Hello privacyguides. I have a question:

Talking strictly about security, how would you rate multi-account-containers for compartmentalizing internet activity? By compartmentalizing, I mean if, for example, I click on link “xyz” on container “a”, and this link is somehow capable of accessing account “b” and compromise it. Except I have this account “b” logged in another container. Would the website be able to compromise the account? I know zero-days exist, but in a typical situation, would this extension improve security in this example or not?

Thanks in advance for your time and any answers!

  • LWD@lemm.eeEnglish
    7·
    10 months ago

    Total cookie protection (called “State partitioning” under the hood) is not totally total.

    In order to resolve these compatibility issues of State Partitioning, we allow the state to be unpartitioned in certain cases. When unpartitioning is taking effect, we will stop using double-keying and revert the ordinary (first-party) key…

    There are two scenarios in which Firefox might unpartition states for websites to allow for access to first-party (cross-site) cookies and other state:

    1. When an embedded iframe calls the Storage Access API.
    2. Based on a set of automated heuristics.
      • LWD@lemm.eeEnglish
        3·
        10 months ago

        The documentation is… Confusing. This was the third time I tried looking into it, and the last two times I was much more wrong about how it actually worked.

        Total Cookie Protection also protects more than cookies, FWIW.