4 ms·

If you're linked to something on twitter or discord or so, odds are that you'll open it in that container because that's the default behavior. While you're righ

by Aachen 3y ago

If you're linked to something on twitter or discord or so, odds are that you'll open it in that container because that's the default behavior. While you're right, and I use containers as well, I'm not sure that's a solid way to prevent this attack unless the person can be convinced to diligently right click anything they wish to open, copy the link, and manually paste it in a fresh new tab.

fsflover 3y ago
This is solved in Qubes OS by using separate VMs for different security domains. For Discord, a single click can be configured to open a browser in a dedicated disposable VM.
- Aachen 3y ago
  My work requires me to open links in different VMs. How exactly do I tell a browser to override link clicks to be handled by an external program? This would be very useful indeed
  - fsflover 3y ago
    This is how I do it on Debian. First, reate a custom "browser" like this: touch .local/share/applications/open-in-dispvm.desktop, and put inside a command like this: qvm-open-in-vm '@dispvm:fedora-37-dvm' %u in accordance with this guide: https://www.qubes-os.org/doc/how-to-use-disposables/#opening-a-link-in-a-disposable-based-on-a-non-default-disposable-template-from-a-qube https://www.qubes-os.org/doc/how-to-use-disposables/#opening... To make this browser default, you do this: xdg-settings set default-web-browser open-in-dispvm.desktop See also how to create .desktop files: https://askubuntu.com/questions/45885/how-do-i-set-a-custom-browser-as-default-in-preferred-applications https://askubuntu.com/questions/45885/how-do-i-set-a-custom-....
    - Aachen 3y ago
      Browsers don't call the OS to open a URL, it would have to be an add-on or something
      - fsflover 3y ago
        Indeed, it only works for other applications, not browsers. Interesting question. Perhaps you could ask it on the Qubes forum: https://forum.qubes-os.org https://forum.qubes-os.org.
  - xk_id 3y ago
    When the link is in a different app (e.g email client), the click event is handled by the OS and the URI is sent to the “default app” for that URI schema (for http/https, that would be your default browser). You can therefore reconfigure your OS to use a different app for that schema. On Mac, you can for example create a simple App in AppleScript with the following code: on open location the_url do shell script "/path/script.sh" & quoted form of the_url end open location Then, using a tool like “SwiftDefaultApps”, you can configure this new AppleScript app to be the default app for the http/https schema. In script.sh, which receives the clicked url as the its first positional argument, you can then run any arbitrary logic that you require. So this idea would work if the links you wanted to open were coming from another app. If they come from inside the browser, I would suggest writing an additional browser extension that replaces all http/https links in a page with an invented URI schema, like newschema://. Then the browser would pass those links to the OS for handling and then you would have full control over how to handle this new schema. Hope this makes sense.
    - Aachen 3y ago
      That makes sense and I knew this, but browsers are the main use case for me, not external programs
      - xk_id 3y ago
        Yeah, so your script.sh could send the URI received in its positional argument to a browser with the configuration you need (and substitute newscheme:// to https:// https://). I think it’s 100% doable
cypherpunks01 3y ago
Temporary Containers extension in Firefox can be configured to isolate upon normal left-click, for any links heading to different domains/subdomains, then you don't need to copy/paste or do anything special. How? - about:addons - Temporary Containers > 3 dots > Preferences - Isolation > Global settings tab - Mouse Click settings - Change behavior for Middle Mouse, Ctrl/Cmd-Mouse, or normal Left Mouse clicks - Always = always open in new temp container - Never = never start new temp container on click - Different From Tab Domain/Subdomain = start a new temp container only when navigating to a different domain/subdomain

by Aachen 3y ago

fsflover 3y ago

This is solved in Qubes OS by using separate VMs for different security domains. For Discord, a single click can be configured to open a browser in a dedicated disposable VM.

Aachen 3y ago
My work requires me to open links in different VMs. How exactly do I tell a browser to override link clicks to be handled by an external program? This would be very useful indeed
- fsflover 3y ago
  This is how I do it on Debian. First, reate a custom "browser" like this: touch .local/share/applications/open-in-dispvm.desktop, and put inside a command like this: qvm-open-in-vm '@dispvm:fedora-37-dvm' %u in accordance with this guide: https://www.qubes-os.org/doc/how-to-use-disposables/#opening-a-link-in-a-disposable-based-on-a-non-default-disposable-template-from-a-qube https://www.qubes-os.org/doc/how-to-use-disposables/#opening... To make this browser default, you do this: xdg-settings set default-web-browser open-in-dispvm.desktop See also how to create .desktop files: https://askubuntu.com/questions/45885/how-do-i-set-a-custom-browser-as-default-in-preferred-applications https://askubuntu.com/questions/45885/how-do-i-set-a-custom-....
  - Aachen 3y ago
    Browsers don't call the OS to open a URL, it would have to be an add-on or something
    - fsflover 3y ago
      Indeed, it only works for other applications, not browsers. Interesting question. Perhaps you could ask it on the Qubes forum: https://forum.qubes-os.org https://forum.qubes-os.org.
- xk_id 3y ago
  When the link is in a different app (e.g email client), the click event is handled by the OS and the URI is sent to the “default app” for that URI schema (for http/https, that would be your default browser). You can therefore reconfigure your OS to use a different app for that schema. On Mac, you can for example create a simple App in AppleScript with the following code: on open location the_url do shell script "/path/script.sh" & quoted form of the_url end open location Then, using a tool like “SwiftDefaultApps”, you can configure this new AppleScript app to be the default app for the http/https schema. In script.sh, which receives the clicked url as the its first positional argument, you can then run any arbitrary logic that you require. So this idea would work if the links you wanted to open were coming from another app. If they come from inside the browser, I would suggest writing an additional browser extension that replaces all http/https links in a page with an invented URI schema, like newschema://. Then the browser would pass those links to the OS for handling and then you would have full control over how to handle this new schema. Hope this makes sense.
  - Aachen 3y ago
    That makes sense and I knew this, but browsers are the main use case for me, not external programs
    - xk_id 3y ago
      Yeah, so your script.sh could send the URI received in its positional argument to a browser with the configuration you need (and substitute newscheme:// to https:// https://). I think it’s 100% doable

cypherpunks01 3y ago

Temporary Containers extension in Firefox can be configured to isolate upon normal left-click, for any links heading to different domains/subdomains, then you don't need to copy/paste or do anything special. How? - about:addons - Temporary Containers > 3 dots > Preferences - Isolation > Global settings tab - Mouse Click settings - Change behavior for Middle Mouse, Ctrl/Cmd-Mouse, or normal Left Mouse clicks - Always = always open in new temp container - Never = never start new temp container on click - Different From Tab Domain/Subdomain = start a new temp container only when navigating to a different domain/subdomain