12
How secure is multi-account-containers? (lemmy.world)
submitted 9 months ago by Qvest@lemmy.world to c/privacyguides@lemmy.one
4 comments fedilink hide all child comments

Hello privacyguides. I have a question:

Talking strictly about security, how would you rate multi-account-containers for compartmentalizing internet activity? By compartmentalizing, I mean if, for example, I click on link "xyz" on container "a", and this link is somehow capable of accessing account "b" and compromise it. Except I have this account "b" logged in another container. Would the website be able to compromise the account? I know zero-days exist, but in a typical situation, would this extension improve security in this example or not?

Thanks in advance for your time and any answers!

top 4 comments
sorted by: hot top controversial new old
[-] MangoPenguin 15 points 9 months ago

Even without containers cookies are separated between sites: https://blog.mozilla.org/en/products/firefox/firefox-rolls-out-total-cookie-protection-by-default-to-all-users-worldwide/

So from a privacy perspective from a site in the browser looking at cookies, with or without containers it should not be able to see cookies from other websites.

However from a security standpoint if something breaks out of the browser with an exploit and infects the host system, it can read all of the browser data easily from any site in any container.

[-] LWD@lemm.ee 7 points 9 months ago

Total cookie protection (called "State partitioning" under the hood) is not totally total.

In order to resolve these compatibility issues of State Partitioning, we allow the state to be unpartitioned in certain cases. When unpartitioning is taking effect, we will stop using double-keying and revert the ordinary (first-party) key...

There are two scenarios in which Firefox might unpartition states for websites to allow for access to first-party (cross-site) cookies and other state:

  1. When an embedded iframe calls the Storage Access API.
  2. Based on a set of automated heuristics.
[-] MangoPenguin 2 points 9 months ago

Good to know! Annoying that it doesn't tell you that.

[-] LWD@lemm.ee 3 points 9 months ago

The documentation is... Confusing. This was the third time I tried looking into it, and the last two times I was much more wrong about how it actually worked.

Total Cookie Protection also protects more than cookies, FWIW.

this post was submitted on 01 Feb 2024
12 points (100.0% liked)

Privacy Guides

16813 readers
1 users here now

In the digital age, protecting your personal information might seem like an impossible task. We’re here to help.

This is a community for sharing news about privacy, posting information about cool privacy tools and services, and getting advice about your privacy journey.

You can subscribe to this community from any Kbin or Lemmy instance:

Learn more...

Check out our website at privacyguides.org before asking your questions here. We've tried answering the common questions and recommendations there!

Want to get involved? The website is open-source on GitHub, and your help would be appreciated!

This community is the "official" Privacy Guides community on Lemmy, which can be verified here. Other "Privacy Guides" communities on other Lemmy servers are not moderated by this team or associated with the website.

Moderation Rules:

  1. We prefer posting about open-source software whenever possible.
  2. This is not the place for self-promotion if you are not listed on privacyguides.org. If you want to be listed, make a suggestion on our forum first.
  3. No soliciting engagement: Don't ask for upvotes, follows, etc.
  4. Surveys, Fundraising, and Petitions must be pre-approved by the mod team.
  5. Be civil, no violence, hate speech. Assume people here are posting in good faith.
  6. Don't repost topics which have already been covered here.
  7. News posts must be related to privacy and security, and your post title must match the article headline exactly. Do not editorialize titles, you can post your opinions in the post body or a comment.
  8. Memes/images/video posts that could be summarized as text explanations should not be posted. Infographics and conference talks from reputable sources are acceptable.
  9. No help vampires: This is not a tech support subreddit, don't abuse our community's willingness to help. Questions related to privacy, security or privacy/security related software and their configurations are acceptable.
  10. No misinformation: Extraordinary claims must be matched with evidence.
  11. Do not post about VPNs or cryptocurrencies which are not listed on privacyguides.org. See Rule 2 for info on adding new recommendations to the website.
  12. General guides or software lists are not permitted. Original sources and research about specific topics are allowed as long as they are high quality and factual. We are not providing a platform for poorly-vetted, out-of-date or conflicting recommendations.

Additional Resources:

founded 1 year ago
MODERATORS
jonah@lemmy.one
dngray@lemmy.one
freddy@lemmy.one
ninchuka@lemmy.one
jonah@lemmy.jonaharagon.net