containers in Firefox a while ago. They didn't really support subdomains, which made using some services (e.g., AWS) extremely painful. Any site with a different subdomain for the login page, the auth flow, the dashboard, etc., became unusable. Don't know if they ever fixed it to allow for grouping subdomains.
- FinalBriefing 5y ago
  I didn't find that unusable...you just have to add all the sub domains to the same container. Usually it isn't very many. I use the "no container" default for work stuff, which means everything just works normally. Anything that isn't a tool for work, that gets a container.
- okanesen 5y ago
  I use Containerise[0] (not affiliated) exactly for that purpose but I agree, this should really be included in the official plugin. [0]: https://github.com/kintesh/containerise https://github.com/kintesh/containerise
some_developer 5y ago
I need to use them almost daily for work. AWS SSO and often need access to multiple accounts at once. Without multi containers this would be a serious PITA
Mandatum 5y ago
Why is the VPN still not available in Australia?
nsonha 5y ago
I love Firefox when they have a focus (privacy), get it together Mozilla
terrycody 5y ago
I just wish they can bring back the official VPN add-on, which is removed after the beta test, no idea why.
dhaavi 5y ago
> [feature] only available in Firefox Not exactly. You can achieve pretty much the same result for the use cases described in the blog post today with the SPN (https://safing.io/spn/ https://safing.io/spn/) - using any browser: The SPN automatically routes every connection individually over multiple hops through the onion-encrypting network, resulting in many exit servers being used simultaneously. Disclaimer: I’m Co-Founder/CTO of Safing, the company behind the SPN. You can ask me questions here - I have notifications enabled.
- ranguna 5y ago
  I'm guessing [feature] means routing happens through Firefox vpn.
  - dhaavi 5y ago
    With “[feature]” I was referring to Firefox’ ability to set a different VPN server per container.
    - ranguna 5y ago
      I was referring to the title of the article "Keep your multiple online lives private with Multi-Account Containers Add-on on Mozilla VPN"
jokoon 5y ago
I wish containers was a default feature. I also wish the UI was better. Adding domains and containers is awkward. Not to mention that with some sites like Google, it's difficult to make containers work, for example of you want to use Gmail and google search without being logged in to Google search. Same with YouTube. It will switch to a new container because of a different login domain.

141 points by alexrustic 5y ago

Multi-account containers are THE reason I cannot switch away from Firefox (not that I have a desire to do so). Tying in a custom VPN location to a container is very nice but I wish I could specify a different VPN provider per container. For example: to log into my email or MS Teams account for work connect to my employer's VPN; to connect to Gmail use the Mozilla VPN; to connect to favorite "free-range, independently sourced" videos website I would want yet another VPN... and TOR enabled. That said, what is so hard about Multi-account containers that Chromium doesn't have it?

sorokod 5y ago
Lost revenue most likely.
georgyo 5y ago
I use Firefox and don't use containers, but I have a friend who can't use Firefox because it doesn't have multiple profiles. Chrome can create multiple browser windows that are isolated from each other, making a very clear distinction of scope. Firefox has containers, chromium has profiles. They accomplish the same goals is sightly different ways.
- buscoquadnary 5y ago
  Firefox does have multiple profiles.
- BeefWellington 5y ago
  Firefox has both profiles and containers. However, the UX for Firefox's profiles feature is godawful. Lately though, I find I prefer not to trust the application to manage this and just launch separate profiles in their own separate app namespaces using things like firecracker, firejail, or similar (depending on need).
  - easrng 5y ago
    about:profiles isn't that bad. There's no reference to it in the UI though.
    - BeefWellington 5y ago
      It's gotten better but I wouldn't say it isn't bad. A big part of the problem is not having an easy way to access it. Similarly, -ProfileManager has existed for ages and that experience is also bad. If I have to go to the lengths of about:profiles or using the -ProfileManager or -P command-line switches, why not just sandbox the entire thing? It definitely needs a useability upgrade.
      - jatone 5y ago
        i refuse to use it given how bad the ux is. which is unfortunate because its a killer feature and why I can't recommend firefox over chrome. basic ux.
      - charcircuit 5y ago
        >A big part of the problem is not having an easy way to access it. I've never had any issues typing "about:profiles" into the URL bar. It even autocompletes.
- peakaboo 5y ago
  about:profiles You can have as many as you want.
- satysin 5y ago
  > but I have a friend who can't use Firefox because it doesn't have multiple profiles. Did you or your friend not even try and Google for "firefox profiles"? Because if you did you would have found the following link as the top result https://support.mozilla.org/en-US/kb/profile-manager-create-remove-switch-firefox-profiles https://support.mozilla.org/en-US/kb/profile-manager-create-... Profiles have been in Firefox for longer than I can remember. I am pretty sure longer than Chrome has existed.
  - andrecarini 5y ago
    Firefox's UI/UX for profiles is, unfortunately, very clunky and nowhere near as intuitive as Chrome's.
  - zamadatix 5y ago
    Needing to go to an internal page or create a custom shortcut to even see the feature exists has always been the problem, combined with the poor profile switching UI once you do know it exists. In Chrome it's an inherent part of the browser UI and the browser not only shows it to you but explains to you how to use them. Remember 2/3 of Firefox users don't even have an extension, expecting them to just accept this as the answer is laughable. I've always felt Chrome was missing proper containers and Firefox was missing proper profiles.
    - ipaddr 5y ago
      Just start with the -p flag
      - zamadatix 5y ago
        Yep, and that alone is enough for it to be too much a PITA to the average user. Modify a shortcut? Oh you mean all of them? Oh the Start Menu is customizable? Well I'm on a Mac. Well sometimes it doesn't work... wait what do you mean other programs can have opened Firefox and I have to reopen it with the right profile? I'm in the other profile now but the wrong stuff is there! (they didn't manually customize the secondary profile to be visually distinct). "just start with the -p flag" avoids the user accessibility issue with the technical answer repeated. These are obviously answered problems for anyone on HN but not obvious problems for the majority of users that have never even installed an extension (even an adblocker). Chrome avoids all of these by automatically managing the shortcuts (clearly named), providing clear in-browser always visible UI about multiple profiles (also clearly marked), and explaining to the user how to make/manage them in app. This is before getting into problems Chrome shares with Firefox like not syncing local profiles or issues with the way things work on Android.
- heavyset_go 5y ago
  Check out the Profiler Switcher for Firefox add-on[1]. [1] https://addons.mozilla.org/en-US/firefox/addon/profile-switcher/ https://addons.mozilla.org/en-US/firefox/addon/profile-switc...
  - commoner 5y ago
    I highly recommend the Profile Switcher for Firefox add-on. Its user experience is very similar to Chrome's profile switcher menu. Different profiles must be loaded in different windows (like Chrome), but different containers can be used in different tabs in the same window. With both profiles and containers in Firefox, you get different containers per profile, which can be a useful way to organize them.
- newhotelowner 5y ago
  No. Firefox is way better. Firefox has profiles & containers. I just wish FF has a better support for PDF. I keep my NSFW Firefox profile in a veracrypt drive. Using about:profiles I can launch the profile that I want to use, and start from previous session.
warent 5y ago
Except that the behavior of creating a new tab via the + button vs. CMD+T (in Mac) is that one of them creates a tab in the active container and one of them does not. This is a dealbreaker for me and kills the hype. https://github.com/mozilla/multi-account-containers/issues/356 https://github.com/mozilla/multi-account-containers/issues/3...
- red_trumpet 5y ago
  For me (Xubuntu 20.04), both behave the same: They open a new tab with no container (which could be considered the "standard container").
  - eikenberry 5y ago
    Check out the "Sticky Windows Container" add-on.. it makes the container of the left most tab the default for that window. It's a pretty decent way to manage multiple default containers.
peakaboo 5y ago
Because Google doesn't want you to have privacy and avoid tracking. They are in the camp that wants more of it, and they want to control it fully on the entire world wide Web.
dblohm7 5y ago
Containers are plumbed throughout Gecko. It's not trivial to add, but it's not intractable either. Somebody has to be willing to put in the effort, more than anything.
javajosh 5y ago
I suspect that account containers in Firefox has very, very low uptake. Why? Because it's a feature that is difficult to understand - it has nuance to it. Just understanding what it does for you requires a pretty sophisticated understanding of how browsers work, and how websites work. If uptake is low, it makes sense that Google would not prioritize the feature. As a happy coincidence, this also keeps the maintstream web in place, a relatively simpler mental model for ad tech software devs working on the web, where your starting point is a user browser capable of moving small strings between origins without the user's knowledge or consent. Which leads me to the idea that maybe the feature should be better motivated! Perhaps we can show the user a meaningful and well-defined number, comparing for example the sheer size of a normal request vs one made in a container. If necessary, you can dig deeper into the payload, and ask questions of the system like, "What are they saying about me and my activity, using my own browser as a communication channel?" This latter one could be quite fun and take community contributions, small code snippets that know how to parse a request and interpret and display the meaning to the user. This is where the imagination of a developer can be helpful, to basically characterize as completely as possible the patterns we expect to see. Because so far, that's a very low-level mechanism, and clearly there's more room for protocols - and given the nature of this problem, multiple, overlapping, dynamic protocols that are proprietary in nature. We can imagine origins that just suck everything in, doing unknown processing on that data, but giving us tools to measure aggregate engagement. The need to define an audience on something more than source IP becomes immediately apparent, and permissive 3rd party cookies have enabled a huge ecosystem to arise, and each persistent part of that is specialized in some way. But the money is in showing users ads, and showing them really useful ads. This means measuring the users and trying to anticipate their needs. We can base this on "identity" facts that don't vary much over time, or on "behavior" facts that vary a lot over time, albeit with lots of consistency for most of it. Both are used to predict what a user wants enough to spend money on. In particular, behavior, what are they asking about, learning about? What sorts of tools and supplies - things you can buy - are associated with the subject? TBH if this happened on the client side, I wouldn't find it creepy at all; I'd find it quite useful. There are really two problems with server side processing of identity and behavior: first, it quickly gets bigoted when people are asked to associate an identity with a consumer demand. Who gets to make this association? Are we okay with this being a self-reenforcing mechanism since we are pushing identities toward the behaviors we associate with their stereo-type? Second, it lets servers split the internet without our knowledge. The incentive to garner as much attention as possible leads inevitably to breaking our shared perception of the world. At least, back in the day, you could argue with someone over a book, and know you have read the same book. But now, the book is a screen, basically a browser, and it is very different for each individual, and no-one is fully aware of this truth. I'm being utterly serious when I say that these are the kinds of issues, technical and philosophical, that users need to be aware of before they can get excited about a feature like tab containers. Given the level of civic discourse in the wider world, my hope that people would be open to learning about it is slim to none. Heck, even most devs prefer not to think about it, and just make the changes the money wants to make, without regard to the users benefit. Then of course there is the secondary market for this data, law enforcement. You could probably get 80% of a panopticon by just hoovering Google analytics data for "alternative" processing. You get the rest by piggy-backing Cloudflare and the like. The interesting thing about CF and other CDNs is that they can provide an alternate, and unavoidable, surveillance function, since they can use access logs, and you cannot use the software without getting the bytes. This ends up being a strong argument in favor of content-addressable resources, rather than named resources: they would let a client rotate physical access, and these segmented logs would make it hard to recreate a coherent timeline. But not impossible: if enough sources cooperated, the could aggregate their logs and you'd lose your anonymity. No, what the world needs is not just a defensive thing like tab containers, but a more aggressive thing. Rather than isolate an account's data, why not provide all the connectivity it wants, but poison the well. Manipulate the messages sent out by your computer to mislead these trackers: shift identities, access different resources, do different things in those resources. It should look identical to ordinary host lookup traffic, but the messages will be different, noisy, worse than useless. Maybe call them "active defense containers".
gigel82 5y ago
You can use different VPN providers per-container-type; go to manage containers, select your container type, then click on Advanced proxy settings (last option); there you can input a proxy address. For testing, you can just type the SOCKS5 address from your VPN provider, but that's not very secure. In my case, I have a Pi running a few Dockers (with network pairs of OpenVPN/WireGuard + Socks5 proxies); it works decently enough, I can even use streaming services like Netflix / etc. if that's something you care about.
- travisporter 5y ago
  Very cool! So if I assume that my ISP is recording/selling my browsing history, including which sites I visit, would this setup prevent me from being snooped on? I don't know if DNS goes over the socks5
  - gigel82 5y ago
    SOCKS5 does not encrypt traffic, so if you put in a public / internet SOCKS5 server address that won't prevent snooping. If you have a spare Raspberry Pi (perhaps running PiHole / AdGuard as well which takes care of DNS security and ad-blocking on top), or another server running you can spin up a Docker (or VM/or baremetal) with an OpenVPN / WireGuard client and a SOCKS5 proxy. For example, in my setup I use the "dperson/openvpn-client" and "serjs/go-socks5-proxy" docker images (set the socks5 container to use the network of the vpn client, and expose the socks5 port out of the vpn container). You should explore whatever option works best for your home and VPN setups.
    - TedDoesntTalk 5y ago
      SOCKS5 does support tunneling of DNS lookups. The FoxyProxy addon for Firefox has that option when you configure it to use a SOCKS5 server.
      - gigel82 5y ago
        SOCKS5, the protocol, is not encrypted. Data is sent in clear text across the wire and can be intercepted at any time. Of course, the data is just TCP and UDP packets, so you could be running a HTTPS connection over it (or DOH for DNS) but from the ISP's point of view SOCKS5 or no SOCKS5 they can see just as much of your traffic. SOCKS5 to an external server is not solving encryption, you need a VPN for that; at most, it can solve anonymity (by hiding your IP address, presuming you trust the SOCKS5 server operator). In my case, I'm using SOCKS5 to another machine in my LAN which in turn connects to an external VPN provider over an encrypted channel (OpenVPN or WireGuard).
brazzledazzle 5y ago
Your work’s VPN might have a strict policy against split tunnel VPN clients. Or they might have narrowly defined lists of IP blocks they split for bandwidth purposes (e.g. Microsoft’s O365 blocks to reduce teams bandwidth). If you think about it a split VPN tunnel with a default route to the internet effectively makes your client a bridge between your internal corporate network and the rest of the world. A bridge that browses the web and installs downloaded binaries. Just something to look into since it could get you spanked by your net or sec team if your company has those.
fomine3 5y ago
Google have incentive not to implement it because of they earn $$$$$$ from tracking ads.

jimmaswell 5y ago

Ok, but where the hell are my Android extensions? It's been years, what possible excuse is there? Either admit you just don't care about extensions so I stop wasting my time, or stop wasting resources on pointless vanity projects and get your shit together. Every new random thing like this is an insult to longstanding users who are still wanting for the baseline experience they had years ago.

kmeisthax 5y ago
Still can't believe we live in a world where iOS has web extensions before Android does
- celsoazevedo 5y ago
  Firefox for Android does support (proper) browser extensions. I have uBlock Origin, for example. The problem is that by default Mozilla only allows a small number of extensions since the redesign/new Firefox. There's a way to use the other extensions, but it requires FF nightly and our own list of extensions: https://blog.mozilla.org/addons/2020/09/29/expanded-extension-support-in-firefox-for-android-nightly/ https://blog.mozilla.org/addons/2020/09/29/expanded-extensio...
- sudosysgen 5y ago
  Firefox on Android has had extensions for a while now. I'm using them everyday. It's just that you can't use all extensions on it as of now.
  - DoingIsLearning 5y ago
    > It's just that you can't use all extensions on it as of now. This is so incredibly misleading I struggle to take it seriously. They had _thousands_ of add-ons on firefox and any remotely popular add-on had a firefox-for-android release. If I open Nightly right now and disable custom add-ons I see a woping _18_ add-ons available and this is _3_ years after the first release with GeckoView. They made the design decision to change to GeckoView engine in firefox 79. They made this decision with the awareness that it would break all of these add-ons. They have made a very low design effort in the last 3 years to resolve this. Users went went from hundreds of add-ons and stabilished workflows to 18 add-ons after 3 years of rolling updates. Power users won't be stopped by this, as Celso mentioned you can add your custom collection on AMO, but it speaks volumes about how much lack of focus there is in FF and the lack of user voice in the current design decisions.

Nextgrid 5y ago

Another Mozilla PR piece regarding "privacy"... let me see, did they finally bundle (or reimplement) uBlock Origin as a standard feature of the browser? No. Did they make telemetry opt-in as required per the GDPR? No. Did they stop opening Mozilla webpages on first run which contain Google Analytics (also in breach of the GDPR)? No. Snark aside, this change (for once!) does have some benefits. Tracking using IP address & user-agent alone is pretty strong regardless of cookies/etc and can't be completely blocked client-side when you do need to load the requested resource (such as browsing the malicious website, or third-party websites using Google Fonts/ReCaptcha/etc), so containing these within their own VPN, separate from other browsing activity is an effective countermeasure.

james-redwood 5y ago
They derive nearly 90% of their revenue from allowing Google to be the default search engine. Default uBlock is an impossibility. If you’d like Firefox with that feature, try the LibreWolf fork.
- Nextgrid 5y ago
  That doesn't prevent me from calling them out on their bullshit. You want to make money from ads? Fine, but don't go around shouting "PRIVACY" at every possible opportunity and giving people a false sense of security.
probably_wrong 5y ago
While I agree with most of your points, I don't want Firefox to implement uBlock Origin. Should Firefox prioritize compatibility with it? Yes. Should the uBlock Origin developers have the personal cell phone of Mozilla's CTO? Also yes. But there's nothing to be gained from absorbing it, and all we'll get is more bureaucracy. If anything, I'd like Firefox to focus more on their core product, not less.
- Nextgrid 5y ago
  My argument is that Firefox should have functionality equivalent to uBlock Origin by default, so that less tech-savvy users who install the "privacy" focused browser actually get some without having to browse for extra add-ons and potentially install an inferior or outright malicious option.

DavideNL 5y ago

Note that you can also assign containers to a specific vpn (for example Mullvad) with Container Proxy: https://addons.mozilla.org/en-US/firefox/addon/container-proxy/ https://addons.mozilla.org/en-US/firefox/addon/container-pro...

okanesen 5y ago
Even though I'm using Container Proxy myself, you can almost do the same thing with the official plugin (Manage Containers -> Click any Container -> Advanced proxy settings).

anonymousab 5y ago

This seems a bit weird as containers still share history and other data between them. I get that they're not supposed to replace profiles, but this feature seems more suited to a per-profile basis than per-container because of said leakage. Of course, you can already do per-profile VPNs via split tunneling and a --profile specifier on startup, but it'd be nice to have a better UI within Firefox itself for the idea.

alexrustic 5y ago

See also: VPN by Google One comes to iOS https://news.ycombinator.com/item?id=30165696 https://news.ycombinator.com/item?id=30165696

surrTurr 5y ago

Absolutely loving FF containers & their VPN. Mozilla VPN integration was the reason why I gave their vpn service a try, and so far it’s been an absolute blast. I completely forget that I got an VPN running in the background, that‘s how fast it is. I made containers for all of the big tech companies. With the VPN settings per container, Google now thinks I moved to Swizerland lol.

rogers18445 5y ago

You could already do this with Mullvad. Use an extension such as Sideberry which allows different proxies for different containers. Then use Mullvad's socks5 set of endpoints.

ersii 5y ago
It's not mentioned in their post, but Mozilla VPN is a brand/browser integration of Mullvad, which is excellent, so that's what they're using underneath the branding.

tvanantwerp 5y ago

I gave up on containers in Firefox a while ago. They didn't really support subdomains, which made using some services (e.g., AWS) extremely painful. Any site with a different subdomain for the login page, the auth flow, the dashboard, etc., became unusable. Don't know if they ever fixed it to allow for grouping subdomains.

FinalBriefing 5y ago
I didn't find that unusable...you just have to add all the sub domains to the same container. Usually it isn't very many. I use the "no container" default for work stuff, which means everything just works normally. Anything that isn't a tool for work, that gets a container.
okanesen 5y ago
I use Containerise[0] (not affiliated) exactly for that purpose but I agree, this should really be included in the official plugin. [0]: https://github.com/kintesh/containerise https://github.com/kintesh/containerise

some_developer 5y ago

I need to use them almost daily for work. AWS SSO and often need access to multiple accounts at once. Without multi containers this would be a serious PITA

Mandatum 5y ago

Why is the VPN still not available in Australia?

nsonha 5y ago

I love Firefox when they have a focus (privacy), get it together Mozilla

terrycody 5y ago

I just wish they can bring back the official VPN add-on, which is removed after the beta test, no idea why.

dhaavi 5y ago

> [feature] only available in Firefox Not exactly. You can achieve pretty much the same result for the use cases described in the blog post today with the SPN (https://safing.io/spn/ https://safing.io/spn/) - using any browser: The SPN automatically routes every connection individually over multiple hops through the onion-encrypting network, resulting in many exit servers being used simultaneously. Disclaimer: I’m Co-Founder/CTO of Safing, the company behind the SPN. You can ask me questions here - I have notifications enabled.

ranguna 5y ago
I'm guessing [feature] means routing happens through Firefox vpn.
- dhaavi 5y ago
  With “[feature]” I was referring to Firefox’ ability to set a different VPN server per container.
  - ranguna 5y ago
    I was referring to the title of the article "Keep your multiple online lives private with Multi-Account Containers Add-on on Mozilla VPN"

jokoon 5y ago

I wish containers was a default feature. I also wish the UI was better. Adding domains and containers is awkward. Not to mention that with some sites like Google, it's difficult to make containers work, for example of you want to use Gmail and google search without being logged in to Google search. Same with YouTube. It will switch to a new container because of a different login domain.