First-party isolation in Firefox: what breaks if you enable it? • Hacker News Board

Re: First-party isolation in Firefox: what breaks if you enable it?

#91

Post by bugmen0t » Sun, Sep 09, 2018, 9:28 PM UTC

the8472 wrote: post #22

wodenokoto wrote: post #3

> I’m not sure whether that is because Mozilla consider it unsafe, unpractical, or don’t want to commit to maintain the feature in future releases. I imagine it was implemented for the container tabs.

Not quite, it's a different axis. Security tokens in firefox contain the domain of the actual request/resource they are related to (e.g. the domain of an iframe) and a bag of data called originAttributes. Containers are one value in that bag. The top level window domain (1st-party) is added as another value if you enable FPI.

This paper has all the gory details: https://www.researchgate.net/publication/315848178_Extending...

Re: First-party isolation in Firefox: what breaks if you enable it?

#92

Post by bugmen0t » Sun, Sep 09, 2018, 9:29 PM UTC

fredsir wrote: post #62

So after enabling it, is there some easy way to see if it actually works?

Not super reliably. But try this one: https://github.com/mozfreddyb/test-firstpartyisolation

Re: First-party isolation in Firefox: what breaks if you enable it?

#93

Post by eslaught » Sun, Sep 09, 2018, 10:19 PM UTC

Is there a test I can use to confirm that it's working? I've set privacy.firstparty.isolate true and privacy.firstparty.isolate.restrict_opener_access true and when I log in to Github followed by Travis, Travis was able to log in without prompting for a password....

Firefox 62 macOS.

Edit: I did lose all my cookies on restart, so I do believe the option is at least enabled. Still would like to test that it's actually doing something.

Re: First-party isolation in Firefox: what breaks if you enable it?

#94

Post by Animats » Sun, Sep 09, 2018, 10:20 PM UTC

That's a great feature. I just turned it on and logged into everything I care about, and it all worked. I already had so much ad and tracker blocking that it didn't create any new problems.

Re: First-party isolation in Firefox: what breaks if you enable it?

#95

Post by mixmastamyk » Sun, Sep 09, 2018, 10:38 PM UTC

dang wrote: post #87

mixmastamyk wrote: post #76

Earlier quoted context omitted.

Well, bootlickers are a thing, sure. We don't have to optimize for them.

Personal attacks will get you banned here. Please don't post like this again. https://news.ycombinator.com/newsguidelines.html

Why do you think that was a personal attack? Simply described a perspective calmly. Perhaps your mood has colored the reading.

Re: First-party isolation in Firefox: what breaks if you enable it?

#96

Post by dang » Sun, Sep 09, 2018, 10:47 PM UTC

mixmastamyk wrote: post #95

dang wrote: post #87

Earlier quoted context omitted.

Personal attacks will get you banned here. Please don't post like this again. https://news.ycombinator.com/newsguidelines.html

Why do you think that was a personal attack? Simply described a perspective calmly. Perhaps your mood has colored the reading.

I read it as you calling the other user a bootlicker.

Re: First-party isolation in Firefox: what breaks if you enable it?

#97

Post by mixmastamyk » Sun, Sep 09, 2018, 10:55 PM UTC

dang wrote: post #96

mixmastamyk wrote: post #95

Earlier quoted context omitted.

Why do you think that was a personal attack? Simply described a perspective calmly. Perhaps your mood has colored the reading.

I read it as you calling the other user a bootlicker.

It's a class of folks with a certain perspective. Whether a person chooses to join it at a particular time is their business.

It is the difference between saying you ARE bad, versus you SAID/DID a bad thing. I didn't say the person was one on purpose, perhaps wording not strong enough.

Re: First-party isolation in Firefox: what breaks if you enable it?

#98

Post by floatingatoll » Sun, Sep 09, 2018, 11:05 PM UTC

eslaught wrote: post #93

Is there a test I can use to confirm that it's working? I've set privacy.firstparty.isolate true and privacy.firstparty.isolate.restrict_opener_access true and when I log in to Github followed by Travis, Travis was able to log in without prompting for a password.... Firefox 62 macOS. Edit: I did lose all my cookies on restart, so I do believe the option is at least enabled. Still would like to test that it's actually…

Did you restart between changing the settings and doing your tests? If not, they’re invalid, and you should repeat them.

Re: First-party isolation in Firefox: what breaks if you enable it?

#99

Post by [deleted] » Sun, Sep 09, 2018, 11:05 PM UTC

mixmastamyk wrote: post #97

dang wrote: post #96

Earlier quoted context omitted.

I read it as you calling the other user a bootlicker.

It's a class of folks with a certain perspective. Whether a person chooses to join it at a particular time is their business. It is the difference between saying you ARE bad, versus you SAID/DID a bad thing. I didn't say the person was one on purpose, perhaps wording not strong enough.

[deleted]

Re: First-party isolation in Firefox: what breaks if you enable it?

#100

Post by Aeolun » Sun, Sep 09, 2018, 11:12 PM UTC

eslaught wrote: post #93

Is there a test I can use to confirm that it's working? I've set privacy.firstparty.isolate true and privacy.firstparty.isolate.restrict_opener_access true and when I log in to Github followed by Travis, Travis was able to log in without prompting for a password.... Firefox 62 macOS. Edit: I did lose all my cookies on restart, so I do believe the option is at least enabled. Still would like to test that it's actually…

If Travis redirects to github, I assume github would get access to it’s own cookies again, and then be able to perform oauth, after which it redirects to Travis again with a token in the URL, no cookies or local storage needed as far as I’m aware.