5 ms·

Firefox container mode stops this. I can imagine a product that makes every tab an ephemeral container by default, and you had to explicitly opt-in to a contain

Firefox container mode stops this. I can imagine a product that makes every tab an ephemeral container by default, and you had to explicitly opt-in to a container profile to share cookies, etc. cross-tab.

pwgentleman 3y ago
Yeah there’s an extension called Temporary containers that does exactly that (^:
- baliex 3y ago
  Been using it for years and watching others’ machines for how tracked they are across the web is terrifying. Even things as basic as being on clothingshop.com and then seeing ads for said shop on someotherdomain.com, which I understand is totally normal, has become jarring for me. I recommend everyone installs it. Yes, you have to click more cookie banners, and I still say no, but mind less when I cave and say yes because what they’ll learn is so limited. My temporary containers have a persistent auto increment so after a few years it’s (semi-) interesting to see that I’m on my ~20,000th temporary container
  - ropeladder 3y ago
    With Temporary Tontainers you can just install one of the cookie-ignoring plugins, since cookies don't do much if your containers are ephemeral.
    - probably_wrong 3y ago
      It is my understanding that the name "cookie banner" is misleading, to the point of acting against your own interests. If you click Agree you agree to be tracked regardless of the method. So yes, cookies won't do much, but now you've agreed to any kind of tracking, even those that defeat private mode and/or script blockers (assuming there's one).
    - baliex 3y ago
      I haven't really looked into the plugins but surely if they can find the "accept tracking" button, they could also find the "no thanks" button instead
- ropeladder 3y ago
  Temporary Containers is fantastic. Its functionality should really be a core feature of any browser that claims to be concerned with privacy.
Aachen 3y ago
If you're linked to something on twitter or discord or so, odds are that you'll open it in that container because that's the default behavior. While you're right, and I use containers as well, I'm not sure that's a solid way to prevent this attack unless the person can be convinced to diligently right click anything they wish to open, copy the link, and manually paste it in a fresh new tab.
- fsflover 3y ago
  This is solved in Qubes OS by using separate VMs for different security domains. For Discord, a single click can be configured to open a browser in a dedicated disposable VM.
  - Aachen 3y ago
    My work requires me to open links in different VMs. How exactly do I tell a browser to override link clicks to be handled by an external program? This would be very useful indeed
    - fsflover 3y ago
      This is how I do it on Debian. First, reate a custom "browser" like this: touch .local/share/applications/open-in-dispvm.desktop, and put inside a command like this: qvm-open-in-vm '@dispvm:fedora-37-dvm' %u in accordance with this guide: https://www.qubes-os.org/doc/how-to-use-disposables/#opening-a-link-in-a-disposable-based-on-a-non-default-disposable-template-from-a-qube https://www.qubes-os.org/doc/how-to-use-disposables/#opening... To make this browser default, you do this: xdg-settings set default-web-browser open-in-dispvm.desktop See also how to create .desktop files: https://askubuntu.com/questions/45885/how-do-i-set-a-custom-browser-as-default-in-preferred-applications https://askubuntu.com/questions/45885/how-do-i-set-a-custom-....
      - Aachen 3y ago
        Browsers don't call the OS to open a URL, it would have to be an add-on or something
ravenstine 3y ago
Even better, type "about:profiles" into your URL bar, create a new profile that runs in an entirely separate Firefox process, and live your second life there.
- xjay 3y ago
  Disable automatic updates in this case (Windows). When an update is applied between the first and second profile process, any new tab won't do anything in any of the instances. Firefox likely still doesn't detect this state. Edit: That is, if you use Firefox with two or more profiles, and may start one profile later (after a new update was published).
  - magicalhippo 3y ago
    I run Firefox stable and Firefox beta on separate profiles (in addition to containers). The stuff I'm less worried about using beta.
  - ravenstine 3y ago
    Same thing happens on macOS. And yeah, I turn off automatic updates and just update when it bugs me. It's an underrated feature, IMO. Profiles can be made very purpose-specific, and I like that there's not the possibility of leakage due to a site exploiting an add-on sharing data across containers, etc. I still like the mukti-containers feature, but I see it as less of an anonymity thing and more as a convenient way to be able to sign into multiple website accounts at once.

pwgentleman 3y ago

Yeah there’s an extension called Temporary containers that does exactly that (^:

baliex 3y ago
Been using it for years and watching others’ machines for how tracked they are across the web is terrifying. Even things as basic as being on clothingshop.com and then seeing ads for said shop on someotherdomain.com, which I understand is totally normal, has become jarring for me. I recommend everyone installs it. Yes, you have to click more cookie banners, and I still say no, but mind less when I cave and say yes because what they’ll learn is so limited. My temporary containers have a persistent auto increment so after a few years it’s (semi-) interesting to see that I’m on my ~20,000th temporary container
- ropeladder 3y ago
  With Temporary Tontainers you can just install one of the cookie-ignoring plugins, since cookies don't do much if your containers are ephemeral.
  - probably_wrong 3y ago
    It is my understanding that the name "cookie banner" is misleading, to the point of acting against your own interests. If you click Agree you agree to be tracked regardless of the method. So yes, cookies won't do much, but now you've agreed to any kind of tracking, even those that defeat private mode and/or script blockers (assuming there's one).
  - baliex 3y ago
    I haven't really looked into the plugins but surely if they can find the "accept tracking" button, they could also find the "no thanks" button instead
ropeladder 3y ago
Temporary Containers is fantastic. Its functionality should really be a core feature of any browser that claims to be concerned with privacy.

Aachen 3y ago

If you're linked to something on twitter or discord or so, odds are that you'll open it in that container because that's the default behavior. While you're right, and I use containers as well, I'm not sure that's a solid way to prevent this attack unless the person can be convinced to diligently right click anything they wish to open, copy the link, and manually paste it in a fresh new tab.

fsflover 3y ago
This is solved in Qubes OS by using separate VMs for different security domains. For Discord, a single click can be configured to open a browser in a dedicated disposable VM.
- Aachen 3y ago
  My work requires me to open links in different VMs. How exactly do I tell a browser to override link clicks to be handled by an external program? This would be very useful indeed
  - fsflover 3y ago
    This is how I do it on Debian. First, reate a custom "browser" like this: touch .local/share/applications/open-in-dispvm.desktop, and put inside a command like this: qvm-open-in-vm '@dispvm:fedora-37-dvm' %u in accordance with this guide: https://www.qubes-os.org/doc/how-to-use-disposables/#opening-a-link-in-a-disposable-based-on-a-non-default-disposable-template-from-a-qube https://www.qubes-os.org/doc/how-to-use-disposables/#opening... To make this browser default, you do this: xdg-settings set default-web-browser open-in-dispvm.desktop See also how to create .desktop files: https://askubuntu.com/questions/45885/how-do-i-set-a-custom-browser-as-default-in-preferred-applications https://askubuntu.com/questions/45885/how-do-i-set-a-custom-....
    - Aachen 3y ago
      Browsers don't call the OS to open a URL, it would have to be an add-on or something

ravenstine 3y ago

Even better, type "about:profiles" into your URL bar, create a new profile that runs in an entirely separate Firefox process, and live your second life there.

xjay 3y ago
Disable automatic updates in this case (Windows). When an update is applied between the first and second profile process, any new tab won't do anything in any of the instances. Firefox likely still doesn't detect this state. Edit: That is, if you use Firefox with two or more profiles, and may start one profile later (after a new update was published).
- magicalhippo 3y ago
  I run Firefox stable and Firefox beta on separate profiles (in addition to containers). The stuff I'm less worried about using beta.
- ravenstine 3y ago
  Same thing happens on macOS. And yeah, I turn off automatic updates and just update when it bugs me. It's an underrated feature, IMO. Profiles can be made very purpose-specific, and I like that there's not the possibility of leakage due to a site exploiting an add-on sharing data across containers, etc. I still like the mukti-containers feature, but I see it as less of an anonymity thing and more as a convenient way to be able to sign into multiple website accounts at once.