Hacker News Reader

Comment by rplnt | Hacker News Reader

Is there a browser extension (or browser) that could either open each new tab "clean" (no cookies or anything) or even better lock it on the first domain visited?

Example:

I open a new tab with example.com, and with this a new session would be created which only contains data relevant to example.com. Anything I open later on in this tab won't see anything else. I can always open link in a new tab to start a "relevant" session (though that would require browser that can work with tabs, i.e. not Chrome).

View on HN

Most browsers have a setting to disable 'third party cookies' - e.g. if you're on www.evil.com and that page sends a request to www.example.com the example.com connection won't send cookies, or store received cookies.

You can set this up easily in Firefox [1] and Chrome [2]. It will break a handful of things, for example some sites embed comments from facebook, disqus, google+ etc. So for example when you visit www.youtube.com you won't be able to comment, as comments are in iframe loaded from plus.google.com which you can't log into without third party cookies enabled.

IMHO this is no great loss, and I block third party cookies all the time.

Of course, it's still possible to do certain attacks by redirecting the entire browser window or opening a popup window.

[1] https://support.mozilla.org/en-US/kb/disable-third-party-coo... [2] https://support.google.com/chrome/answer/95647?hl=en-GB

What will I do without my YouTube comments?? /s

In all seriousness I blocked Third Party Cookies in Chrome and never looked back. Nothing of value was lost.

I did this after I learned that Safari on iOS does this by default. If in all of my usage of my phone browser I didn't run into issues, I don't see why I should on the desktop.

Developers often make special exceptions for iPhones that they won't make for e.g. linux users.

How so? You can't really get around not using third party cookies by doing something different, and if you can, are you really going to detect the device type rather than whether the UA accepted third party cookies? I guess anything is possible. All I know is that turning off third party cookies has not affected me in any way over the past three months. Then again, I block advertisers at DNS and via ABP, and they are the main user of third party cookies, so I guess you could say that the ads didn't properly work for me for a while.

Yup, I made a browser that did that and used it for a while, did even one better. Rather than per tab it was flexible and by default it was locked to the domain you were on. I created an experimental browser with as much new stuff as I could, but sadly users don't care that much. I mean just look at Chrome and how horrible the history control for users is. Even really basic stuff like delete every history entry from site X or for the last N minutes is missing. Where is the outrage?

If anyone is interested, here is a much more fleshed out description of what a next generation browser could have: http://benjamin-meyer.blogspot.com/2009/08/next-generation-d... If a company out there is looking to see some browser R&D work done send me an email.

I just skipped through it quickly, but have it opened in a tab to read later :P

For some bookmarks/history and window/tab management I recommend checking old Opera (<=12). I'd argue it's still the best browser when it comes to UI/UX, unfortunately it's dead[1] and not really usable nowadays. For no-url experience, see Yandex Alpha[2].

1. there's an open source project to get that feel back http://otter-browser.org/ (not quite possible without touching the Blink)

2. http://browser.yandex.com/future/

Yeah I have played around with those and either written myself or been part of a team that wrote at least a half dozen browsers that were released and dozens of little R&D browsers. I have also seen many many browsers that offer very little beyond Chrome/Firefox come and go. Yes they might have a very good idea, but it is not enough to get someone to change browsers. A tweak, climbing higher up the local hill, but not fundamentally changing the game. A few of the big points in the article I wrote have to do with the idea that private browsing as known today is flat out wrong and not what users want, having a split view, and robust local access control. Living with a hacked up browser for a month that did these really showed that they were a big deal. But alas after an acquisition my new (former) employer forbid me from working on it so it had to be shelved. But even today I don't know if what I wrote about is going far enough. For most users browsers are like internet speed. The important thing isn't what speed you are connecting, but that you are connected period.

Unfortunately (or fortunately depending on how you look at it) it isn't 2004 where almost no browser development was occurring and you could have something "new" like Firefox come to light and grow quickly with very little features against almost no competition. These days you have many large companies funding development teams to keep what we have today working and make marginally better each day. To make a new browser you can't just take Chrome and tack on a tiny tweak you need step changes. That is what my 2009 article was about and with a few more years of thought and experienced that is what I have been messing around with lately, making a browser where users abandon Chrome/FireFox/IE not because it is a tiny bit better because it is so better it isn't about switching, but about moving to a different product.

Chrome supports multiple users pretty well, but it's per-window not per-tab. (I think that might be better anyway, it seems like it would be easy to lose track of which tab is logged into what)

Do you just mean the "incognito" feature, or is there another way that Chrome deals with "multiple users" (multiple sets of cookies?), cause if there is I'm interested!

Chrome added the concept of different user profiles recently, there's more info here: https://support.google.com/chrome/answer/2364824?hl=en-GB

Indeed and once you enable it, it's very easy to switch between profiles. It's one feature I miss since switching back to firefox.

> It's one feature I miss since switching back to firefox.

You can use multiple profiles in Firefox. There is even an addon to make the switch easy: https://addons.mozilla.org/en-us/firefox/addon/profileswitch....

Do you still need to restart firefox to switch users (or switch accross all open windows at once), instead of being able to simultaneously have different users in different windows, like the new Chrome feature seems to do?

It's the simultaneous different 'users' (ie, cookie stores, mostly) in different windows that is exciting to me.

Firefox allows multiple profiles to be in use at once (in different windows). You need to pass the -no-remote flag when you start up the other profiles, or else the new firefox process just signals to the original to open a new window and then closes itself.

I'm using MultiFox now and it works, but it's not nearly as seamless. I'll give the addon a try.

Awesome, this is something I've wanted for a while and didn't realize Chrome had finally added it!

It lets you have different users in different windows simultaneously, or it makes you switch the entire environment all together?

Thanks!

I just so happened to see such a Firefox extension[1] announced[2] on planet.mozilla.org the other day, though it might be a bit more manual than you are envisioning, and I haven't personally tried it out, yet.

[1] https://addons.mozilla.org/en-US/firefox/addon/priv8/

[2] http://143th.net/post/105342885096

There's a Firefox extension called Priv8 [1] which is meant to do that.

However, given that FF doesn't have sandboxes and SOP is (AFAIK) the main isolation system, I wonder whether it's possible for one origin to somehow sniff the presence of different sessions in the same client via, say, some JS info leak.

[1] http://143th.net/post/105342885096/priv8-is-out

There is a suggestion for this on the Firefox Developer Tools uservoice

https://ffdevtools.uservoice.com/forums/246087-firefox-devel...

Doesn't "private navigation" work for this?

You can disable third-party cookies in most browsers.

that is a great idea. why hasn't any browser done this?

Reply on news.ycombinator.com