Facebook Container for Firefox | Hacker News Reader

Facebook Container for Firefox

mozilla.org

1,457 pointssushicalculus425 comments

I use Firefox multi-account containers[1] extensively, it's honestly the primary reason I use Firefox these days. The big win for me is that I _hate_ having to use the Google account switcher, so I basically set up a container for each Gmail account (work, personal, old email, etc).

The nice bonus feature is you can have certain sites default to containers. I had a paid YouTube account for a while, for example, so having any YouTube link open in my personal account was nice for not getting hit with ads on initial click due to my default Gmail not being the right one.

There's also a plugin[2] that will make any new tab default to whatever the first tab listed is. Really great for if you want to have a whole browser window dedicated to one container.

[1] https://addons.mozilla.org/en-US/firefox/addon/multi-account...

[2] https://addons.mozilla.org/en-US/firefox/addon/sticky-window...

I use it to split my work and my personal GitHub accounts!

Do you use windows? I found that having multiple GitHub account is infuriating on windows because it forces you to go into an obscure security manager to delete a record in order to switch which account your using. Never found a way around it.

I had never heard of this so I just tried to reproduce this - I have no trouble logging into two separate GitHub accounts in different Chrome profiles. What makes Firefox profiles different?

I think he's talking about the windows credential manager for HTTPS authorization for cloning/pushing.

Aha! I've always just used SSH authorization with GitHub.

Oh, I'll give that a try, thanks!

I think he means when using git from the command line. Trying to push to your repo will trigger a github sign in process, which will then save the credentials to Windows Credential Manager. Git will then ALWAYS use those from that point on credentials unless you go into the manager and delete them, which is a massive pain if you use multiple github accounts.

> GitHub recommends using only one user account to manage both personal and professional repositories.

https://github.community/t/using-one-account-for-all-your-pr...

Of course they do. That doesn't make it a good idea though.

Where I'm contracting now didn't want my account added to their org because it's not a profile picture of me. As the public facing stuff of the account is my personal stuff, I don't want someone else to tell me how it should be. So a new account for this customer it is..

Be careful. If you ever write a commit for an open source project a disgruntled employer could become ideas, depending on your contract.

I wish they didn’t do that. Or preferably, I wish they had native “containers” for work and personal repos.

Explore is one of my favorite features and now it’s crowded with work related suggestions. It makes it harder to separate the personal/professional persona and interests. This problem also manifests in notifications. I want a clear separation so I can focus on my personal life after work.

I’ve thought many times about creating a separate account.

We actually discussed this for quite a while at work when I pushed us to start contributing to open-source. Mostly it came down to the fact that TfL wished me to keep my work-life and personal-life separate to keep things simple. Reading that back, it doesn't sound so crazy.

GitHub wants a lot of silly things. I want a lot of silly things. Doesn't mean we all get what we want.

same here! its the main thing stopping me from switching back to vivaldi

thanks for the sticky windows tip

What I've been doing was to set up a browser profile (local) for each main context. If I have a set of work accounts (google, github, etc.), I have a 'work' profile for it. This isolates all cookies related to 'work' at once, as well as bookmarks, saved tabs, extensions, and settings. It's a total context switcher.

I'm also doing this in chrome. I have about 5 different profiles, aliased to things like `chrome-work`, `chrome-personal`, `chrome-dev', etc. I would love to use FF, but iirc FF doesn't provide something like `firefox --profile=someIdentifier` that opens a new window in my desired profile.

edit: Apparently this is bad info. I'll have to give it a try again.

It does. `firefox -no-remote -P <profile>`

I used to always include `--no-remote` here but it seems `firefox -P <profile>` now works, too, even when another Firefox instance is already running. Is anyone experiencing the same?

When I last tested, it varied by platform.

Linux was happy to open a new instance without the `--new-instance` option (which is implied by `--no-remote`), but macOS required it.

There's also a firefox-bin. Anyone know what the difference between firefox and firefox-bin is nowadays?

I believe that in the far past firefox-bin was the firefox binary, and firefox was a shell script that would do things like notice you already have a firefox-bin instance open and signal it to open a new window rather than launching a new firefox-bin instance.

But nowadays, firefox and firefox-bin seem almost the same. On the current release version on Mac, for example, both are binaries, with firefox-bin 40320 bytes and firefox just 16 bytes bigger.

Info.plist in /Applications/Firefox.app/Contents gives firefox is the executable to run. I'm not sure what role firefox-bin has now, if any.

Grabbing the source and building it myself results in firefox and firefox-bin matching.

https://bugzilla.mozilla.org/show_bug.cgi?id=658850 has some background, it seems at least sometimes they are identical

`firefox -P <profile name>` works like a charm for me?

If you're already in FF, consider using about:profiles as well, the old profile manager GUI was integrated into the browser itself a while ago.

Or a shortcut with `firefox --no-remote -ProfileManager` to always launch the profile dialog on bootup just like it is 90s Netscape all over again.

Profiles definitely have the basic functionality, but I like to keep all my extensions the same across my containers, and it's also easy to set up rules such that a certain site will always open in a certain container. You don't have to think about it at all.

excluding extensions is the exact reason I use profiles (I don't want any with access to my banking)

I use containers liberally also

You can open a private window when doing your banking, extensions aren't allowed there by default.

Good idea but this doesn't save history which can be useful sometimes.

I want my extensions to share the base configuration but have some different settings in different contexts.

Like, allow some tracking & advertising for "shopping" container, but block it otherwise. I don't mind having a special self-curated image where my in-scope browsing is tracked and analyzed. Now, I just have a separate browser (Chrome) for this - because it's more straightforward and less error-prone.

Or a sandbox development & local resource management profile where nothing but localhost and LAN addresses are allowed. And then block such access for any other profile - for security reasons.

Or allow, let's say, Grammarly extension on a few selected websites (like HN), where all I write is public and I would benefit from machines aiding my writing without any privacy concerts, but don't give it any chance to see my private correspondence.

Unfortunately, that's not possible with containers, and profiles are quite cumbersome.

Is the Firefox implementation different from Chrome? I don't think Chrome allows you to default links to specific profiles but I have used this feature in Chrome for a while to separate work and personal profiles to sandbox Chrome instances.

afaik profiles in chrome work for the whole instance (like in firefox) but Container work on a per tab basis

Oh I see interesting. That's correct in Chrome you get an entirely separate instance of Chrome with the new profile. Thanks!

and to add to mmcclure's point

I do all my shopping in the shopping container. I have the deals website I frequent set to the shopping container so if I open slickdeals.net in any tab, I get to the shopping container.

One quality of life change I encourage is go to manage containers and select "Select a container for each new tab". Then you can pretend the firefox tab without a container even exists (caveat: does not work with ctrl + t shortcut for new tab)

> The nice bonus feature is you can have certain sites default to containers. I had a paid YouTube account for a while, for example, so having any YouTube link open in my personal account was nice for not getting hit with ads on initial click due to my default Gmail not being the right one.

That's exactly right. And Firefox has that profile functionality too.

That second extension is a great idea! Thanks for sharing!

I use Chrome on Windows 10 at work because we're a gsuite shop and that's just what we do (I don't do personal things on company resources). I use Firefox on Debian everywhere else because Fuck Google.

How do you create different containers for different Gmail accounts, since the beginning of the url will be the same?

By not associating the domain with the container, and instead juggling it manually.

Along with the Facebook Container I use multi-account containers to keep a Google, Microsoft, and Amazon container as well. I included all of their children companies in the parent containers (like GitHub in Microsoft, YouTube in Google). It's sobering seeing how much of the internet shows up in one of these four containers.

I use multi-account containers and temporary containers so that all my new tabs are isolated.

Is there any reason to also use facebook container if you already have multi-account containers?

> I use multi-account containers and temporary containers so that all my new tabs are isolated

Worth mentioning that with the addon cookie auto-delete, you can more or less emulate temporary containers.

Temporary containers has a plethora of settings for when to open a new container. For example, I have a rule enabled that will open links in a new temporary container when they leave the current one. That's a terrible explanation, so let me give an example to make it clear:

- I have a GitHub container

- github.com and gist.github.com are set to always open in the GitHub container

- Say I am currently browsing github.com in the GitHub container.

- If I click a link to a domain other than [gist.]github.com, instead of navigating my current tab to that url, the url will open in a new tab & new temporary container

This is more powerful than simply persisting cookies from github.com -- I'm keeping GitHub's cookies, but only in the github container. It's almost like first party isolation, but a little weaker (unless you enable the setting where any link to a different domain will open in a new container), and I have the ability to group sites that would break with 1st party isolation by opening them in the same container.

I agree, your description is more why I like it -- the only websites that get to save any state are the ones I pick to open in specific named containers and which I also specifically granted permissions to with uMatrix (RIP).

Everything else opens links in a new container with the hope to make it as close as possible to looking like a different person clicked that link. I know it won't work that well since the IP doesn't change nor the user-agent, but at least it helps with the most lazy tracking.

I share the same goals; thanks for the succinct description.

Discussion upthread made me interested to see whether I can route temporary containers through tor, to make this protection stronger — see https://news.ycombinator.com/item?id=24853320

It's not super high on my list of priorities though, probably won't get to it for a month or two.

Oh, that'd be very neat if it made separate container tabs look like different tor sessions. Very clever! I suppose there's little short of that which would stand a real chance of working...

Damn I also hate the Google accounts mayhem. I will look into those containers.

Right now I manually type ?authuser=1 into my URLs to have Google Docs open in the right account, but this breaks when I restart the browser and the page reloads with the wrong account... Why Google removes this parameter from URLs after loading is beyond me.

It feels like multi-user management with google is a feature which was not really considered from the start and never become important enough to refactor the whole thing.

Do they need to refactor much though? I would they could fix it in Chrome, and accomplish basically the same thing.

I have no idea how the product is structured, but I do know that many other services have a similar issue.

Heck, we’re using outlook at one of my customers and I can’t even open a second tab in 2020. It will just block the UI telling me there is another tab open.

Does this work with Firefox Sync? I'd love to have different bookmarks/cookies/accounts/etc. for work and home but use the same sync account - sometimes I work from home and want to use my work profile, but also don't want my home bookmarks showing up when I share my screen at work.

MAC works with Firefox Sync, yes.

Only partially; Containers get synced, but site to container assignments do not get synced.

Containers won't give you two sets of bookmarks, but if you go to about:profiles, you can set up two accounts for separate bookmarks.

Physical accounts in different directories inside ~/.mozilla/firefox/? Those don't get synced to the same account as far as I know.

Multi-Account Containers with Containerize is an unbeatable combo. Until Chrome gets something like this (I doubt it), I'm never leaving Firefox because of it.

What does Containerize gain you over Multi-account containers? Is the pattern matching more robust?

(I also use Containerise)

In my experience that had better support for per-eTLD temporary containers, so that each site can have its own, and the data can be discarded relatively soon. I also have more permanent containers for things that I want to be able to persist (e.g. work uses SSO so I need to link multiple sites together to log in).

When I used it I found the management in Multi-Account Containers to be onerous (I don't believe it could do automatic containers based on eTLD).

Oh wow, okay this makes things a little easier. I've always struggled with logging in as the SSO-flow has domains that I haven't added to the "Always open in X tab". Hopefully the functionality gets incorporated into the MAC addon eventually!

.. I say hopefully, man I feel guilty getting so much use out of these addons when I could be actively contributing. Fuck it, donating.. https://donate.mozilla.org/en-US/

This is going to take care of my biggest gripe with Multi-Account Containers; it leaks cookies to the default container if you open the site management list because it looks up favicons each time. I just tested Containerise and multi-container cookie jars, it does not leak cookies with this. Finally, painless container management!

https://addons.mozilla.org/en-US/firefox/addon/containerise/ this?

The worst thing about the Google account switcher is logging into some third party sites sometimes just uses the first logged in account instead of showing the account switcher, so I can't log into the correct account without logging out of all the Google accounts.

Agree that containers are Firefox #1 killer feature and incredibly useful.

I used to have 4 or 5 profiles for firefox for various accounts and situations and containers let me leave all that mess behind. It's pretty awesome and I wish more people knew about it. It's one of the things I bring up to privacy oriented and people who need a lot of different logins.

Is there a way to have multiple profiles open in separate windows but inly a single instance of Firefox, similar to Chrome?

I think you can do it from command line. Set up a few profiles (2 to start with/test) and run them from command line. https://chromium.googlesource.com/chromium/src.git/+/62.0.32...

Also adding to this - you can set up container-specific proxies with "Container proxy" addon. This is great for when you want to ensure your connection is going over a private network, for instance if you have a regular torrent website (or porn or whatever) - you can configure it to automatically open in a container, like this Facebook addon - but when it opens - it will only connect to the endpoint over a proxy. If you're not connected, it fails.

Works really well with Mullvad which has a SOCKS proxy setup only available when connected.

Great for work connections too, I've setup all work/business websites to auto-open in a "work" container which I've created a local bridge proxy for to ensure my work connections are always over the corporate VPN.

This is also really good if you consult or work with many customers - you can start to build a catalogue of containers with specific settings for those customers.

Container Proxy addon:

https://addons.mozilla.org/en-US/firefox/addon/container-pro...

I use the same setup (mullvad + container proxy) and can't praise it enough. I just keep a mullvad connection open on my router and only route the proxy IPs through it.

Great for all kinds of silly GeoIP restrictions, too - in my part of the world, homedepot.com just spits out "access denied", a foodnetwork.com recipe you find in search results just redirects you to the tudiscovery.com homepage, etc.

>"I just keep a mullvad connection open on my router and only route the proxy IPs through it.'

I'm interested in your setup. Do you configure your router to have a point to point tunnel with Mullvad then? I didn't know this was a thing. Do you then just have a separate container proxy for each GeoIP region you want to access?

This'll help you: https://mullvad.net/en/help/dd-wrt-routers-and-mullvad-vpn/

For Geo-IP, unfortunately unless you have some sort of automation to reconfigure the OpenVPN settings on your router - this will only work with 1 configuration. They may be alluding to using the VPN to connect to another country where they're not getting weird as fuck redirects and shit content.

Although just as I wrote that, I'm expecting a dd-wrt/browser addon will probably support this somewhere - or at least as a script on Linux.

I have a Unifi USG, which has a third party wireguard addon, though of course OpenWRT could work just fine. You setup a wireguard tunnel normally, but disable the default routing (on a Unifi, set route-allowed-ip false), and then explicitly add a route for 10.124.0.0/16 through the wireguard interface. The mullvad servers page[1] has socks 5 proxy addresses for all of their servers - assign one to a firefox container and you're all set. No reason you couldn't have a container for each geographic region you want.

1. https://mullvad.net/en/servers/

On a USG the config looks like this:

    wireguard wg0 {
        address ***/32
        mtu 1420
        peer *** {
            allowed-ips 0.0.0.0/0
            endpoint ***:51820
        }
        private-key ***
        route-allowed-ips false
        up-command "ip route add 10.64.0.1/32 dev wg0 && ip route add 10.124.0.0/16 dev wg0"
    }

I'm curious to learn more why you have gone this route compared with the default settings of a standard router?

I'm uncertain of the benefit for everyday people.

Anyone in the know: what would it take to implement a "container over tor"? I am not currently a tor user, but absolutely would if I could integrate it with my current workflow (using the temporary containers addon).

tor provides a socks proxy, which you can assign to a container easy enough w/ the container proxy addon.

Thank you, I'll look in to this!

Be careful doing this though, there's a reason Tor Browser exists and it is because it's very hard to do anonimity over Tor right on a default browser.

Granted, Tor tries to upstream as much as it reasonably can to FF, but there's still large differences in defaults that could give away (some bits of) your identity.

See this comment first, not mine but might as well be https://news.ycombinator.com/item?id=24853678

It's all baby steps. I don't expect to be fully anonymous this way, just like I know my current setup does not foil more sophisticated tracking.

Does FF send DNS requests via the proxy? Depending on the personal threat model and the ISP, that might matter.

FF defaults to DNS-over-HTTPS now, so I would imagine it does, although I can't find solid confirmation.

Only in the US.

There are checkboxes to control this in the Firefox proxy settings. "Proxy DNS when using SOCKS v5" and "Enable DNS over HTTPS".

In the proxy options, there's a box to tick for sending DNS through the proxy or not.

Though you won't get stream isolation this way https://www.whonix.org/wiki/Stream_Isolation

"Anyone in the know: what would it take to implement a "container over tor"? I am not currently a tor user, but absolutely would if I could integrate it with my current workflow (using the temporary containers addon)."

This is my every-six-months wish/rant on this subject ...

What we need is the ability to 'jail' a GUI browser process.

It is too resource intensive to spin up an actual virtual machine to run a browser window/tab. However, a facility like 'jail' (or zones or, perhaps even Docker) that simply chroots a new process with its own network interface, etc., does not have any of that expense.

It really is just a fancy chroot and the expense is limited to the overhead of just the process you're running.

If you could 'jail' a GUI application, you could have a browser window that was not merely its own cookie domain or history domain, but that was on an entirely different network and it's own chroot.

Container proxy plus a putty socks tunnel over SSH through a pinhole firewall rules to my work linux system is my preferred poor man's work VPN. One main benefit being that allowing the non-VPN traffic to handle the video meeting works way better.

I'd even debate if it's really a "poor man's" VPN, I think it's actually a better solution

Traditional VPN solutions seem overengineered and complicated. Wireguard is better though

I just discovered Mullvad (just a VPN provider) and for some reason, they don't have "English" in the list of languages available for their site.

So they redirected me to the Dutch version because I'm in a nominally Dutch-speaking region, and I had no option to get it in English. I had to go with half-translated French until I noticed that I could replace the "fr" in the URL with "en", and actually get to an English-language website.

The region-based redirection was annoying enough, and the half-assed translation job was expected, but not even providing an easy way to get back to English is really idiotic.

I still wish I had some kind of system that would automatically use a connection in the right country for geoblocked content. For now I just use SSH proxies to (my own) strategically located servers combined with Firefox Containers and Container Proxies, but it's all manual.

Just checked it, and English is 4th option in the language switcher on the bottom of the page.

Also, it seems to be using browser's preferred locale, not the IP region. So, it looks like that changed, too.

Google, on the other hand, is just as bad as you described. Geo-based localisation, lots of clicks to change the language (or ?hl=en, once you learn about it).

Looks like you're right, but unfortunately the select is cut for me[0] because my screen is not big enough.

Since the list is not alphabetically ordered (it actually is, but with the English names, not the displayed names) and it shows no scrollbar, it wasn't obvious there would be other countries up there.

As for language, maybe Google itself chose to send me to the Dutch version. Despite all my attempts, I still cannot consistently get Google to use the language I want (apart from manually choosing it by directly visiting Google with the right hl= first, indeed). Right now Google.fr seems to be in English and offering me the three languages of Belgium, for some reason.

[0]https://i.imgur.com/nuAPsxD.png

Could you provide some more information about the local bridge proxy? I'm trying to implement something similar but don't know where to start.

Mozilla needs to work harder on the permission system for addons.

One of the permissions you have to grant to the container proxy add on is:

“Access your data for all websites”

That’s not acceptable.

How would you propose fixing it? Firefox has an active bug tracker to discuss these kinds of things.

I also love Temporary Containers, so each of my tabs can be a fresh sheet. Also cookies and much else gets purged after I close them.

I've been wondering if such an extension exists! Thanks for telling me about it.

Would you be willing to share your config?

Last I checked, I'd have to enumerate every Google domain and subdomain, which just seemed like too much work. But if others have already done this, itd be easy to just use theirs.

https://github.com/containers-everywhere/contain-google

https://addons.mozilla.org/en-US/firefox/addon/google-contai...

You can use this. It's a fork of Facebook Container, but for Google.

This one is a fork for Amazon https://github.com/krober/contain-amazon https://addons.mozilla.org/en-US/firefox/addon/contain-amazo...

Twitter: https://github.com/v1shwa/contain-twitter https://addons.mozilla.org/en-US/firefox/addon/twitter-conta...

There's a few more too

I didn't know about the default containers. Thanks, that's great to know!

Why do you hate the Google account switched for Gmail? It keeps all of my Gmail-attached sites isolated in Chrome and is easy to use on desktop (non-existent on Android Chrome unfortunately).

Tooting my own horn :). Session Boss [1] saves the container information as part of the session and can restore the tabs in their respective containers. I use it to maintain multiple Gmail accounts and other email accounts in different containers.

[1] https://addons.mozilla.org/en-US/firefox/addon/session-boss/

Sweet, I'll give it a go. I'm a huge fan of being able to export sessions, save them, query and suspend tabs.

That looks like a useful extension, just installed it. Good for those times I want to Undo Close Tab for something 10 tabs ago

The add-on page for this says it was last updated in June 2019. Just wanted to check if it's still compatible and has no issues with all the changes in Firefox for more than a year now.

I'm a bit late to this thread, but thanks for making & sharing this extension. It looks amazing!

Didn't know you could do this with Firefox. Thanks for the tip! Curious — have you ever heard of Shift (tryshift.com)? It pretty much does the same thing, but with everything (Gmail, Facebook, YouTube, WhatsApp, etc.). I use it at work so that I don't have to sign in and out of all my Google accounts. It's pretty unreal.

Welcome to HN. Is this you?[1] You should disclose your job is promoting the company you mentioned if it is. I hope it isn't or you just forgot. Astroturfing erodes trust between people and makes the world worse.

[1] https://blog.hubspot.com/marketing/author/olivia-scholes

Good catch !

I'm confused. Containers work by URL. How do you use a different container per Google account?

Firefox containers isolate all cookies, site associated credentials and cached content

Right I guess I mean you can't isolate all Google sites to one container but also split your Google accounts across multiple containers.

The Facebook Container extension is special, it does a bunch of work to put all of Facebook and only Facebook inside the Facebook Container. Bits of Facebook trying to peak through outside Facebook (e.g. tracking pixels) are elided entirely. Which is exactly what I want. But ordinarily that's not the behaviour you get from a Firefox container.

e.g. I have that Facebook Container, and I also have a Slack container I just put together in the usual way by opening my Slack session (it's for the main social group I hang out with, during the pandemic) inside a Container with a pink theme and icon.

Suppose three friends send me a funny Youtube video of kittens, one sends it on Slack, one on Facebook, one literally sends me a postcard with the URL on it.

In Facebook, it's inside the Facebook container. Since the Facebook Container has no idea who I am, Youtube presents adverts and of course there's no way to add the video to my "Fun kitten videos" list. But if I tell Youtube to open this now the tab is not Facebook, a no-referrer link opens with the URL and now in my default context which has Youtube Premium, so there are no adverts and I can add this to my lists. As far as Facebook is concerned I apparently just left. Unless Google tells them I watched that video they are none the wiser.

Slack is inside the Slack container. So again, no Youtube account, adverts. But if I open the Youtube page that's still inside the Slack container, so still no Youtube account. I need to explicitly get the URL and paste it into a not Slack tab to get my default context.

The link from the postcard obviously I get to choose which context to type it into the URL bar, although maybe the UX of typing random Youtube URLs in isn't great.

> In Facebook, it's inside the Facebook container. Since the Facebook Container has no idea who I am,

wouldn't they know exactly who you are with every request sent to any of their servers and any facebook page you load either by your facebook account, IP address, or by browser fingerprinting.

I mean, sure they can be entirely confident that I'm the Facebook user who signed up for that account, and so in that sense they know exactly who I am.

But in another very real sense they've got no idea who that is. It would suit them very well to be able to reliably tie it to other information (hence all the tracking pixels and so on) but the Container prevents that.

I mean, one of my Facebook friends is named say "Norman Le Plum". I'm very confident that isn't what it says on his birth certificate, and indeed when his friend request arrived I actually ignored it until I found someone out of band to tell me who "Norman" was, but in a sense Facebook know exactly who Norman is, he's a disembodied red skull who is still really into skateboarding and Steamed Hams.

What use that is,isn't clear, and presumably one day advertisers might conclude the answer is "No use whatsoever" and Facebook will go out of business. Meanwhile I read funny Steamed Hams variants, people complain about their jobs, and while I'd rather it didn't exist at all, if it must exist at least it's trapped in a little box where it can't taint everything else.

Now Google probably knows way too much about me, but that's quite a different problem.

I wouldn't count on a fake name being any kind of problem for facebook assuming they're actively using the profile. Not providing them any data at all won't spare you, but if you're using the account they can easily analyze photos and comments (including those on other people's profiles), use facial recognition, use friend/activity patterns, match IP addresses/browsers (including any instances where the same IP address/browser was used to sign into non-facebook services found in records purchased by facebook from data brokers), and if he ever uses his phone or chrome to look at facebook there's a handy unique ID sent to facebook as well which can be matched with countless other recorded activities.

Facebook devotes a huge amount of time and money to collecting data and using it to associate people to a real identity to the extent that even people who never signed up for an account at all have hidden profiles created for them by facebook which contain the intimate details of their life including what they buy at the grocery store.

As far as I can tell, a container won't protect your identity but it will limit the amount of information they have on your browsing history (unless your ISP decides to sell them that information or they obtain some of it from a 3rd party data broker)

Older accounts may have fake names but newer ones require identification documents, even selfie videos to prove you are a human. It wouldn't surprise me if they start combing through older accounts eventually.

Ok so my point is that you specifically don't put any Google sites into "a" container but rather let them fall where there are, and if you have a Work container and open something Google, you only ever log into the Work-related Google account?

For work stuff my habit for maybe a decade or more has been to have work buy me hardware and the work hardware does work stuff, so this conflict never arises. The closest is maybe a previous employer paid me a retainer and obviously they didn't buy me a special laptop just for like one conference call a year on retainer, so I did that from my PC.

But yes, in a Foo container, all the various Google things (Docs, GMail, their Cloud offering, Youtube...) are either not logged in at all or they're logged in from some Foo context.

I tried it but it doesn't seem to work. I clicked a new "Work" container, then went to mail.google.com, and it instantly took me out of the container.

And then when I click back to the work container and try to access mail.google.com I get:

"400. That’s an error.

The server cannot process the request because it is malformed. It should not be retried. That’s all we know."

Bug? It seems like a really messy UI. Why can't they make Multi-Account Containers work just like Facebook Container? Or have make 1 window == 1 container?

You can actually have different profiles for Chrome which achieve exactly the same thing.

Can you have dozens of different profiles open at the same time in different tabs of the same window?

Yes, I use it at home but also a lot at work. Opening personal account and admin accounts in a bunch of different tabs for a bunch of different sites. Makes it super easy, no need to log in and out throughout the day. I have users that also will have our O365/Okta accounts as well as client O365/Okta accounts. Containers make it a cinch to keep everything separate and logged in at the same time.

It seems that one could also run multiple instances of Chrome or Chromium inside docker containers with X11 forwarding.

I was asking about Chrome profiles, not Firefox containers. I use dozens of Firefox containers already, and it's my understanding that Chrome profiles aren't a good substitute because you can only use one at a time.

No, though I prefer different windows as then you can have different bookmark bars for each context.

I really like "Temporary Containers" https://addons.mozilla.org/firefox/addon/temporary-container... which is a really useful privacy-enhancing usage of the containers API.

https://medium.com/@stoically/enhance-your-privacy-in-firefo...

isn't this the same as a private tab ?

Private tab? Do you mean private window? Or is there some other feature/extension?

The temporary containers extension is creating a temporary container with each newly opened tab. It uses same container for tabs opened from existing tabs.

All tabs opened in private windows share the same "container", which gets cleared once you close the last private tab. With temporary containers, all your tabs are in independent containers.

good to know thanks

I log into roughly 20 AWS accounts/day. Container tabs make that work. I can compare things side by side or just work on two tasks at once.

Holy moly, why 20 accounts?

It's not that unusual to use separate AWS accounts as blast-barriers. I.e. they contain the damage that might occur due to a leak etc. I typically use 2 (prod & non-prod) for each major product/offering, plus a centralised one to manage policies, billing etc for all the sub accounts. They add up pretty quickly.

I use an account for $service-$stage-$region-<$function> then I run most services in every available region

so:

main-service_prod_us-east-1_dataStore

main-service_prod_us-east-1

main-service_test_us-east-1_dataStore

main-service_test_us-east-1

main-service_beta_us-east-1_dataStore

main-service_beta_us-east-1

* regions

Adds up pretty quickly.

My employer has accounts in the hundreds...

Similar to OP you're replying to, I use Firefox Containers to open separate accounts to open independent windows from my Identity Provider when I need to be in more than one account at a time.

AWS credits? You can get a bunch of free credits for each account, and then build an abstraction around boto3 to make 20 accounts look like 1 account to you.

meh, compute cost almost always costs less than dev time. I use multiple accounts for separation of duties, cost, access, and blast radius. Most services I run blow through the free tier in minutes.

I do have scripts that spin up accounts as needed and I just have a bucket for 'free Tier account access ending' emails.

Standard practice in larger scale.

I run big fleets, 100s of hosts 1000s of containers in most AWS regions. Most of the control plane is automated, but when that breaks, or there are issues in the data plane, I might log into read logs, look at metrics, force scaling actions, or just general investigation tasks.

I also use different accounts for permissions boundaries. Data shared between multiple teams might go in one account. The apps can access the data but maybe the interns can only access the app account while the SR. Eng(s) + current oncall have full read only access to the data for investigation. A second RW-Data oncall might have access to the DB account in each region. Ever data storage account also has a limited access cross account Data replication/backup account.

+ I help people out. 'Can you look at this? . . .'

In the end, there are account specific errors that can be caused in your infra, IAM rolls, keys, throttling, malicious access that are easily prevented with least access in per account buckets. So I end up with multiple accounts in each region.

This is great, I have been using firefox forever never knew this. Thanks for posting!

I use private windows in Safari, where each tab automatically behaves like its own container.

It’s not the same. All my uMatrix anc cookie auto delete rules are container specific. Private windows are like very simple containers that destroy themselves once closed.

AFAICT private Firefox windows are also part of the same container so you don’t get true separation (can’t open multiple Firefox private windows and log into different google accounts — does that work in Safari?)

Yes it works in Safari private tabs. I do that sort of thing regularly.

I just recently discovered a tip that finally made Firefox multiple windows usable. When you want to restart the browser and save tabs across all windows, you use Quit command from menu (or Ctrl+Q) and not the window X button (Alt+F4).

Ctrl-shift-n will reopen a closed window (with all the tabs it had) just like ctrl-shift-n will reopen a closed tab. Try it a few times after closing multiple firefox windows with multiple tabs each if they don't come up automatically on start.

You mean "ctrl-shift-T will reopen a closed tab".

Yes, my mistake. That's pretty obvious in context what I meant to someone that already knew it, but that doesn't help those that didn't know about that feature, so thanks. :)

Do multi account containers work with SSBs (site specific browsers / chrome like apps for specific websites)?

I use the 'Containerise' plugin along with the following configuration (which I am constantly tweaking) to keep the big tech companies isolated from each other and the rest of the web.

https://addons.mozilla.org/en-US/firefox/addon/containerise/

I'm also increasingly using it to keep their various properties isolated from each other (eg. keeping Bing separate from the rest of Microsoft) to reduce tracking even further.

  !*.atlassian.net , Atlassian
  !*.bing.com , Microsoft Bing
  !*.bitbucket.org , Atlassian
  !*.github.com , Github
  !*.google.com , Google
  !*.imdb.com , Amazon Home/Personal
  !*.linkedin.com , Microsoft LinkedIn
  !*.live.com , Microsoft
  !*.microsoft.com , Microsoft
  !*.nytimes.com , New York Times
  !*.reddit.com , Reddit
  !*.twitter.com , Twitter
  !*.youtube.com , Google
  amazon.com , Amazon Home/Personal
  console.aws.amazon.com , Amazon AWS
  music.amazon.com , Amazon Home/Personal
  news.ycombinator.com , Hacker News
  smile.amazon.com , Amazon Home/Personal
  www.amazon.com , Amazon Home/Personal

You get the idea. Really powerful.

Oh wow. I used containers for a while, but the official plugin for managing them was awful. You had to go to the site, set the container, then click an approve button the _next_ time you went to it. Took forever to get things set up, and it never synced the settings despite claiming it would. I'm going to give this one a try. Thanks!

> but the official plugin for managing them was awful

I wish we'd stop being so hard on products. It's likely those developers read these comments. Having babies be called ugly by your peers is rough, actively trying to be more respectful on the internet leads to a nicer industry.

EDIT: Just to clarify - I'm not saying your intention was disrespectful. I've written many comments similar to this, and continue to do so, but I've started to try and curb it because I imagine it's what YouTubers feel like reading their comments section.. But this is by our own peers in our industry.

They should not take it personally. The UX/dev people at Firefox should take that as a constructive criticism.

Since when is constructive criticism expressed in words like “awful”?

You should take be asking the question why are the users using words like "awful"

I was quite frustrated by this as well, but then I remembered that the design goal of the extension is allowing logging into the same service with multiple accounts, not isolating services from each other. That is why the secondary functionality, the possibility of isolating tech fiefdoms, is less polished. It's not the main show, it's just a happy side effect.

Containerise and Cookie Autodelete together are indeed a very good addition to uBlock and uMatrix, and if you already have some Regular Expression classification rules written for Cookie Autodelete, setting up Containerise is very quick. It works like a charm even with the Firefox Multi Account Containers extension itself disabled.

This add-on has the same problem as Temporary containers. If you want to isolate Facebook and click a link to Spotify it will open Spotify in the Facebook container :(

So far only the Google/FB container add-ons do this right.

If I understand what you want correctly: the Firefox multi account container extension (is that the default one?) allows to "manage containers" and by clicking on the one you want you can select "limit to designated sites" so you can, from a container, click a non containerized link and get that link opened in the default/different container

Thank you thank you! That's fantastic! I wish I didn't have to manually assign containers but ya know what, good enough.

In temporary containers you can set up what should happen on different actions (left click, ctrl+click, etc) and different domains.

https://github.com/stoically/temporary-containers/wiki/Globa...

> If you want to isolate Facebook and click a link to Spotify it will open Spotify in the Facebook container :(

If you are talking about the Temporary containers extension, that's not the case. The extension is not the most easy to use, but it certainly supports opening Spotify in a different container when clicking a link in FB. You either don't have the Navigation→Target Domain set to Different from Tab Domain & Subdomains or you have Exclusion Patterns set which exempt Spotify.

Right-click the link and click "Open in new container tab > " and click the container you want.

Just enable "Default container" in its settings to isolate everything. (For advanced usage, also see the help button)

Thank you thank you for posting this!

While I do agree with some reply-ers that @pkulak's critical wording was a bit strong in the sibling comment here, I have been incredibly frustrated with the default "Multi-Account Containers" add-on.

They have a facility to delete domains from a container, but no facility to add one: something I would've thought would be one of the first things one would want to implement. I understand resources are not always plentiful, but they've added a bunch of other features and yet this one is still lacking.

This is especially infuriating for "intermediate" domains forming parts of a redirect (Google have changed their subdomain structure recently and placing different Google properties into separate containers is now impossible with Multi-Account Containers due to their redirect structure)

The pattern-matching feature in `containerise` looks even better again.

Hoping it works as well as it looks; going to give it a try now.

How bizarre that I desperately try to contain these monsters in digital cages, keeping them on a VPN leash, carefully adding plugins, trying to maintain delicate balance. Sometimes I try too hard, the monsters are offended, throw errors, hide the contents away. Sometimes I miss something, and they devour my privacy bit by bit, unnoticed. I spend sleepless nights scouring the internet for new codes, secret browser options, complex combinations of obscure settings.

And when I finally fall asleep, I dream of internet without the monsters.

Well put, the fact this is required is IMO an indictment of what Facebook has turned into. FB are not alone in this.

To be fair, it isn't required. The actual consequences of Facebook having your information has thus far been a benign experience for the vast majority of its subscribers.

Beautiful

Try Qubes OS instead, it gives a great peace of mind.

A few others:

- Temporary Containers[0]

- Google Container[1]

- Google Container w/ Integrations (YouTube, AdTech, Apps, etc)[2]

- Reddit Container[3]

There are a few others[4] as well, but I've found the Temporary Containers solves the 80%.

[0] - https://addons.mozilla.org/en-US/firefox/addon/temporary-con...

[1] - https://addons.mozilla.org/en-US/firefox/addon/google-contai...

[2] - https://addons.mozilla.org/en-US/firefox/addon/google-contai...

[3] - https://addons.mozilla.org/en-US/firefox/addon/contain-reddi...

[4] - https://addons.mozilla.org/en-US/firefox/search/?q=Container

Worth pointing out that while they're probably safe (and do in fact use the same container APIs to separate out the domains), these are all from third-party developers. Where as the Facebook container is from Mozilla directly.

Multi-account containers IS made by Mozilla, actually

You can make all of these yourself as long as you've got the Temporary Containers add-on installed. I don't see the benefit of installing four addons for this purpose, as the security risk of third-party addon vendors surely outweighs the convenience of a pre-configured container.

Has temporary containers gotten the feature to drop the container when leaving the target sites? That's the main difference for me.

If I'm in FB Messenger and click an external link I don't want that link to be opened in the FB container.

I use per-domain isolation, so I don't run into this issue.

However, I need 2 manual persistent containers for sites that are broken with per-domain isolation (Gmail and Outlook 365). Both visit many different domains after login. Within those containers, I need to be careful not to click on external links, but to open them in a new temporary container.

I think it's actually just a containers feature now: https://news.ycombinator.com/item?id=24850878

Is it possible to have each domain open in a persistent container? It looks like Temporary Containers uses a new one each time a site is visited. Containerise, on the other hand, seems to need to know about each domain in advance.

I use persistent containers based on domain. Works brilliantly.

With what addon?

I only use the official "Firefox Multi-Account Containers" (on this browser).

It gives me a menu with choices like "Reopen This Site in..." and "Always Open This Site in..." as well as options to open a new tab in any of the permanent containers or even open new ones.

Tip: if anyone gets confused by a page popping up, saying something like "You asked me to always open this site in, do you still want to " a typical explanation for me was I had set at site to open in a specific container but as part of login procedure it would access another domain for sso, trigger "Always Open This Site in..." for that domain and get confused.

Now that you know this you should probably be able to either avoid it completely by being specific about subdomains or something.

It is not a big thing, just a heads up so nobody gets confused.

Do not use Temporary Containers.

This extension to Multi-Account Containers looks great at first -- its Automatic mode spins up a new container each time you open a new tab, then switches that tab to an existing container, should one be associated with the TLD you visit.

The problem is that Temporary Containers does not delete these temporary containers. They accumulate in the MAC containers list. There is no way to mass delete them, nor set them to auto-delete when the tab is closed.

These WILL sync to your Firefox account and reappear on every machine. Over 3000 temp container made MAC unusably laggy. This was so destructive of my MAC experience that I uninstalled both extensions. Unfortunately, to my knowledge, there is no way to reset the data MAC syncs to Firefox Account.

Temporary Containers has an option "Delete no longer needed Temporary Containers" which defaults to 15 minutes, but can also be set to immediate.

Are you setting this option to something else?

Temporary Containers works really well for me. I have per domain isolation, which only breaks very very few sites (Gmail and Outlook 365). For those I have regular persistent containers. Alternatively, I can always open a new private window where I don't have this plugin active.

uBlock Origin + Temporary Containers + ClearURLs are a great setup for privacy and security. Actually, I don't need much else aside from a VPN and a few settings in my user.js.

The only thing I miss is Vimperator. Modern alternatives are full of glitches because of inherent limitations in the WebExtensions API.

It's a long-standing bug that also affects me. It's quite annoying since it's easy to irreversibly hose up your sync account by going over the remote storage quota. Maybe you don't have a Firefox account and/or sync setup?

There are related issues opened for Temporary Containers, MAC and Firefox and at least from the public discussions not much is happening about it.

I use Temporary containers heavily and the MAC sync is also enabled but I never see anything like this. Sometimes 1-2 container it remains but I can delete it manually. Maybe I'm lucky with this.

> The only thing I miss is Vimperator. Modern alternatives are full of glitches because of inherent limitations in the WebExtensions API.

Didn't use Vimperator, but I found Tridactyl to be pretty good, especially their hinting mode.

Here is the issue if you are interested. It's still not closed: https://github.com/stoically/temporary-containers/issues/371

"Delete no longer needed temporary containers 15 minutes after the last tab in it closes" is a default setting. This is not an issue I've experienced in the 3+ months I've been using this extension.

Are you sure you didn't accidentally change it?

I had the same issue and this was always enabled

I can confirm what others are saying, using temporary containers with the default settings left me with hundreds of containers to clean up.

I don't remember what the default settings are, but I do remember changing a fair number of them (and they are numerous). Definitely not the most friendly tool to casual use. But when fully configured, it is my second favorite addon (behind uMatrix).

I don't know what, but something causes it to leak. I've been using it for about a year and several of the low numbered containers have accumulated duplicates:

Edit: Apparently HN strips box drawing characters. Imagine the output of `sparklines 6 15 7 5 2 1 1 4 3 1 1 1 1 1 1 1`.

I had the same issue and uninstalled both.

I used to delete manually each container when this happened, through about:preferences container manager, but now there is no more this in Preferences and to remove containers through the Multi-Container extension isn't the best thing.

Tried do that by editing some files too but the hundreds os containers keep reappearing after few days, or on new installations.

Huh, I have not experienced this issue, but there seem to be mixed reports in these comments. The numbers continue to count up (this is also configurable), but the containers are actually deleted.

The only passable workaround is to enable "Reuse available numbers" for container numbering setting.

At least this way yo won't end up with unusable FF because of the thousands of undeletable temporary containers.

I have the same problem (which supposedly does not happen to all users of that extension). I fix it by running this script once a month (it deletes the temporary containers from the containers.json file):

    import json

    with open('containers.json.bac') as f:
        s = f.read()
        j = json.loads(s)
        ids = [i for i in j['identities'] if not i['name'].startswith('tmp')]
        print(len(j['identities']), len(ids))
        j['identities'] = ids
        with open('containers.json', 'w') as wf:
            wf.write(json.dumps(j))

You can reset your sync data for any extension in Firefox.

Just go to about:debugging, click on "This Firefox", locate the extension and click the "Inspect" button. In the case of MAC this should lead you to about:devtools-toolbox?type=extension&id=%40testpilot-containers

In the devtools that open you need to go to the Console tab and run this command:

  await browser.storage.sync.clear()

If you want to see the data before you delete it, you can show it with this command:

  await browser.storage.sync.get()

The issue with this was using multiple Google identities. The Google Container Extension would want to open any other Google sites in the same container.

I wanted to keep the soccer club administrator, school website, etc. Google identities separate and distinct.

Perhaps things have changed and this isn't an issue anymore. What I did was create an identity (soccer, PTA) for each gmail account and set defaults for google.com, YouTube.com, etc.

Having MTTSCPresident@gmail.com is really nice for being able to give someone else the password and let them take over the account when your term is done.

I am hard pressed to think of any other website in the 25 year history of the WWW that was so abusive of its users that web browsers had to start inventing features to protect user from it.

www.google.com seems like the obvious answer.

https://addons.mozilla.org/en-US/firefox/addon/google-contai...

Any website from mid 90s through early 2000s when popups were the dominate way to deliver ads to users. Want to say Yahoo services and just about any local news site were good examples but it has been 20 years. Browsers added popup/popunder blocking settings that exist to this day which neutered that ad revenue model.

When you're the only drug dealer in town, you can treat your customers however you want. They'll keep coming back.

Google, Twitter, Reddit, Amazon, Medium, the list goes on (there is a Container extension for each one of them).

Special mentions for polluting search results: Quora, Pinterest

I'm finding more and more that it might finally be time to switch back to Firefox.

Is Google still planning to destroy adblock with Manifest V3?

I'm finding more and more that i want to move to a Chrome fork (Brave) but TreeStyleTabs (Sidebery) keeps me with FF.

What advantages does brave have other than their weird ad replacement thing? I’ve weirdly moved to Microsoft edge from Firefox for something’s recently. Unfortunately the chrome developer tools are awful.

Chromium browser which still generally has a performance edge, but without some types of Google's tracking like the browser level sign in or the recent example of Google exempting themselves from clear cookies.

I use both quite a bit and do not notice any difference in performance. You may be able to tell via benchmarks, but real-world performance is very similar.

But is that performance difference actually important? I can accept a minor impact as a tradeoff to support a more diverse ecosystem and weaken the Google monolith just a little.

> Unfortunately the chrome developer tools are awful

You are literally the first person I've ever heard say this. I've heard a ton of people say they want to switch to Firefox, but can't leave the Chrome dev tools behind. Mind telling us why you find Firefox dev tools superior?

Is it possible to publish extension to Brave without Google authorizing it? As an extension builder I tried in the past and didn't manage to do that.

No, Brave still uses the Chrome Web Store.

I stay with Firefox for a lot of reasons, but the main one is this - I am so used to TreeStyleTabs I can't imagine going with anything else. Do any other browsers support something similar?

Opera has tree tabs extension (which I'm using for a long time, but only for really threaded sessions), chrome idk. Not sure how much different it is, but the basic functionality you'd expect from tree editor is there.

The TST repo actually has a number of similar projects for Chromium and specifically Vivaldi on it's repo: https://github.com/piroor/treestyletab#similar-projects

I love Brave and use the Sidewise extension to mimic TST. [1]

It isn't perfect though. My main issues are that it's a separate window so sometimes clicking on the side window or the main window draws focus instead of clicking the thing under my cursor. Also the search bar in the sidebar keeps getting accidentally activated when I hit command-T. So I ended up inspecting and deleting the element. It's not the most elegant solution, but it works well enough.

I've tried FF a couple times a year ever since Quantum came out, but on my MBP it's just much slower than Brave.

1: https://chrome.google.com/webstore/detail/sidewise-tree-styl...

I've given it a show but sadly it doesn't satisfy my needs. Firefox will have to stick for now.

Eventually I'll probably end up on Brave.

I switched to Vivaldi (Chrome fork) as a dedicated browser for Roam Research and associated chrome extensions, but I've been using it more and more.

Encrypted SNI is another feature which is completely absent in chrome but available in firefox.

That and the containers are why I'm back on Firefox!

Work on Encrypted Client Hello (the current iteration of encrypted SNI) continues and you should anticipate that Chrome will deploy it as the draft approaches Last Call perhaps next year.

Because of the Don't Stand Out principle one of the most important factors for success of ECH is the deployment of ECH GREASE, which is to say, willing clients just claiming they want to do ECH even when talking to servers that don't really have any hidden services at all. Chrome's participation in that probably makes a real difference to whether anybody actually tries to block it.

Worth noting that it's currently disabled by default. You can enable it by going to about:config and setting network.security.esni.enabled to true.

The time to switch back to Firefox was years ago. But better late than never.

The only asterisk to that statement would be if OP was a Mac user. Using Firefox for reddit and youtube nets me 4 hours of battery life on a 2020 13 inch MacBook Pro, while safari will get my 6.5-8 hours with the same usage.

Some years ago Firefox was near-unusable on MacBooks because it started spinning fans like crazy after a few minutes, eating battery in 30 minutes. But it had improved immensely since that time.

Speaking of Safari, maybe it's a matter of preference or habit, but for me it's has a very weird UX

It's because mac doesn't support vp8 hardware decoding. use this extension to force youtube to use h264 https://addons.mozilla.org/en-US/firefox/addon/h264ify/

Blame apple

> Blame apple

and Google, for not doing the minimum thing they could have done and served you the best encoding for the platform.

It is almost if the companies you actually give you money to (or eyeballs) do not care at all for your interests.

I love this Facebook container. Love to see the Facebook container mark also on other websites trying to track me.

I also use the Firefox multi-account containers to set a temporary container for every new tab. To not lose logins etc I'm websites I visit frequently, I set up dedicated containers for those. Work very well.

Anyone else with experience of the Firefox multi-account container extension?

Was just coming back to this thread to say I use the Multi-Account Containers extension to isolate my Facebook, YouTube, Twitter, and Google Search sessions from the rest of my web browsing, and I highly recommend it.

The terminology is a little confusing: Containers or "Container Tabs" is a session-management tool that's baked into Firefox, while Multi-Account Containers is an extension on top of that that allows you to automatically sort specific domains into containers, so when I open e.g. a YouTube link it automatically appears in a YouTube container, which knows nothing about my Google account. IMO the functionality of the extension (which was written by Mozilla) should be added to the browser itself.

https://addons.mozilla.org/en-GB/firefox/addon/multi-account...

Does this work for separating Google accounts?

Right now I use safari, chrome, firefox, and edge to keep the four identities I use for different projects separate thanks to Google not playing nice at all with the GCP account you are using not being the primary Google Signin.

Yes, it does

> Love to see the Facebook container mark also on other websites trying to track me.

In fairness, some of those sites might not even know the like button is used for tracking and just think it's for helping them grow their facebook audience.

Sync for multi-account-containers was implemented in Feb 2020, nice! And it works on mobiles as well! Reinstalling.

Multi-container will break any SSO experience that depends on cookies, where the sso domain (abc.sso.com) is not pinned to a container, and the destination domain (abc.com) is pinned to a container, due to the correct behavior of not allowing cookies to be copied into the container when the SSO chain of requests traverses from abc.sso.com -> abc.com.

This plus the inherent back button hijacking when you click a link that throws you into another container (which works by opening the link in the new container tab, changing to it, and closing the original tab), led me to just stick with facebook containers and sacrifice the privacy offered by multi account containers for some convenience.

To do this for all sites you can enable First Party Isolation if Firefox by toggling privacy.firstparty.isolate in about:config, or have a UI button that toggles is through an addon [1]. I've been using it for years and it only seems to break some payment processors, and only rarely.

[1] https://addons.mozilla.org/en-GB/firefox/addon/first-party-i...

> I've been using it for years and it only seems to break some payment processors, and only rarely.

The majority of cookies don't break much at all. Or at least not that I notice; I've been blocking all cookies, including first party, for a few months, using uMatrix.

Obviously you need them for logins[1]. You need them on Twitter to view the old version of the site that doesn't require js. On YouTube, to view comments. To follow some redirects on the Android developer docs site.

[1] ...mostly. Some actually store all the login info in js state (and presumably localstorage?).

This is definitely convenient for now, but the shifting browser ecosystem (along with default security changes in Safari and proposed changes in Chrome) is driving the development and adoption of server-side tracking solutions. This is great for the short-term, but I imagine it won't be relevant much longer.

There's a reason why Segment just sold for $3.2 billion... [edited to add: They offer a single integration point and will proxy your data server-side to hundreds of other companies.]

Indeed, I'm getting increasingly skeptical that a technical solution is sufficient to fighting surveillance capitalism. Looking forward to see some serious GDPR fines.

Agreed. I'm hoping to see more analogous stateside laws like California's CCPA as well.

Apparently, Japan, Brazil and Canada is following suite.

Couldn't you block all requests to Segment's integration point?

They use CNAME aliasing to make the requests seem like they're coming from your own domain, so you'd have block a specific URL on a site-by-site basis, and there are also fully server-side APIs so you don't even know when data is being captured or shared.

uMatrix has the option to unmask cnames.

Browser finger printing will defeat this. I wonder how prevalent it is.

Most of the sites I visit seem not to recognize me without cookies but I always wonder if it's just a "ploy" to make me feel untracked.

While I'm at it, anyone has good resources on how not to be finger printed (without going full Tor browser)? Do I have to disable Javascript?

Hi, I did my thesis on browser fingerprinting. Most algorithms that build profiles and look for combinations of features that are unique. The best way to hide your fingerprint is to be as similar to everyone as possible.

So that means use as much of the standards as possible that comes with the OS. Do not use anything that would not be considered mainstream (e.g. don't be the only person from Guatemala on Opera, Linux, DVORAK Keyboard using an odd screen resolution.)

The absolute hardest thing to create a browser fingerprint on is corporate laptops as they have identical setups!

Does changing things often also help? Like, if there was a way to set things up so the browser would randomly change (on every request, or maybe every N minutes) bits of your user-agent, font list, screen resolution, etc., would that make it harder for sites to track you?

The rate of change is of course an important factor, but some things like the order of how you installed fonts (which depends on the order you installed the software that fonts came with) or the plugins you have installed in your browser are still going to be constant.

What we saw was that people tried to spoof their UA only made it more unique. (E.g. your UA says Internet Explorer but you have Chrome specific plugins). Or even worse if you have a completely unique User Agent.

As long as you're spoofing your fingerprint info (you can randomly change things like fonts, video cards, battery life, plugins etc) it doesn't matter how unique you are because every time you visit the site you'll be unique just like everyone else who is either a first time visitor or does the same. That seems way more effective than trying to hide in a "crowd" when even the smallest consistent deviation in an ever growing and changing list of potential flags will get you tracked 100% of the time.

Couldn't the frequency of profile information itself be considered a uniquely identifying attribute? Couple that with something that's harder to change on every request (such as IP address) and I imagine you can confidently build a profile out of that.

frequency of changes could be an issue in cases where connections are continuous, but for most browsing it shouldn't be a huge problem. Your information will have changed multiple times between requests. The IP problem is larger, but can be mitigated by the use of VPN, TOR, or shared connections (school, workplace, public wifi etc). I think the real takeaway is that there is no perfect solution, only means which make the work of people attempting traffic correlation more difficult. For services you're already logged into (facebook, steam, reddit, insta, youtube, HN) the battle is already lost. Blocking trackers and ads helps prevent 3rd parties from building a profile of your actions across the web, but all we can ever hope to do is make the record less complete. We're all vulnerable. Now that ISPs are able to decrypt much of our traffic and sell our entire browsing histories alongside our names it's not something I see being solved anytime soon.

There are extensions for Firefox that do this. See https://news.ycombinator.com/item?id=24851721.

Is there anything a user could do to switch a common "corporate laptop" profile, either manually (set this resolution, these fonts, etc) or via an extension.

I know about Privacy Badger and they provide some protection but not from all fingerprinting. Their statement about is:

https://privacybadger.org/#Does-Privacy-Badger-prevent-finge...

---

Privacy Badger can detect canvas based fingerprinting, and will block third party domains that use it. Detection of other forms of fingerprinting and protections against first-party fingerprinting are ongoing projects.

---

You could potentially run some sort of "guest account" on your OS that is wiped clean on logout.

Tor Browser is trying to do something like this, even going so far to restrict viewport resolutions to some common multiple, leaving you with black bars for the remaining space.

> The best way to hide your fingerprint is to be as similar to everyone as possible.

Ironically, this also means you should not enable your browser's "Do not track" preference.

Right. In the best of worlds, websites should of course respect the "Do Not Track".

DNT was an entirely pointless idea. Given the easy choice, no one wants to be tracked when not being tracked is an option so browsers rightfully started making it the default since its what everyone wants. But no tracker is going to think, gee, no one wants me to track, guess I'll shut down my business so they ignore the marker or use it as another tracking point.

I don't think it matters, roughly half of browsers have it on and half have it off. The most important thing is to not change it from its default since thats the real marker trackers can use.

How did you validate this research? It is not like companies that do profiling do that in the open, in verifiable manner.

Also, weird you mention dvorak. I know this is just a hyperbole for the joke of being an easy to identify linux hacker... but keymap is the one thing you can't use for fingerprinting... well, you are able to use the language (by detecting typed in keycodes and matching against a mimum denominator of keymaps) but not the keymap itself (e.g. no way to see qwerty-US vs dvorak-US, but easy to detect -US vs -DE for example)

If a person's typing you could probably figure the keymap using timing between keystrokes.

I don't know how effective it is, but Firefox has some basic protection (and an experimental one): https://support.mozilla.org/en-US/kb/firefox-protection-agai...

The thing that's annoying about this is that some sites trust the browser's report of your timezone and don't let you change it.

When I tried enabling this, Slack, despite having timezone settings in the preferences dialog, showed me message timestamps in UTC, and there was no way to change it.

Thanks to this, I have gotten used to my time being in UTC. I even changed my system timezone to UTC.

The goal should not be to not be fingerprinted since that is a data point in itself, rather the goal should be to appear as a different browser after a short amount of time. There are extensions for Firefox that generate a new "fingerprint" periodically, e.g. 5 mins, for canvas, fonts, audio. Technically they don't generate the actual fingerprint, they add noise to the information that trackers use to generate the fingerprint.

So even if your fingerprint is unique, it would be a new unique fingerprint every 5 minutes. Maybe there's a logical fault with this plan, but, so far, I'm not seeing it.

What's the extension name?

It's not one, but several: Canvas Defender, Font Fingerprint Defender, AudioContext Fingerprint Defender.

Facebook provides a way for advertisers to pass back non-deterimnistic and PII signals to match users offsite of Facebook. ie. without cookies, server-to-server https://developers.facebook.com/docs/marketing-api/conversio...

How does this stop facebook from tracking you? I'm fairly certain that on facebook, google, everyone, etc tracking is largely through processing request logs to gstatic.com or fbcdn.net for example with a referrer header saying what site you are visiting, your source IP and various other things to fingerprint the request.

> various other things to fingerprint the request

Isn't this exactly how it prevents FB from tracking you? Those "various other things" that it uses will all be different between different containers. I think the source IP thing is a valid point, which is why other commenters have pointed out that you can force your FB container to connect through a proxy, while your other containers don't.

Timestamps, IP, and user agent are probably enough to reconstruct the user visit. Chrome is now sending a browser generated fingerprint x-client-data to all Google's domains while of course they will be trying to end use of referer header for everyone else. They are shameless and think people are dumb.

Mobile carriers are injecting their own fingerprint headers into outgoing http requests as well if not using https.

TIL about x-client-data. It looks even worse than user-agent, it's completely unique per user.

I think you mean user-agent rather than referer?

I have the same question and I agree. Combination of IP, timestamp, fonts, user-agent, screen-size ... can identify you so only advantage I see is that if you have multiple accounts you could log to all of them. Correct?

I've been using containers on Firefox for a long time now. And I love it.

But my biggest issue is Firefox performance on MacOS. The only reason it's not my primary browser is because Safari is just so much better.

What I wonder is, is this just me, or does everyone have this problem?

I use Firefox on Mac, but I don't notice any performance hits. At least not compared to Chrome, or browsers on other operating systems. I don't use Safari so maybe I don't know what I'm missing out on.

What performance issues specifically do you notice?

The two main things I notice:

Some websites basically crash the computer on Firefox but run fine on Safari. Mostly JS heavy sites.

The energy usage of Firefox is way higher than Safari, which in turns makes my fans spin a lot harder. Basically some sites will peg the CPU and hit max fan speed, but the same site just sips energy on Safari.

Video streaming is a prime example of this. I can use twitch on Safari and it uses maybe 30% CPU. Twitch on Firefox uses 150% CPU.

> Some websites basically crash the computer

What does "crash the computer" mean? Do you get the MacOS equivalent of a BSOD?

Disclaimer: Firefox is my daily driver. There are sites that just make FF spike its CPU usage, I guess through rogue JS, and if you let them run they’ll make macOS stutter (this on a beefy 2016 mbp). Sadly, some of these are big names like new Reddit and new Facebook.

Are you running any adblockers? I haven't experienced this personally on newer and older mac hardware than your rig.

Yes - uBlock Origin and Disconnect.

Everything freezes, I can't use move the mouse. If I wait, sometimes I can hit Cmd-W and get the tab to close eventually, sometimes I literally have to do a hard power off.

I haven't experienced this on my 2020 macbook nor my 2012 macbook. Care to link an example of some heavy javascript?

I don't keep track of which sites do it, and it's fairly infrequent, but if I happen across an example I'll let you know.

That sounds like it could be that you're running out of memory.

Open the Activity Monitor, switch to the Memory tab, and watch the Memory Pressure graph as well as Memory Used. If memory pressure isn't green, or memory used is close to Physical Memory, you're using too much. In that state, the whole MacOS GUI can become rather unresponsive, fitting your description.

I agree with the sibling comment, what you are describing sounds like you are running out of RAM. This happens to me with Firefox on a PC with 64GB of RAM and the cursor gets janky and I have to wait until some poor process gets killed and the PC becomes interactive again and I can restart Firefox.

> Video streaming is a prime example of this. I can use twitch on Safari and it uses maybe 30% CPU. Twitch on Firefox uses 150% CPU.

I concur - Firefox consistently uses higher CPU than Safari in my experience too. "Idle page" CPU when nothing is apparently happening but it's draining the battery anyway is higher with Firefox and annoying.

With the exception of LinkedIn, oddly.

Safari uses 105% CPU consistently when a LinkedIn tab is in the foreground.

I use Firefox on Macbook 13 (2017) mainly because performance is significantly better for me compared to Chrome and even Safari.

I've literally never had someone say Safari is better. Chromium, sure...but Safari? It's like the IE of the browser world these days.

Battery usage and smoothness of transitions on back button. In those areas Safari is unbeatable, for obvious reasons.

But yes, overall it is such an inferior browser, kept forcefully relevant by the iPhone alone.

That sounds more like the result of a filter bubble than reality. Safari is the default browser on a lot of Macs, but those users don't comment on HN about using it. It would also be useful if you described the properties of Safari that make it "IE" to you, since it's hard to discern what that means otherwise.

Safari is very much like IE. The best part is they don't even allow you to install an alternative to iOS so you end up with people on older ipads who are unable to install an up to date rendering engine.

I use Safari as my general browser, mostly for following links from HN and reddit. The AdBlocking works well enough, and I don't really log into anything from Safari. I also use it for Twitch streaming since it's so much more stable. For those use cases, it is superior to both Chrome and Firefox.

I use Chrome for Google apps. Gmail, GCal, etc.

I use Firefox for work and isolation. So I use containers to keep all my AWS logins/consoles separate, I use it for Github, I use it for my own internal apps and dev (and all the dev tools). If for some reason I need to do Facebook or Insta I do it in FF, and it's isolated into its own container.

Firefox is also my default browser, so if I click a link in another app, it'll open in a container in Firefox.

Here you go: Safari is a great browser for users.

The only thing that kept me away all of these years is the lack of extensions and because I’m used to Chrome’s developer tools.

Firefox is the worst browser in literally every way except for the containers. Everything else feels hacked on compared to other browsers. Just compare Firefox’ reader mode to Safari. It’s night and day. Firefox’ feels hacked on.

As a developer I hate Safari, but as a user it’s everything a browser should be. With Translations coming in Big Sur it doesn’t have much to envy Chrome.

I haven't noticed a significant difference between safari and firefox in terms of performance, personally. I never had the browser feel like it's hung up or crash, honestly I don't think I've had a frozen browser window in years. Maybe it's because I run ublock origin and cut the pollution, though.

Not just you. Firefox is my main browser, but for a growing number of JS-heavy sites I've been using Safari instead. These are not necessarily ad-ridden either, but rather interactive apps (Jira, Whimsical, etc.) were FF is getting super laggy and it's a real distraction. Sad how much faster Chrome and Safari behave on them :/. This is on a new 2020 MBP with plenty of RAM.

While I appreciate this kind of solutions, in my brain all I can think is: what the hell is wrong with the web today?

I mean, what did we do to ourselves? How the hell did we ruin the web experience this much?

Looking back in the 90s, the web wasn't the most pretty thing but how simple it was. You went to a news website and that was it. Click, read, the end.

These days however:

- Go to a news/content website

- wait for the 40MB of useless CSS and JS "minified" crap to download.

- Agree with 2 or 3 huge popups to allow collect your data

- Get a new popup to make you disable your ad-blocker plugin. And if you disable it, you need to refresh the page all over again.

- Get a "subscribe to our newsletter" popup

- Get tracked by amazons, facebooks, etc...

- And once you finally click on an article.... get another popup to subscribe to their premium paid content...

Seriously, we broke the web, and now we are trying to fix it with putting more plugins and tools on top of this problem. I just feel the web is fighting against us and our browsers, and in the end everyone will loose.

It's the consequence of decades worth of monetization of as much of the internet as possible, fighting against ad saturation/blocking by the users.

Additionally, web browsers were never built for easy monetization of web content; being under the control of the end user.

I tried containers for a while, but I didn't really trust the separation, and I also wanted the browser to be separated from my regular homedir/user.

So now I have a script to create/remove new UNIX users with a pre-configured firefox profile and a script to run the firefox under that user.

It has some quirks, but also some benefits. Mainly that the browser doesn't have access to all files on my computer, and the separation between profiles is enforced by the OS, which I trust more.

I'm loving Firefox Containers for various use cases, but is running Google/Facebook in them worth the extra hassle if you use uBO/Privacy Badger? It blocks all that stuff anyway.

uBO barely works on facebook these days. Try and use the element picker.

What do you mean? I just visited a site and uBO blocked FB fine.

As in, it doesn't block most stuff automatically. You need to pick them using the element picker manually. And even that doesn't stick all the time.

Are you talking about stuff on the Facebook website? I'm talking about blocking Facebook tracking on other sites.

I was talking about on the facebook website.

I think that one of you is talking about network filters and the other is talking about cosmetic filters. Cosmetic filters are a bit hard right now, due to Facebooks effort to obscure them. Network filters are as easy and as reliable as ever though.

Remove the Stories and "Video chat" widgets that take up so much of the top of the page:

www.facebook.com##div[aria-label="Stories"]

www.facebook.com##div[data-pagelet="Stories"]

www.facebook.com##div[data-pagelet="VideoChatHomeUnit"]

Have you looked at FBPurity?

I was pretty "meh" on containers until I put in a bit of effort to set them up. Flagging certain domains to always open in a specific tab category took a bit to work through on the common sites I visit, but now that its all set up I think its great.

Is it better than uBO? If so, how?

You can use both. They each solve a set of problems that only overlap partially.

You might be able to escape facebook using ublock, but you're going to have trouble escaping google. It's everywhere: youtube embeds, google cdn (for scripts/fonts), google maps embeds/autocomplete, recaptcha.

Do these embeds matter if you block 3rd party cookies and don't click on the embedded content?

The embed should still get access to its first party cookies, so yes.

They're worth it for me just so I don't have to use the Google account switcher.

uBO/PB make you much easier to fingerprint uniquely due to not loading advertising content on all web requests, which could be considered harmful in a scenario where you don't want to be tracked. Facebook Containers extension offers the same fingerprint as "doesn't have a Facebook account and uses a browser that blocks tracking by default" outside of the container, which is far less unique these days than it used to be.

Note that this doesn't diminish the effectiveness of uBO/PB at blocking requests — but I think most of their users don't realize how much easier it is to identify who uBO/PB users are, relative to the rest of the world on less obvious setups.

maybe someone needs to make a spoofer extention of a factory fresh laptop

I have a use case where I'm using 6 different amazon accounts which I'd have loved to use with containers controlled by bookmarks (I use Firefox keyword bookmarks a lot for productivity).

The best out of the box way you could do it with Firefox is to setup different profiles and switch between them, however, while there is a many-to-many relationship between website and containers, there is none between bookmarks and containers, thus you'd have to manually switch to the right container.

My workaround for this was to setup a thin server that redirects amazon<\d+>.localhost to amazon.com. Then, on Firefox, I bind each amazon(1-6).localhost to its own container and configure it to always open this site in its container. Now every time I type "amazon2" it will open up amazon.com in its right container.

Would have wished to have bookmarks granularity as part of Firefox, but for my use case, this is the best I could come up with in few minutes of work.

I absolutely love the containers feature in general, and the Facebook one in particular.

One severe use case limitation (for me) involves using containers to separate work/home accounts. I am a developer, so I do a lot of screen sharing / presenting.

Theoretically, I could use Firefox containers to separate things into "work" and "personal."

However, all containers have a shared autocomplete history for the URL bar.

1. Suppose I visit "GirlsXXX.com" in my "Personal" container 2. The next day at work, I am screen-sharing and using my "Work" container 3. I type in "github.com" so that I can visit Github.com 4. As I type "g-i-t-h-u-b", "GirlsXXX.com" will be one of the autocomplete suggestions after I've types "g" and "gi"

To be fair, both Girls and Git have the concept of commitment. And I've got an extensive .girlsignore file. But under no circumstances should a push be tried on the former, especially if a gentle pull does not succeed.

don't quit your day job ;)

I keep all job related stuff in separate desktop VM and only ever share that window over Zoom/MSTeams/Slack on the host system (better native pref). No surprises in years.

Looking forward to a Google Container

I use https://addons.mozilla.org/en-US/firefox/addon/google-contai... for a year now. Works as expected.

https://addons.mozilla.org/en-US/firefox/addon/multi-account...

You're welcome.

The reason Facebook Container exists is because the UX of the generic version is awful. Trying to created a new container to always open a site with has something like half a dozen steps.

And of course we won't get a dedicated 'Google Container' from Mozilla because despite all their hot talk they know what side their bread is buttered on.

"ctrl + ." or just click the container button on the top right

Select "always open this site in".

You're missing quite a few steps. I just ran through this process to ensure I didn't miss anything:

1) Visit the site.

2) Click the container button or use the shortcut.

3) Click 'Manage Containers'

4) Click 'New Container'

5) Name the container, click 'Ok'

6) Open the multi-account containers panel again.

7) Click 'Always Open This Site in...'

8) Select your new container.

But wait, you're still not done!

9) Open the site again in a new tab.

10) Check the 'Remember my decision for this site' box. (Didn't I already tell it to ALWAYS open the site in that container, in step 7?)

11) Click 'Open in [your container] Container'

That's how you create a new container to always open a site in with the Multi-Account Containers extension.

Mozilla gets too much Google money to do that. I've asked for them to do a first party extension for this, and they have "no plans" to do so.

Unfortunately, I don't trust a third party extension with this either.

If you don't trust a third party, how about creating your own? That should provide an answer for your trust issues.

This could be said for most of one's software stack, but there's only so much time in a day.

I solved this another way. Last week I #deletefacebook :) ..so long and thanks for all the fish

Don't they still track people even without an account?

If you enable the First-Party Isolation preference in about:config then this is more effective site isolation and is automatic for all sites.

Are there downsides to this? Settings aren't usually hidden in about:config without a reason

Do you use this for every day browsing? Does it break anything?

Yes.No, it does not break anything for me, and I browse a ton of websites.

I already do this manually using Profiles/People in Chrome. Containers look much better and more seamless though.

I wonder, does this fix the Google reCAPTCHA problem with using multiple browser profiles?

Yeah, I've tried to do the multi-profile thing in Chrome and always ended up giving up in disgust after a while because the UX is hard to deal with. Lately I've just been using different browsers for different "profiles" (social media, work, general internet browsing, etc) with. Between Safari, Chrome, Chrome Canary, FF, FF Nightly you can have a lot of different "profiles" and using something like https://www.choosyosx.com the day-to-day UX is not bad.

I tried creating an account this way, but it promptly got banned, with no ability to appeal.

I guess they don't want my business. Good thing I gave it a few days before connecting the Quest.

I wish we have the same for Android apps as well. I don't want random Apps to have full access to my storage instead it can have it's own space.

And a special Inbox folder with a sticky bit where other apps could put their files to open in that app.

Is there anything like this to stop (or minimize) Amazon from increasing prices based on the max they think I'll pay?

I just got an alert saying my recent Amazon purchase "May have been lost in transit". I went to place a duplicate order only to find each product's price ~15% higher than when I placed my original order. Such a dirtbag pricing strategy....they should call it the monopoly algorithm

Anyone know if there's an integration with Tree Style Tabs[0]? They're a gamechanger for browsing the web, and it'd be nice to see what tabs are contained.

[0]: https://addons.mozilla.org/en-US/firefox/addon/tree-style-ta...

Itll show a color next to the tab to indicate that its in a container

In addition to showing the container color, the context menu options to reopen a tab in a container work just fine with tree style tabs.

I switched my sidebar tab add-on to Sidebery [0], and that's actually what got me to start using containers (not the other way around).

I have a 'home' container (= sidebar 'tab' of tabs), 'personal code' container (ditto), 'finance' (ditto), and 'work' (ditto). It's not even really that I want to silo their data from each other (I have uMatrix - yes I know, will probably switch to nuTensor - and autocookie delete etc. anyway) - but the organisation into contexts I can easily switch between is amazing.

[0]: https://github.com/mbnuqw/sidebery

I think you want Container Tabs Sidebar:

https://addons.mozilla.org/en-US/firefox/addon/container-tab...

Is this possible to request data facebook (potentially) have on you, even if you don't have an account? (I deleted mine about 5 years ago...)

Answering my own question: Yes you can -> https://www.facebook.com/help/contact/2032834846972583

that's a useful link. is similar link from other giants like google?

Speaking of Firefox containers, I created an extension that adds an extra layer of convenience. The extension lets you create a default page for each container; something like a homepage for each container. It’s called‘Container Default Pages’ [0]

One thing the Multi-Account-Container does is allow you to redirect a website to open in a specific container. My extension gives the extra feature of assigning the container itself to a default website.

The main use case is when you have a container dedicated to say, YouTube, it makes sense that when you open a new tab in your ‘YouTube Container’ it should go directly to YouTube. Of course you can open other things but the extension provides a convenient default behavior.

[0] https://addons.mozilla.org/en-US/firefox/addon/container-def...

Since this is the major advantage and draw of using firefox this should be default and not an extension

I've already moved most of my immediate family over to Firefox. Would save me from having to do the Facebook rant each year.

I recently switched to Edge on my iphone because it has adblock by default. Firefox doesn't have the adblocking ability. Then, I switched to Edge on my MacOS as well because I want to maintain my bookmarks sync between the 2 devices.

I would definitely go back to Firefox if it has adblock in iOS.

The best adblocking extension is uBlock origin and is available on Firefox Android and desktop. I can't speak for iOS though.

Firefox iOS has a "Tracking Protection" feature which will block ads that do more aggressive tracking. It's on by default but I recommend toggling it onto strict mode for best results. You can also use Firefox Focus to apply the same functionality to the default Safari browser.

The thing with the most potential on iOS is Lockdown, a local-only firewall which filters network connections from any application. It'll break apps like Facebook Messenger if you turn on all the options. But again, it's focused on trackers, not ads specifically.

I use ungoogled chromium but I have a script that completely replaces my .config/chromium/ directory with a clean version saved with no cookies/history or anything else saved. that means I can basically roll back any stuff that I do. to update the config (eg for bookmark adding) I just replace the stored clean version with a new clean version created. I have my workflow integrated with starting on the internet with a "clean slate". yes things take a bit longer being signed out but using a password manager mitigates this somewhat. I have never had a problem with resetting my config and have been using the design for at least 2 years worth of chrome updates (with a few " resets" of my safe config)

I love the general idea behind the container (sandboxed browsing). However, I'm not clear on the exact privacy benefit relative to the much easier path of blocking 3rd party cookies in your browser of choice and installing uBlock Origin. What specific tracking is no longer possible using containers that is currently possible if you're using one or both of those protections?

Is it something about 3rd party scripts that uBlock Origin doesn't block by default and that don't require 3rd party cookies?

I'm not looking for a general answer about containment or sandboxing or a nice user experience for separating environments or profiles; I'm looking for a precise attack/tracking vector that makes this worth switching browsers for.

It's my understanding that if you're logged into Facebook and visit a website that uses Facebook's APIs (the Like button etc) then your pageview will get tied to your profile. Even if you don't actually interact with it in any way.

If you isolate your session with Facebook container then they can only tie your pageviews to an anonymous profile and will have a much harder time tracking you across devices, connections, etc.

Here is an example. This page [1] has stuff from google loaded that is not blocked by a combination of Ublock Origin and Privacy Badger; for instance google fonts (other stuff from Google, Twitter and Facebook is blocked). If I ever log into Google, then my activity on this page will be linked to my account. If I containarize my Google account, then I guess Google can only use my IP or very advanced tricks to attach this activity to my account.

[1] https://www.sportsbettingdime.com/news/nfl/week-7-opening-li...

> or very advanced tricks

Like those: https://panopticlick.eff.org.

That's helpful, thanks. Now I'm curious to learn more about embed security as it relates to 3p cookies.

Just FYI, I installed this and immediately got trapped in a login loop in Facebook.

I got logged out of Facebook after installing it (either by the extension or by FB) and then when I log back in FB asks me to "complete the following steps to regain access to your account" with a button that brings me to an error page. They also mention that this behavior was triggered by me having 2FA enabled on my Facebook account.

So I'm interested but beware right now (especially 2FA people).

Edit 2: This was resolved by using the FB app to verify logins and restored my access in firefox.

> puts people over profit to give everyone more power online.

The elephant in the room is the default Google integration in Firefox, I guess? They don't speak too much about that kind of tracking.

I'm confused here about two things, and can't find any answers in the comments.

1) How is this different from a regular Firefox container you use for Facebook?

2) Firefox containers are essentially the same as Chrome profiles, right?

I'm just trying to figure out what benefit this has over someone keeping Facebook inside a separate profile in Chrome. If Mozilla's trying to attract people from Chrome... I feel like they need to be a bit clearer on what precisely Mozilla provides that Chrome doesn't?

For 1: I'm pretty sure the regular firefox containers are an extension of the Facebook container. As I recall, Firefox first rolled out the Facebook container for Facebook + Instagram, and then later rolled out Multi-account containers which allowed user defined rules for custom containers

For 2: I'm not familiar with Chrome profiles, but Firefox has profiles as well. And with Firefox you can set up different container settings for different profiles. So you can have container settings for a "Home" profile and a separate container settings for a "Work" profile

The feature that has kept me from switching to Firefox is history archiving. I like to keep a record of my browsing history using Chromium's “History Trends Unlimited” extension to easily find articles previously read. However, Firefox appears to only record the most recent site access date and there's no similar extension. Does anyone know of an alternative?

Safari has this figured out from a UX point-of-view with their concept of “website settings”. I wish other browsers would steal this idea and run with it because “containers” and “switching profiles” doesn’t mean much to users or isn’t the best experience.

If you haven’t in a while, go check out “Settings for websites” on Safari desktop and mobile. It’s some pretty sane and reasonable stuff.

What’s the way to set this up for custom domains? I basically only want to be logged into my mail, Facebook HN and twitch (and they don’t need to share tracking cookies) and have everything else happen in a no-cookies stored environment.

But do I need a container extension for each of those sites or what is the deal here? And do I exit the container when I click a link to another domain?

multi account containers. it allows you to create containers and automatically open sites in them.

There's the Multi-Account Containers addon for this: https://addons.mozilla.org/en-US/firefox/addon/multi-account...

And also the Temporary Containers addon if you want cookies, local storage, and history cleared automatically: https://addons.mozilla.org/en-US/firefox/addon/temporary-con...

I've been using Multi Account Containers for a while now (years probably) and they do provide good value but things can still be improved. What I think Firefox lacks right now is good UX around switching profiles. Sure `about:profiles` works, but it's hard to access, looks ugly, and prone to miss-clicking.

Here is my workflow:

- Normal browsing: not logged in, no containers.

- YouTube: have an "Entertainment" container for it and use it logged out since Google signs you on all their property, and I don't want to mix my entertainment history with my educational history.

- Social media: have a "Social" container where I access all the data harvesters.

- Logged in: For anything that I need to be signed up, a "Personal" container, so I can check my email in peace.

- Work: here's the catch, this needs it's own profile. Since "YouTube" is set to always open in the "Entertainment" account, and I don't want work related videos pop up when relaxing, and vice-versa, I can switch profiles and have everything completely isolated in my "Work" profile. And in case I need to, I can set up more containers in this profile. Also there are different add-ons I need for my own setup compared to work, or the same add-on with different configuration. So just containers won't do here.

My point is, if Firefox had a profile switcher as easy to use as Chromium had, my life would be way better. Profiles and Containers seem to complement each other. They just need a truckload of polish.

Some things that annoy me right now:

- There is no dedicated UI for profile CRUD. And an add-on won't work for this since it needs to be available and enabled by default across profiles.

- "Reopen in container" opens a new tab instead of replacing the current.

- Having keybindings for the two above would be extremely useful.

- For some reason, Firefox lacks the functionality to change the ordering of stuff (in general, but more specifically profiles and containers). The creation order is all you get.

- A quick way to do "clear cookies/data in this container only" so I don't need to delete/recreate the container and mess up my ordering (which I can not change). Also clear data for non container use without clearing data in containers. Basically treating non container use as a "Default" container.

- All of the above I wish came by default with Firefox and not from an add-on. My honest opinion is that they are crucial functionality and deserve to be made aesthetically pleasing and available for everyone to use.

The ability to use plugins easily on mobile phone. That's why I choose firefox

Except they limited it with recent Firefox Mobile "updates" or "redesigns". AFAIK the last fully-featured FF Mobile on Android is 68.12.0. I have tried the most recent FF Mobile couple of weeks ago and there were only a small subset of add-ons supported and still no about:config.

yeah, I wonder when the Facebook container will make it to mobile - it's one of their own after all so there should be no safety issue.

On the one hand, I've been using Facebook exclusively in Incognito/Private mode for years. On the other hand, I haven't logged into Facebook for months. Maybe just because of the upcoming election though.

Why do we need it, given we already have containers built-in (I mean in Firefox)?

Tools like this are useful for those suffering from Facebook Stockholm syndrome.

I've been using this, but it seems to break any sites that use facebook login, so it's pretty annoying to have to disable the extension whenever I need to login to a site that only has facebook login.

There isn't much point to using the Facebook container if you're using FB login in enough places that you get annoyed by it.

Facebook Container dev here. It breaks those sites because the extension blocks all Facebook resources (and tracking) from loading on non-Facebook sites.

To use Facebook login on a site, you'll need to add the website to the Facebook Container. Follow the directions from the docs[1]. This will stop you from having to turn the extension on and off entirely.

[1] https://github.com/mozilla/contain-facebook/blob/master/docs...

This plugin is for increasing privacy. If you're using FB login on non-FB websites, you've already given up your privacy.

Other than convenience, what, if anything, do containers have over doing what I do - always opening a private window/incognito in Chrome, go to facebook and log in?

Primarily, it's not 'other than convenience', because that's huge.

But to actually answer: you can remember cookies etc., they're just only accessible within that container silo, versus private/incognito windows where they're deleted (by design) when you close that tab.

You can only open one private session, you can have as many containers as you want. With the caveat that you can probably spawn multiple chrome sessions each with a different profile, but then each session will have it's own bespoke config and (lack of) extensions.

I dearly wish that I was able to purge cookies/local storage on a per-container basis.

Persistence. If you log into a website in a container, cookies will be stored locally within the context of the container. Those cookies can't be used to track you on other sites outside the container, but they do fulfill their purpose within the container.

Isn't this old news? I was using Firefox Facebook container for quite some time before I closed out my Facebook account, and that was some time ago.

It is a great feature.

Why stop at just Facebook? What about Google, Doubleclick, Disqus, Google Analytics, Twitter and all the others that have embedded widgets all over the web?

https://addons.mozilla.org/en-US/firefox/addon/multi-account...

Do you still need Facebook container if you use Multi-Account Container? This is confusing. I haven't used Firefox in years but the idea of containers sounds awesome. I just wish the UI was a little less confusing.

No. Facebook container is basically a fork of multi account container that only quarantines facebook. It's meant for less technical people who might not want to set up their own filtering rules on multi account container.

Is it possible to set privacy settings per container (keep cookies or not, delete history), or is that still a universal switch for every tab?

Presumably if Facebook really wanted to track you they could associate requests from the same IP and request signature (user-agent/accepts etc)

This doesn't work as well though for things like university campuses or large companies where many people may be using a single IP and identical hardware.

I would bet $100 FB does geolocate your IP to determine if it's likely a single residence or a larger multi-user building, and likely tracks that, but that misses a large chunk of their user base.

Imagine the number of people who use FB as a distraction at work or in class, but might not use it as much at home.

Do the containers and their settings sync across devices as part of Firefox Sync? Last time I tried them, I had to recreate them on each device.

Yes since version 6.2 from February: https://addons.mozilla.org/en-US/firefox/addon/multi-account...

I love Firefox containers. Can also recommend cookie auto-delete. It's honestly not that bad if you whitelist sites you use a lot.

> "The Facebook Container Extension is currently only available for Firefox for Desktop."

I hope this comes to Firefox for Android soon!

I don’t use FB but I use the container feature; I keep streaming, social media, banking, separate, for example. And shopping.

Be aware that using this container will prevent websites from displaying Instagram embedded content and things like that.

Nice. I use Firefox as my FB container (all the other web activity happens in Chrome). This is good to see.

How does the container extension work? Is this just masking browser signatures or something else?

Would there be any downsides to Firefox putting every website in its own container by default?

If they have this ability, why doesn't every website get its own 'container tab'?

By default? It can break a lot things that people expect to work and can make browsing the web slightly more annoying (harder recapcthas etc). You can enable first-party site isolation in your Firefox preferences which will effectively provider a container for each site (as far as I understand). But it's pretty annoying at times.

In terms of cookies that's effectively the same yes.

To deal with the annoying breaks, assuming the fix you want is 'just make it work', there's at least one add-on available that just gives you a toolbar button to toggle it on or off, a fish bowl that glows red as a warning when off.

This is effectively first party isolation. It's buried in about:config as it breaks too many sites apparently

Just easier to stop using Facebook.

If you find ceasing all use of Facebook easier than installing an extension in Firefox, you're probably part of a very small minority.

Isn't it tracking you anyway with all these Like(TM) buttons spread around?

We shouldn’t need to engineer around this. The fact this is needed shows Facebook wrongdoing.

> The Facebook Container Extension is currently only available for Firefox for Desktop.

Is there any way to stop recording browsing history for a particular container?

There are still other ways they can identify you based on typing and mouse movement patterns or other heuristics and fingerprinting techniques. Or they can purchase this information from one of the many 3rd party adtech companies that are also tracking and building shadow profiles on people.

I Wish sites could be opened in specific containers via bookmarks

Can it open facebook as an SSB (chrome like desktop app)?

I've been using this for a while... would recommend!

the only reason I still use chrome is for my mac's fingerprint reader as 2FA for work systems.

there's been a firefox ticket open for this for a while now.

Is there anything similar for Chromium-based browsers?

Closest thing I know about is the built-in "people" feature.

I use the SessionBox extension and let chrome remove all cookies at shutdown.

This is like finding a technique that will make it safer for your kids to play with the creepy neighbor.

You may be better off not playing with the creepy neighbor.

What is new? Why is this posted now?

I proudly give them all my data, I want big tech to make money and get better products.

It's not just tech making money The data companies collect is valuable because it can be used against you. It's not just so that companies can show you ads for things you might be interested in. Surveillance capitalism means that your health insurance rates can increase because big data shows that people in your zip code eat out more often. The data collected is used to create a secret "consumer credit score" which determines things like how long you wait on hold, what stores will tell you their return policy is (their policies for you are not their policies for everyone else) and can mean you're paying more for identical products at the same website than the person next door. If you want companies to make money there are plenty of ways for them to do that without handing over your personal information which will be used for years to secretly exploit and manipulate you in ways you'll never even be aware of.

I proudly lick the boot of master, it tastes strong like leather.

Only for desktop :(

Sorry but isn't this trivial to circumvent. Hire me Facebook. I'll get you the usual data back in a day or so.

EDIT: I am confused why nobody sees the obvious.

Reply on news.ycombinator.com