Hacker News Reader

Comment by jmathai | Hacker News Reader

Isn't it possible to have a "per TLD" container addon? I'm fine to be logged into Google and even have Google collect information when I'm using any of their services (same for Facebook). What I'm really after is a way to sandbox every site to only have information I explicitly grant it while using their service.

View on HN

I believe First Party Isolation is what you're looking for. To enable, change `privacy.firstparty.isolate` to `true`. See also previous discussion[1]

[1]: https://news.ycombinator.com/item?id=17944991

I've been using first party isolation ever since it was ported from Tor. It's excellent, but be aware that it breaks stuff, usually JavaScript, on about 5% of websites (anecdata). I find this to be well worth it, especially to find out which sites do the worst tracking.

I have a separate Firefox profile I use for rare occasions when I need to allow third party tracking in order to do something.

Google has... literally hundreds of domains. Just assuming *.google.com would miss things like googleusercontent.com or googleapis.com or doubleclick.net. The Facebook container basically grabs "all domains by Facebook" and sandboxes them together (so they can still interoperate amongst themselves), while isolating it off from other sites you visit.

Sure, you could do a lot of this yourself with different browsers/browser profiles/containers, but it'd be far better to have someone provide that list as a prebuilt addon.

I really hate websites that do this because I have to go and whitelist the hundreds of domains that important resources are coming from.

I would say it's both a blessing and a curse. Yes, it makes it harder for first party isolation scripts to sandbox a service, but the separation of domain based on the service (doubleclick for ads, googlevideo.com for video, etc) makes it easier for ad/content blocker list maintainers to block only the domains and services it should be blocking.

All IPs used by Google have PTR records to the 1e100.net zone so it is straightforward to determine whether any given domain is a Google domain.

e.g. googlevideo.com resolves to 172.217.4.196 and the PTR for that IP is lga15s48-in-f196.1e100.net

They even have a faq for this: https://support.google.com/faqs/answer/174717?hl=en

Yes, but they are supposed to be using subdomains for that (e.g. usercontent.google.com, video.google.com, apis.google.com, ...), instead of what is essentially DNS spam (guesswhetherthisdomainalsobelongstogoogle.com).

DNS has been made hierarchic for this reason.

I was told this may have been because older browsers limited the number of simultaneous connections to a domain name and you could work around it by having multiple domain names.

So when a site relies on resources from ytimg.com, are those ads or videos? What about ggpht.com, gstatic.com, branch.io, unpkg.com, or any of the hundreds of CDNs?

Most sites I visit these days--even super common sites like medium.com--have dozens (or even the hundreds alluded to above) of dependencies from seemingly unrelated sites. I have no idea if those are CDNs for common js libs, analytics libs, spammer libs, tracking libs, or what. I recognize things like CDN links for jQuery, Bootstrap, React, etc. I see many that seem to be Facebook tracking.

Of course, blocking many of these breaks the page. I have started to avoid sites that break without access to urls I can't identify. But this is both laborious to vet, and isolating.

There is no longer such a thing as easy, anonymous, inclusive web browsing.

To trigger the switch to a container, only the user-visible URL in the address bar is relevant. Other URLs for resources on the page do not matter at all, as they will only be loaded after you are already in the corresponding container.

For me personally a per window container would work pretty well. Does that exist?

Reply on news.ycombinator.com