Changes

Jump to: navigation, search

Security/Contextual Identity Project/Containers

2,678 bytes added, 13:06, 14 June 2016
Updating to match most recent implementation details
{{warning|This is just a draft proposal of how [[Security/Contextual Identity Project|contextual identities]] might be implemented in Firefox}}
[[File:Containers.png|200px|thumb|right|Mock-up of what this might look like]]
 
==Description==
Individuals behave differently in the world when they are in different contexts. The way they act at work may differ from how they act with their family. Similarly, users have different contexts when they browse the web. They may not want to mix their social network context with their work context. The goal of this project is to allow users to separate these different contexts while browsing the web on Firefox. Each context will have its own local state which is separated from the state of other contexts.
[[File:Containers-side-by-side-cropped.png|500px700px|frameless]] ==How to Use Containers== The containers feature can be enabled in Nightly by going to `about:config` and setting the `privacy.userContext.enabled` pref to true. Once enabled, containers will integrate seamlessly into your current browsing experience. You will have the option to open entirely new browsing contexts, which will have their browser storage (such as cookies or localStorage) separated from other containers. Your normal tabs, which we consider to exist in the ''default container'', will still look and act as you'd expect them to before enabling containers. Container tabs operate just as you would expect a normal tab to, except for the fact that the sites you visit will have access to a separate slice of the browser's storage. This means your site preferences, logged in sessions, and advertising tracking data won't carry over to the new container. Likewise, any browsing you do within the new container will not affect the preferences, logged in sessions, or tracking data of your other containers. There are several ways to open new containers: ===File Menu=== In the OS menu bar, click "File" -> "New Container Tab". From here you can choose from one of the four pre-defined containers (Home, Work, Banking, and Shopping). After choosing one of these, you will see a new tab from that container appear in the tab strip.  ===Hamburger Menu=== To access the hamburger menu, you must restart your browser after setting `privacy.userContext.enabled` to true. Once this is done, click the hamburger menu (three horizontal bars on the right hand side of the browser), and then click "Customize". From here, you'll find the "Open Container Tab" icon under the "Additional Tools and Features" section of the icons. You can drag this icon to the right side of the URL bar.
Separated by Containers:Alternatively, you can place the icon in the dropdown hamburger menu.* Cookies* localStorage===Open links in new tabs and containers===* indexedDB* HTTP data cache* Image Cache* Any other areas supported by OriginAttributes [https:/It's possible to open links in a new and/bugzilla.mozillaor different container.org/show_bugRight click on any link, select "Open link in New Container Tab", and then select the desired container tab.cgi?id=1179985 Bug 1179985]
Not separated by Containers:* History* Bookmarks* Saved Passwords* Saved Search Holding the "Control" key on Windows or Linux (or the "Command" key on Mac) while clicking a link will open it in a new tab. The new tab will open within the same container as the previous tab. This includes both the default container and Form data* HSTS Flags* OCSP Responses* Security Exceptions for Invalid TLS Certificatesin any of the predefined containers.
==Benefits and Use Cases==
* Personal (to use at home)
* Work (to use at the office)
* Banking (for accessing sites with financial or sensitive informationsinformation)
* Shopping (for accessing ecommerce sites)
* Custom (for [available in future versions)]
Through naming and onboarding, we gently encourage users to use different containers for different purposes, as the separation is necessary to gain the benefits above. A purpose-specific container can have many sites in it:
* The Shopping container can be a place for Amazon, Alibaba, and other stores
===Default Container=Implementation Details==
By creating containers, we also create a notion of sites that exists ''outside'' of a container. By default, all of a user's browsing prior to enabling the feature ===What is considered to be in the (and isn''default'' container. Additionally, any browsing that occurs after the feature has been turned on, but not in a named container is considered to be in the default.t) separated between Containers===
Our goal is to match Separated by Containers:* Cookies* localStorage* indexedDB* HTTP data cache* Image Cache* Any other areas supported by originAttributes [https://bugzilla.mozilla.org/show_bug.cgi?id=1179985 Bug 1179985] Not separated by Containers:* History* Bookmarks* Saved Passwords* Saved Search and Form data* HSTS Flags* OCSP Responses* Security Exceptions for Invalid TLS Certificates You can find more information on the navigation experience that users currently expect during a session without containersimplementation of the project by looking through the Contextual Identity / Containers meta-bug, [https://bugzilla.mozilla.org/show_bug.cgi?id=1191418 Bug 1191418]. This necessitates a few behaviors when you navigate from inside a container:
Manually-invoked navigation:===An extended origin===
* Right click menu will have two additional options** Open Link in New Tab (this opens the link in the default container)** Open Link in New Container Tab (this opens the link in An origin is defined as a specified container)* Command-clicking combination of a link will open that link in scheme, host and port. Browsers make numerous security decisions based off of the origin of a new tab in resource using the same container-origin-policy. Various features can be re-imagined as simply adding another key to the origin check. These include the Tor Browser’s work on [https://bugzilla.mozilla.org/show_bug.cgi?id=1260931 First Party Isolation], Private Browsing Mode, the [https://w3c.github.io/webappsec-suborigins/ SubOrigin Proposal], and Containers.
SiteHence, Gecko has added additional attributes to the origin called OriginAttributes. When trying to determine if two origins are same-invoked navigation:origin, Gecko will not only check if they have matching schemes, hosts, and ports, but now also check if all their OriginAttributes match.
* windowContainers adds a userContextId OriginAttribute. Each container has a unique userContextId. Stored site data (like cookies) is now stored with a scheme, host, port, and userContextId. So if a user has example.com cookies for the Shopping userContextId, they will not be accessible by example.open always open com in the same container as Banking Container. Note that one of the site motivations in enabling this feature in Nightly is to help ensure that we iron out any bugs that may exist in our OriginAttribute implementation before features that opened depend on it, so as not are rolled out to break single signusers. ===More information=== * OriginAttributes implementation [https://bugzilla.mozilla.org/show_bug.cgi?id=1179985 meta-onbug]* Containers implementation [https://bugzilla.mozilla.org/show_bug.cgi?id=1191418 meta-bug]
==Making containers look different==
[[File:Containers-comparison.png|900px|frameless]]
Each container could have a differenthas several visual indicators:
* Name: On the File Menu and location bar* Icon: On the File Menu and location bar
* Color: On the tab and location bar
==Discovering the feature==
[[File:Containers-file-menu.PNG|668px|frameless]] For the initial version, this feature is discoverable via the File menu and is limited to a few purpose-specific containers. However, on Windows, the File hamburger icon menu is hidden until the user hits the Alt keyas discussed above. In future versions, This makes the Containers menu should be added as an item under the ‘Hamburger’ menu on the right side of the toolbar. Containers are discoverable feature accessible for those who want to use themit, and have no impact on the browsing experience of those who don't. Through user research, we’ve found that many people have only one account per website, and that they don’t currently separate their online selves into work/home/banking/etc. Containers is not a feature for those users.
However, we can hook into several user actions and present onboarding messages to encourage container use for users who can benefit from them. We can detect users logging in and out of a service like Twitter that doesn't have support for multiple logins, and offer the feature to them. We can also offer the feature to users when they first try to access their online banking after the feature has been enabled.
* The website I signed into saves a whole bunch of cookies that are outside of its origin. How will the browser know that these out-of-origin cookies are associated with a specific site container?
* Some sites may require that the user interact with multiple top-level origins during a session, or may require cookies from multiple origins.
 
==Implementation Details==
 
You can find more information on the implementation of the project by looking through the Contextual Identity / Containers meta-bug, [https://bugzilla.mozilla.org/show_bug.cgi?id=1191418 Bug 1191418].
==Related work==
Englehardt
Confirm
25
edits
Retrieved from "https://wiki.mozilla.org/Special:MobileDiff/1136864"

Navigation menu