Hacker News Reader

Comment by sohkamyung | Hacker News Reader

One thing not mentioned in the list is Firefox Multi-Account Containers [1]. It helps by segregating your on-line information (cookies) into separate containers that you set up.

It doesn't stop sites pulling all cookies, but it reduces the amount of information being sent: only the information in the same container is accessible.

[1] https://addons.mozilla.org/en-US/firefox/addon/multi-account...

View on HN

Also worth mentioning is the Temporary Containers add-on [1] [2] which works in conjunction with Multi-Account Containers.

If you browse the Internet in default Tabs or in a specific Container you still collect Cookies, Storage and Cache in one place — which is something advertisers and other data-collecting services really appreciate — it makes tracking you easy. Fortunately there’s an easy way to automatically create new Containers every time you open a new Tab and delete the Container if it’s not needed anymore: the Temporary Containers Add-on. By default you can open new Tabs in Temporary Containers with the Toolbar Icon or the keyboard shortcut Alt+C. If you enable the “Automatic Mode” in the options however, it will overwrite your standard ways of opening websites in new Tabs and external programs opening links. Instead of opening the website in No Container, it will open the website in a freshly created Temporary Container. You’ll notice how the names of the Containers keep counting up every time you open a new tab and visit a website: tmp1, tmp2, tmp3. As soon as you close the last Tab in such a Container, it will automatically get removed and with it all that data that makes you easy to track.

[1] https://addons.mozilla.org/en-GB/firefox/addon/temporary-con...

[2] https://medium.com/@stoically/enhance-your-privacy-in-firefo...

Sounds very nice. I'll take a look at it. It should be useful for when I open tabs to links from websites that I usually don't go to (suggested by social media friends, for example).

Nice! This is exactly the feature I had been pining for, with Containers already being a core part of my browser experience. Works as advertised. Always pays to open the comments, thanks!

I abandoned that. Mukti containers have lots and lots of usability issues.

I had some tabs (mostly YouTube) opened thrice when clicking on a YT link.

They don't automatically switch back to the default container. That's a big problem. You open your FB container (and Firefox can do this automatically when entering a FB URL or following a link there), you follow a link elsewhere or enter another URL, and you keep inadvertantly surfing in the FB container for the next hour.

> I had some tabs (mostly YouTube) opened thrice when clicking on a YT link.

Some of the multiple tabs issues have been fixed in version 6.0.0. And the upcoming version will fix them completely.

> They don't automatically switch back to the default container. That's a big problem

I've added an "Isolation" feature to the just published version 0.67 of the Temporary Containers Add-on that gives you several ways to avoid accidentally staying in the same container - including an option to only allow "Always open in" assigned domains to load in their container.

There is a new config in Firefox under privacy.firstpartyisolation that is similar. But I can't use it or the various referer about:configs with my work mac because they break JIRA.

First party isolation was made for Tor and privacy and keeps all cookies in containers in some fashion.

There's First Party Isolation add-on[0] that allows you to enable it by default, and then disable it for a period of five minutes by clicking on an icon.

That way, you could click on it when you're using JIRA and have first party isolation when you're not using JIRA.

[0] https://addons.mozilla.org/en-US/firefox/addon/first-party-i...

It's a promising idea but has issues currently. In recent Nightly builds I found it completely broke websites that override control keys [1], which is loads (GitHub, Facebook, Google Docs, etc.). It'll be great when they iron out all the bugs, because this guards against all sorts of the more advanced, sinister ways of deanonymising people.

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1433592

This is great and fairly simple to use. I personally use it to separate out Google into its own container, but it is also more practically useful to allow you to login to the same site with different accounts.

It just works! But, the one problem that I've encountered is clicking links in gmail cause them to be opened within the Google container.

Right click > Open link in new container tab > No container

Yes, this is what I always do... after my muscle memory has already clicked the link normally!

I've added an "Multi-Account Containers Isolation" feature to the Temporary Containers Add-on. Enabling that will only allow Websites that are assigned to "Always open in" with Multi-Account Containers to load in their container - every other request will automatically opened in a new Temporary Container.

There's also a discussion about implementing such an Isolation feature directly in Multi-Account Containers.

Thanks for this. I've been looking for something like this for ages. I used to use VM's for this but it was a right pain.

As an aside I used this guide having discovered it a couple of years ago. I can't remember how but I ended up on a site that had been hacked, might have been following a link from a forum, and the page I was looking for wasn't there. Instead there was a link on the page saying it had been moved. I stupidly clicked the link and off I went to a random site that I can only assume was meant to drop some form of malware or take control on my browser. Anyway all I was left with was a message congratulating me on how secure my browser was, I didn't stay around.

thanks for that - i'll look into adding that information

And what you don‘t mention is that that privacy extenson now also has more telemetry. Sad.

I just checked all the links in the repo of the add-on, and only links to Mozilla's domains are links to the MPL license.

I’ve had it installed before and received the prompt “to install the update of this extension please accept the new telemetry conditions.” I don’t claim every user sees it (maybe I’m a/b tested?). I’ve rejected it, and checking the repo wouldn’t help for that.

The new requested permission, different from the ones previously accepted by me is, if I remember:

"Monitor extension usage and manage themes"

What's that if not a new telemetry? In a privacy-oriented extension!

It's explained here:

https://github.com/mozilla/multi-account-containers/wiki/Per...

""Monitor extension usage and manage themes": Required to provide interoperability with other container Add-ons by checking if they have the required permissions."

How about not being required? Older versions really didn't require. Knowing the management (see "Looking Glass"), even if the extension is not using the telemetry at the moment it's just "hey the user already agreed!" Especially troublesome as I haven't agreed anywhere else.

> How about not being required? Older versions really didn't require.

Unfortunately there's no other way for us to check whether an Add-on that tries to access the "API" has the needed "contextualIdentities" permission. I can assure you that it's in no way about telemetry and never will be. If the Multi-Account Features would be a Firefox platform feature then such an API would have the same requirements.

But why "required" to agree? If I know that I don't want other add-ons to call that extension, why can't it use it as it behaved before, that is, without effectively having to "agree" and "accept" telemetry?

I agree that it would be nice to have a way to show that permission prompt only if an external extension wants to use the API - however, that's not possible because such prompts can only be triggered after an explicit user interaction, not from the Add-on itself or external Add-ons.

Also, you didn't effectively "agreed telemetry". The same way you didn't "agreed to sent all website data you visit to the Add-on developers" when you accepted the "Access your data for all websites" permission that the Add-on also requires. If you don't trust the Add-on or its developers, then that permission should scare you more than the "Monitoring extensions" permission. But as you probably know; it's just a wording you have to take with a grain of salt and a lot of Add-ons/Extensions require permissions which would in theory allow them to inject any arbitrary content in websites you visit, or read data from them for that matter. It's how permissions work.

You didn't explain WHY should I'd ever want to allow that every other "external extension" automatically "uses the API" of the extension to which as you properly note I anyway gave a lot of major permissions. And why the extension forces me to allow something to the "other extensions" automatically.

You didn't allow every other Add-on to access the API, but explicitly only the Add-ons with the "contextualIdentities" permission ("Container feature"). Which is the reason the "management" permission ("Monitor extension usage") was needed in the first place - to check if the Add-ons accessing the API have that permission. Also, the API doesn't give external Add-ons access to the permissions you gave the Multi-Account Containers Add-on, but instead only a really specific amount of information; which is whether a specific domain is assigned to a container (you can read about it here https://github.com/mozilla/multi-account-containers/wiki/API).

Now, why "automatically" for Add-ons that have the "contextualIdentities" permission? It's simple, if you grant an Add-on that permission, you already gave your consent that the Add-on can access the Container API; and the Multi-Account Containers Add-on itself being from Mozilla, is just additional Container functionality, but as an Add-on. So if you grant the Container permission, you also get API access to some additional informations from the Add-on; and with that increase interoperability between Container Add-ons.

Reply on news.ycombinator.com