Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Container Tabs

wiki.mozilla.org

Post reply on HN
Print view View original

161–170 of 222 posts

Re: Container Tabs

#161

Post by mememachine »

vosper wrote: post #104
nikcub wrote: post #94

This is a neat idea but it doesn't implement the main reason I use separate profiles in Chromium - different security contexts based on how much you trust a site. Example: my main general browsing profile has flash, PDFs and all plugins disabled, absolutely all handlers switched off, all hardware access off, WebGL switched off, no account logins and uBlock Origin set to aggressively block most third-party requests. M…

I'm genuinely not trolling here: what are you worried could happen if you didn't do all of this stuff with the extensions and settings in your various profiles? What does it mean to trust a website?

Chances are he is either insane or is accessing a lot of very important information

Re: Container Tabs

#162

Post by andrewflnr »

cpeterso wrote: post #114
rlpb wrote: post #39

I would like to be able to configure my browser to open every URL in a domain-specific "container", unless I say otherwise. Say site www.a.org includes an image from www.evilcorp.org, and www.evilcorp.org sets a cookie. When I then go to www.b.org and it includes an image from www.evilcorp.org, I don't expect the cookie to be sent back. In other words, the cookie should be tied to www.a.org, even though it actually c…

Firefox is integrating a cookie feature from Tor called first-party isolation or double-key cookies. It will separate third-party cookies for each first-party site, so evilcorp.org cookies for evilcorp.org images on a.org will not be set for evilcorp.org images on a.org. Blocking third-party cookies can break some site that rely on third-party resources, but first-party isolation should allow each site to work withou…

I knew I stayed with Firefox for a reason. Privacy isn't even the real issue for me: this should take a big bite out of CSRF attacks.

Re: Container Tabs

#163

Post by hackuser »

mverwijs wrote: post #142
TheDong wrote: post #100

Earlier quoted context omitted.

The firefox feature of `--no-remote -P` is the way to do that, which has existed since before the chrome browser did. Old feature. This feature is not meant to solve that use-case since if your case is security, you need separate browsers/contexts/proceses anyways. Separate profiles in firefox implement separate profiles (which may all be independently open side-by-side in different windows). This exchanges less secu…

Old perhaps, but userfriendly this is not.

I wonder how many users understand the concept of profiles and the session isolation they provide, want to use them, yet find the command line too difficult to use.

Re: Container Tabs

#164

Post by tomaskafka »

shostack wrote: post #139
gcb0 wrote: post #120

Earlier quoted context omitted.

best thing that happened to mozilla was losing the money from google. yahoo pays them almost the same and does not meddle on anti tracking features. note how every single privacy feature came after google-money. during google-money what did we got? third party cookies accepted as default. good riddance, google.

I'd love to know how those corporate conversations go exactly. Is it so blatant as saying "no you won't work on these anti tracking features?" Or is it more "this will be so you focus on" which conveniently excludes undesirable stuff?

This. And, what is really Google paying them for? Ensuring that there is no mainstream browser left that would complicate things for ad/tracking sponsored web (and so never creating an incentive + ecosystem for any alternative)?

Re: Container Tabs

#165

Post by hackuser »

cpeterso wrote: post #114
rlpb wrote: post #39

I would like to be able to configure my browser to open every URL in a domain-specific "container", unless I say otherwise. Say site www.a.org includes an image from www.evilcorp.org, and www.evilcorp.org sets a cookie. When I then go to www.b.org and it includes an image from www.evilcorp.org, I don't expect the cookie to be sent back. In other words, the cookie should be tied to www.a.org, even though it actually c…

Firefox is integrating a cookie feature from Tor called first-party isolation or double-key cookies. It will separate third-party cookies for each first-party site, so evilcorp.org cookies for evilcorp.org images on a.org will not be set for evilcorp.org images on a.org. Blocking third-party cookies can break some site that rely on third-party resources, but first-party isolation should allow each site to work withou…

I'm glad Firefox is doing this, but ...

> Blocking third-party cookies can break some site that rely on third-party resources

Can anyone name sites that require them?

As someone who defaults to deny all cookies and manually enables every one my browser accepts, I don't think I've found a site that requires 3rd-party cookies. Few sites require cookies unless you login or have shopping cart.

Of course, that's anecdotal. Maybe I just don't visit certain categories of sites and don't encounter them.

Re: Container Tabs

#166

Post by hackuser »

gcb0 wrote: post #120
cpeterso wrote: post #114

Earlier quoted context omitted.

Firefox is integrating a cookie feature from Tor called first-party isolation or double-key cookies. It will separate third-party cookies for each first-party site, so evilcorp.org cookies for evilcorp.org images on a.org will not be set for evilcorp.org images on a.org. Blocking third-party cookies can break some site that rely on third-party resources, but first-party isolation should allow each site to work withou…

best thing that happened to mozilla was losing the money from google. yahoo pays them almost the same and does not meddle on anti tracking features. note how every single privacy feature came after google-money. during google-money what did we got? third party cookies accepted as default. good riddance, google.

Could you provide some examples? That's a serious allegation.

I remember, as a volunteer, debating some privacy issue with a Google dev in Bugzilla. They made some crack about looking a gift horse in the mouth, but the discussion was out in the open. I don't recall evidence that Google was influencing Firefox improperly, but OTOH absence of evidence is not evidence of absence ...

Re: Container Tabs

#167

Post by hackuser »

gcb0 wrote: post #119
nikcub wrote: post #94

This is a neat idea but it doesn't implement the main reason I use separate profiles in Chromium - different security contexts based on how much you trust a site. Example: my main general browsing profile has flash, PDFs and all plugins disabled, absolutely all handlers switched off, all hardware access off, WebGL switched off, no account logins and uBlock Origin set to aggressively block most third-party requests. M…

you are using the wrong tool. install NoScript in firefox and allow flash/etc per domain temporarily or permanently. profiles/context tab is all about tracking. You just happen to successfully abuse one tool to your ends in one case.

I'd take a look at uMatrix, which is easier and more granular than NoScript (but lacks the more in-depth security features). It allows you to block/allow cookies, css, images, plugins, scripts, frames, and more on local/remote host basis.

For example, when visiting example.com you could allow scripts from example.com but not from gstatic.com, analyticshost.com, or shadylookingdomain.com. Yet at domain.com you could allow gstatic.com scripts and images because it embeds Google Maps.

It's all done in an amazing, quick GUI that provides a visualization of the rules. I wish all firewalls would adopt the UI.

Re: Container Tabs

#168

Post by d33 »

rsync wrote: post #152
nikcub wrote: post #94

This is a neat idea but it doesn't implement the main reason I use separate profiles in Chromium - different security contexts based on how much you trust a site. Example: my main general browsing profile has flash, PDFs and all plugins disabled, absolutely all handlers switched off, all hardware access off, WebGL switched off, no account logins and uBlock Origin set to aggressively block most third-party requests. M…

"I'd like to see these security levels built into browsers where the contexts are built around permissions and site trust rather than access to the user store (which is also important)" I want to take it all the way to eleven and 'jail' a gui process (in this case, the web browser - any web browser). It gets its own filesystem root and its own IP BUT I don't have to pay the penalties of firing up a full blown virtual…

For a partial solution, have a look at "sandbox -X" (man 8 sandbox).

Re: Container Tabs

#169

Post by baraah »

hackuser wrote: post #165
cpeterso wrote: post #114

Earlier quoted context omitted.

Firefox is integrating a cookie feature from Tor called first-party isolation or double-key cookies. It will separate third-party cookies for each first-party site, so evilcorp.org cookies for evilcorp.org images on a.org will not be set for evilcorp.org images on a.org. Blocking third-party cookies can break some site that rely on third-party resources, but first-party isolation should allow each site to work withou…

I'm glad Firefox is doing this, but ... > Blocking third-party cookies can break some site that rely on third-party resources Can anyone name sites that require them? As someone who defaults to deny all cookies and manually enables every one my browser accepts, I don't think I've found a site that requires 3rd-party cookies. Few sites require cookies unless you login or have shopping cart. Of course, that's anecdotal…

I think I remember allowing them to watch Thursday Night Football on Twitter. I can't find anything about third-party cookies and tnf.twitter.com on Google though.

Re: Container Tabs

#170

Post by jagtesh »

This is a great idea! I love the fact that I can have both contexts in the same window. What would also be pretty cool is being able to move all windows in one context into a new window, if I want to separate things in a new OS workspace.
Post reply on HN