Hacker News Reader

Comment by billysielu | Hacker News Reader

I don't understand why the default behavior isn't to isolate every website from every other website? Why is least privacy the default?

View on HN

Disclosure: I'm the author of the add-on mentioned in the story.

Basically, various privacy protections cause various kinds of website breakage.

https://blog.mozilla.org/data/2018/01/26/improving-privacy-w...

Then those websites should be considered broken much like we consider Adobe Flash and sites with invalid TLS certificates.

Agreed. There are good kinds of broken.

The problem is that basically all of Google’s products would be affected, which is something no browser can easily ship without angering users.

Can you elaborate? Is there some reason that running every Google property except google search (unless desired, but I prefer non-tailored results) in one container wouldn't work?

In that case each origin is not really getting an isolated cookie jar.

I really like that perspective! A few more high-profile cases like this and we just might nudge the internet in this direction! :)

Yes please. Third party cookies and the like are the plague. They have so few legitimate use cases.

Make it a long deprecation if you have to. Give even longer exemptions to the really big players / the big breakage / the legitimate use cases while we find better ways. But it is up to the browser vendors to remove the weapons here.

Unfortunately, OAuth relies on them. Many SaaS offerings rely on OAuth.

SAML and some oauth flavors do, but most of oauth does not.

I don't think OAuth requires third-party cookies, and SAML definitely does not. The authentication parts use HTTP POSTs or redirects from the IdP to SP. You probably do want cookies to track the sessions on each end, but those would be first-party.

It's possible for your IdP to track the SPs you authenticate to regardless of protocol or cookie use, of course.

Oh hey, love your work mate. Thank you!

My pleasure ... but it's not just my work. Firefox privacy & security and add-ons engineering teams have poured a ton of effort into Firefox Quantum to make features like this possible and easy.

How easy is this to extend to other sites? LinkedIn and Google, specifically?

That is mostly the case. However, other websites may ask your browser to make requests to Facebook domains (to load in social buttons or tracking scripts/pixels). Those requests will include any cookies your browser has for Facebook as they're direct to Facebook domains.

This extension gives Firefox selective amnesia: if you're in a Facebook container tab, it'll remember and send those cookies. If you're not, it won't!

An alternative solution is to never make those third party requests in the first place, but you might need some of them for content you're actually interested in viewing. Using both a blocking extension and this container extension should improve your privacy towards Facebook.

There's a "Same-Site" cookie flag that helps prevent CSRF by preventing cookies being sent in that scenario. Can the browser be made to treat all cookies as "same-site" for a quick 'fix' to this issue?

Obviously this would need a white-list (and a pair<from,to> whitelist, not just "this domain is OK list) to allow SSO scenarios.

Simply set the configuration value privacy.firstparty.isolate in your about:config.

This will treat every first party domain as it's own container for cookies and other stuff.

Yes, but as you say this breaks a large number of applications. The web browsers aren't super likely to break existing behavior since people simply blame the browser that whatever thing doesn't work.

There’s uMatrix for that of course but is uBlock Origin and PrivacyBadger combo enough with this extension? As the de-facto tech guy in my family I know how to take care of my own privacy but I’m always searching for the most hands off solution for the tech illiterate family members who come to me asking to “fix their laptops”.

Have you considered Tracking Protection? https://support.mozilla.org/en-US/kb/tracking-protection I had to disable it for a few select sites but I guess there's currently no solution that won't ever break a site.

This begs the follow up question: Why can’t my browser always send zero cookies for all third party requests in all tabs?

Presumably the like button wouldn’t work - but that’s what I want. So the Q is: what will break that I didn’t want to break?

Single sign-on? (e.g. logging in to Trello with your Google account)

If you get tokens by callback urls you don't need any 3rd party cookies.

That's not relevant to the question.

It breaks federation, i.e., Single SignOn.

But there's a thing for Firefox which does it for all sites. Called First Party Isolation.

knowing what fb is doing with your data, why would you still want SSO?

Because it doesn't have a way to break only FB SSO. All SSO would break by default.

I mean it's too late now but there's nothing fundamental about the current SSO design. If browsers shipped with FPI from the beginning SSO would still work, it would just look different.

An idea.. imagine putting SSO stuff into a Container and setting First Party Isolation off for just that Container.

ive had it disabled for years and never had any kind of issue with single signon websites

It breaks things like "sign-in with github credentials" in CIs. But you know, these should be exceptional, therefore the default should be to load third-party content without cookies. The problem is that some content is loaded without your having to click on something (where you'd have a chance to right-click and request loading with selected credentials).

Not necessarily: OAuth Basic Flow does not require third-party cookies. With Basic Flow, you'd get redirected to github.com, making it a first party request. Github will then redirect you back passing an authentication code as a URL parameter.

I use uMatrix for this purpose, and to block third-party frames to defend against clickjacking. That said, Multi-Account Containers still are very useful.

I’ve been blocking third-party cookies for years and using OAuth authentication in several places. Don’t remember ever having an issue.

The main thing I notice break when I enable things like "no cross origin cookies" is history on the AWS console. Stuff like "roles you've switched to" and "services you've used recently" get forgotten.

You can disable third-party cookies in Firefox. See https://support.mozilla.org/en-US/kb/disable-third-party-coo...

The site of one of the banks I use relies on third-party cookies, because it outsources parts of the site functionality.

Sites that put a checkout flow hosted on a different hostname in a subframe break.

Some forms of "sign in with X" break.

> Why can’t my browser always send zero cookies for all third party requests in all tabs?

It can. Blocking third-party cookies is available in the browser settings of at least Firefox, Chrome, and Safari. I think it’s even on by default in the latter.

I’ve been using it for years and never seen a broken page as a result.

> I don't understand why the default behavior isn't to isolate every website from every other website? Why is least privacy the default?

Default privacy settings are tough to manage.

Some people want privacy, and will accept broken websites if it keeps their data and online movement private.

Other people just want their usual websites to work, don't understand or care to think about privacy, and if some random content farm looks busted in Firefox, will just switch to another browser.

Aside from picking a sensible default, Firefox also offers to educate users where it makes sense. For example, when you open a new private browsing window in Firefox, the tracking protection section includes a "See how it works" button that takes you to a tour-style walkthrough of how tracking protection works.

> I don't understand why the default behavior isn't to isolate every website from every other website?

There's an add-on that does something close to that:

https://addons.mozilla.org/en-US/firefox/addon/temporary-con...

This add-on's options include opening each (sub)domain in its own container. These containers are temporary: they're deleted a short time after you close their last tab, so you have to log back into each site on each visit. (This may be something you do anyway.)

I don't (yet?) know of an add-on that automatically assigns each domain you visit to its own permanent container, and automatically creates new containers for each new domain.

It's likely breaking lots of websites that do single sign-on and similar federated/multi-domain things

You can set Firefox to behave that way, though. Look for First Party Isolation.

you can do that with the firefox Multi-Account containers extension. I don't go to that extreme, but its nice to have a few key profiles. I have work and personal, plus a few others (like banking).

What is really nice, is you can tell it to ALWAYS open your banks website in a particular container, and it will. If you go to that URL from a tab in your work profile, it will switch to the banking profile for you.

Reply on news.ycombinator.com