Yeah but you miss in the parallel session. Having several github and twitter accounts, it's very handy.

I never disconnect from anything, i just open a non container tab. I never connect to anything on my laptop, i open the site in the desired account container.

This website is in a state I don't want ? New container, and it's sees me as a new customer.

This doesn't work for me.

I have a "personal" container that I use for my Google/PayPal login, and sites that I use Google oauth with, same for a "work" container.

If each site used it's own container, I couldn't sign in with Google without signing in multiple times (let alone the mess of signing out old sessions, which I do once in a while).

Google logins still work, this is a different kind of container from the Firefox container tabs.

I use this feature with container tabs and it's fine. There are so far one or two sites I've come across that this breaks, neither of them anything I care about.

For those curious about how this actually works: https://bugzilla.mozilla.org/show_bug.cgi?id=1330467

Related: https://wiki.mozilla.org/Security/FirstPartyIsolation

It doesn't work all the time. I tried it with Google login on Atlassian, it seems to rely on third-party cookies, and fails. There are a few bugs open on websites that don't work with this feature:

https://wiki.mozilla.org/Security/FirstPartyIsolation#First_...

I assumed it didn't work because it was an Atlassian site I was logging in with. Thanks for pointing this out.

Container tabs works for me very well, so I don't see much point in switching over and dealing with little bugs like this.

Atlassian actually rely on referrer headers as well! Extensions such as smart referrer break their single SSO system.

Sorry, are you using `privacy.firstparty.isolate` or container tabs? I think SparkyMcUnicorn was saying the former would not work for them.

Both. I'm saying they work together fine, and isolate works fine with Google logins. It's not that strict.

My use case is multiple Google accounts. I can log in to multiple Google accounts at the same time in different containers and answer emails very easily.

You can be logged into multiple Google Accounts at the same time without the extension. Just click the little profile icon in the top right and click "Add Account."

I'm logged into four, including a Gapps account.

Have they fixed the issues though where some of their apps only work with the primary account you're logged in with? (e.g. the first one)

Google Play Console only works with your primary account.

Over the years they have definitely fixed those one by one, but I’m not sure if they’ve fixed all of them. I believe the last problematic one I encountered was some ads-related developer console a year or two ago.

They fixed the big ones but there are still a bunch of edge cases where you have to log out, like one account is from US and one is from Canada.

No. I use this feature daily, and have to login to my "primary" Google ID for my Drive/Calendar, then I "Add Account" to enable my secondary/tertiary ID's. It has to be in that order.

Good question, though the account isolation to the extent I've tested it has been surprisingly good.

I still don't fully trust it, but that's a different matter.

+1 deal with this all the time on spreadsheets ===== fixed

This would let Google know these accounts are affiliated with the same person on your network, whereas containers won't necessarily provide that assumption.

Right?

If they wanted to they could associate them other ways by just looking at the IP address and/or browser fingerprinting.

My thought is that they can certainly find good indicators that they're related, but that signing into them at the same time directly in their website confirms the relationship. Bear in mind, everything coming from say, a corporate network, won't be distinguishable by IP, and browser fingerprinting is likely less helpful in an environment with a hundred PCs running identical system images.

Your home device may not live in such a family, but it's hard for Google to determine that.

Even in a corporate network there's some plugin drift over time depending on job role especially for developers. And GP specifically has installed a container add-on which probably makes him/her fairly unique among all the corporate traffic coming from that IP/group of IPs.

Most good corporate environments should be controlling what plugins they allow users to install in their browsers. (For the few users we permit to use Chrome, for example, all extensions are disabled.)

But again, the issue is not your specific configuration (or GP's specific configuration), the point is that Google cannot assume same IP or browser fingerprint is a definitive association of identity, whereas signing in additional users in Google's app definitely does.

> Most good corporate environments should be controlling what plugins they allow users to install in their browsers.

For a very odd definition of the term 'good' I suppose that's may be the case. It's certainly not been in any place I've worked in the past 20 yrs.

I can't vouch for the security of any place you've worked in the past 20 years.

But suffice to say, it's very common for Chrome extensions to be able to both modify any content on websites you view and read data you enter into them. Both adware and spyware is prolific on the Chrome Web Store, and it's the number one infection vector I see.

Controlling extensions is downright basic competency for network security. With regards to Chrome, I currently operate an outright block, though obviously we can whitelist extensions as necessary. (One thing Chrome does particularly well is their ADMX templates: It's easy to blacklist and whitelist extensions, and install them compulsorily for users as well.)

Considering that I've spent 15 of the last of those 20 years working at cybersecurity companies, I can say with some degree of assuredness that your level of control over browser extensions goes far beyond the typical work environment, and that goes doubly so for companies based in silicon valley. Do you really think that all those engineers at Google/FB/Apple/etc can't install browser extensions?

I assume there is no hiding from Google unless you black-hole their IPs. Also, don't let an Android device with links to Google be near you.

It'd hard to ban Google from your life even if you want ti. I think governments should help citizens achieve that when they choose so.

If you browser fingerprint and uniquely identify someone in this scenario what is the GDPR rationale going to be?

I'm not sure if this is the same thing you are suggesting, but what I like to do is use the "Manage people" option from the menu at the top right. My work and home google accounts are never logged in at the same time in the same chrome window. It seems to keep everything separated pretty well, even extensions seem to maintain their own settings/"activated-ness" within each person/account.

On Chrome you have the SessionBox extension - https://sessionbox.io/discover

Why don't you use Thunderbird for multiple mail accounts? I cannot imagine using web interface for multiple email accounts, too much effort, taking my browser tab space. Thunderbird is right tool for it...

"... and then I discovered the privacy.firstparty.isolate option (in about:config), which effectively gives every site its own container ..."

But with its own IP, possibly a non-routable, private IP ?

I think not ... and that's too bad because that is what we really need. We need the ability to chroot jail a GUI program just like we jail named or (whatever).

A different root, a different IP, and no access (or knowledge) of the rest of the system. If I used facebook, that's the browser I would run it in.

This is exactly what Qubes offers. Have as many separate browsers as you like, each originating from a different IP using VPN proxyVMs. Or just run everything through Tor using a Whonix gateway.

https://www.qubes-os.org/intro/

Any problems? For example, CDNs are in different domains. Some ecommerce sites use payment services from other domains.

Things will break like logging in with Google/Facebook/other OAuths that use popup window redirects, iframe services like Disqus or Facebook comments, Google's captcha will become more annoying, less local caching will happen which means slower browsing in general.

When you say login would break, what do you mean? Just that it would be less convenient, i.e. you have to login to your identity provider once for each first party? Or are you suggesting that the redirect flow for OpenID Connect or oauth wouldn't work at all?

Yet another reason why you should avoid using service to log into another as much as possible.

I'm really of two minds about this. On the one hand you can use Facebook or Google to log in and then have them know what sites you log into. Or you can use a site's native login and be pretty sure that at some point you're going to get a "we take security very seriously" notice after they screw up and expose all their user data.

If you use a password manager with different passwords for each site it doesn't matter (much). Either they steal your password (usually hashed), or your OAuth information.

The minor difference is that with OAuth they cannot log-in to the site pretending to be you, but if they don't hash the passwords, or use weak method to do it, then it's possible.

Regarding other user data stored in the DB (which is usually more valuable than just the passwords) there is no difference between the login method.

I don't really see how logging in with a different system prevents your user data from being exposed?

I've definitely run into problems with ecommerce sites (really just Tarsnap) and embedded iframes from 3rd party payment services, while using the Chrome equivalent of this Firefox setting.

In case it's useful: This was due to a bug in Chrome which has since been fixed. (Chrome was losing the "POST" flag when sending a redirect message between processes.)

Any idea what version of Chrome fixed it? I refill my Tarsnap balance only occasionally.

The bug was fixed on January 26th and was being merged to older supported branches expeditiously -- I don't know the exact version numbers but I'm sure that any releases they rolled after mid-February would have the fix.

I guess 65.0.3325.146 from March 5th probably works, then. Thanks!

How do you do this in Chrome?

chrome://flags/#enable-site-per-process

Strict site isolation > Enable.

Using profiles I guess

Doesn't Privacy Badger do about the same, but more granular and breaking fewer things?

By not breaking things, Privacy Badger will essentially let some cookies and trackers pass through which aren't cross tracking but these could leave behind a trail. Some will stay dormant until activated.

CAD or any similar cookie deleting add-on will essentially kill any cookie that isn't required for your active tabs. This way nothing is left behind to track or trail you.

What about browser fingerprinting (https://panopticlick.eff.org/)? Unless you are using the Tor browser, this appears "uncontainable" especially for folks not using Chrome over Windows 10 or another super generic combination.

Blocking your canvas to avoid being fingerprinted/tracked is like walking under the CCTV with a hoodie and cap on. Unless everyone under the CCTV does the same you will not be detected but will be tracked. It might be hard to identify you but you will standout.

So instead of standing out of the crowd why not disguise so well that the tracker doesn't know the real you.

The idea is to use something that gives a fake readout of your fingerprint thus making you look normal but keep changing it occasionally so it leads no where for long time. Try Canvas blocker[1] and/or Canvas Defender for fake readout.

[1]https://github.com/kkapsner/CanvasBlocker

> The idea is to use something that gives a fake readout of your fingerprint thus making you look normal but keep changing it occasionally so it leads no where for long time.

What is "normal" in this case? One correct way to counter fingerprinting is to standardize the fake readouts to a specific value and not change it every so often. So if everyone's browser is reporting the same value for this feature that feature will become meaningless in the context of fingerprinting since its entropy is very low.

That's what Tor Browser has been doing with font enumeration, reported windows size, screen resolution etc. - they all report the same value. On the other hand, you can correlate these values and identify Tor Browser users.

I use containers to keep some activities limited to it. As my primary browsing is open all the time which. For each of these activities I use a separate container; shopping, work, research, banking, payments and social.

I use uBO with dynamic filtering[1] + I've replaced 'CAD' with 'Forget Me Not'[2] works like a charm.

[1]https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-qu... [2]https://github.com/Lusito/forget-me-not

Wouldn't setting your cookie settings to strict (block all third party cookies) do the same thing?

It's more thorough than just cookies including various caches and data stores.

Does the OP's method allow third party cookies while isolating them from other sites?

That might be more usable than blocking third party cookies for sites that break because of SSO.

Personally I use Containers and block third party cookies and I don't have any troubles.

nice, I wish there were a dedicated checkbox for this in the settings page. I didn't know about this until now.

Yup, this is how I thought containers would work like at first.

9/10 times I navigate off a link from one container and boom I've pulled in everything in that new container by ctrl+l reflex.