Hacker Newsnew | past | comments | ask | show | jobs | submit | 283894's commentslogin

Say you click a link that sends you to facebook content (whether that be a video, or a group or other public content), does that then change you over to your logged in Facebook container tab? Isn't this kind of counter intuitive?

I've been using the Containers plugin and its predecessors for years to isolate facebook, but I've always liked it because when someone links to facebook content I can then read it logged out in my normal tab. Obviously on top of this I am using ublock/umatrix anyway.


The purpose of this extension is to isolate Facebook. So yes, when you click a link to Facebook, it will open it in a dedicated Facebook container.

It would be counter intuitive if this is how the standard Containers extension worked, but for this specific extension, you are installing it to isolate Facebook, so I think this is how people would expect it to work. If the extension did not open Facebook links in a dedicated Facebook container, then I think the extension would not be doing its job correctly.


I think you would like the Temporary Containers extension even more if you've been using Containers to keep logged in Facebook out.

To automatically open Facebook links in a logged-in, dedicated-to-FB container is the entire point of this extension. After all, it was built for regular, non-tech-savvy people. To such people, it'd be a bad experience if suddenly they could no longer open FB links sent to them by their friends (because links to FB posts can have non-public visibility).


> but I've always liked it because when someone links to facebook content I can then read it logged out in my normal tab.

Personally I've trained the habit of opening most random links in private browsing mode. Besides achieving what you mention it seems like good, additional mitigation against tracking/security/etc. The only downside is lack of browsing history but I've never had much use for browsing history (mostly because I've found the search functionality in browsers to be useless).


A few weeks ago I posted here [1] how I think that Containers should really work.

I think your observation is a good one, and a rule for it should be added (or actually the third rule should be modified).

[1] https://news.ycombinator.com/item?id=16866086


Right - normal Containers are useful if you don't want sites you visit to track you by associating your browser with a FB account. Facebook Container is for when you don't want FB itself to track what websites you visit. (Normal containers also help if you just want to log into multiple FB accounts at once.)


I'm a bit uninformed on Firefox Containers. Can you help me understand how this is different from using things like ublock/adblock plus/ghostery and why you might want to use both those, and a Facebook container?


uBlock and Adblock Plus are ad blockers. They block advertisements from appearing on the web pages you browse. I am not familiar with Ghostery.

Firefox Multi-Account Containers is an extension [0] that allows you to compartmentalise cookies and other data into different containers. It's possibly best explained by thinking about how you might use it:

Suppose you have two Twitter accounts: a personal account and a business account. Twitter usually only allows you to be logged into a single account at a time. This means that if you're currently logged into your personal account, you need to log out first before you can use your business account.

With Containers, you can simply create a Business container and log into your business Twitter account in there. That way, you can be logged into two Twitter accounts at the same time.

Containers do not act as ad blockers and perform a very different function.

For more information on Containers, I would suggest reading the extension's description [0] and/or the support page [1].

This article is talking about a special version of Firefox Multi-Account Containers called Facebook Container [2]. This works similarly to Firefox Multi-Account Containers, but it isolates Facebook to its own dedicated container.

[0] https://addons.mozilla.org/firefox/addon/multi-account-conta...

[1] https://support.mozilla.org/kb/containers

[2] https://www.mozilla.org/firefox/facebookcontainer/


uBlock, etc are for blocking ads and trackers. That means the trackers don't even load.

Firefox Containers don't block ads, trackers, or anything. Instead, they isolate websites into their own "containers". Think of it like private browsing mode. Except each container is its own, separate private browser, and they persist.

They're different approaches with pros and cons, but they can certainly be used together since they're orthogonal.

Personally I use both. uBlock blocks ads/trackers/etc for me, while I use Containers as additional protection for not just social media sites but also to isolate my banking activity, work accounts, etc. It's useful for when you have multiple logins to the same site, and for mitigating some attacks (e.g. CSRF). [NOTE: I'm using the full featured Multi-Accounts Containers add-on, not the Facebook Container add-on mentioned in the article]


> uBlock, etc are for blocking ads and trackers. That means the trackers don't even load.

That's what they advertise, but it's not even remotly true. I've made a bit of an exercice to see how they are working. Basically they all (adblocker and tracker removal) have a database of bad guys and avoid the known bad guys to load. The problem is all the unknown bad guy. We would need something that is behavior based, not database based, doing my research I couldn't find one that was working as one would expect.

Just as 1 example of the bad guys: Cloudflare that send cookies when the owner of the site is using their CDN regardless if you have setup a do not track header. Do any of those track blocker managed to block Cloudflare? Nope

It makes me sad that our community for some reason I ignore don't even respect the do not track header. It literally is just decoration


It sounds like you're looking for Privacy Badger: it uses heuristics to block requests and cookies from third-party sites based on their behaviour in your browser.

https://www.eff.org/privacybadger

The basic rule is that if more than one first-party site tries to connect to the same third-party, that third-party could be tracking you and will be blocked. But it's a little cleverer than that, and has etra rules to just block cookies from common CDNs.


> Do any of those track blocker managed to block Cloudflare? Nope

False. I just visited cloudflare.com and uMatrix blocked 2 Cloudflare cookies, 8 Cloudflare scripts, one tracking pixel each from Bing and Google Ads (who are on the "bad guys" list), a script from Optimizely and an embedded frame from Google Tag Manager. That's with a whitelist that only allows CSS and images (the default, I think), and only from first-party sources.

Surprisingly, the site wasn't even broken.


I made my tests with: DuckDuckGo Privacy Essentials, Ghostery, Privacy Badger, Stealth mode. Never tried uMatrix and you're right, it's blocking cloudflare :)


>"What was once a rich selection of blogs and websites has been compressed under the powerful weight of a few dominant platforms," he wrote.

>Reddit has the power to help reverse this trend.

Odd that they completely missed the point of this, Reddit is a major part of the consolidation of the internet. Reddit pretty much killed independent forum and community websites.


In my experience, Facebook has replaced more independent online communities than reddit.


I just signed up for 2 Tesco accounts the other day to dump 3k in each for the 3% interest.

I'm certainly not going to be doing anything with the accounts until Tesco give some more clarification on what actually happened (although the way these things work, I doubt there will ever be a full technical response.)

Also if it is some sort of internal breach, would any other data have been taken?

Back in 2012, Tesco were storing passwords in plain text.

http://www.bbc.co.uk/news/technology-19316825


Tesco ask you to log on with "character 2 and 4 from your password" which sort of implies they must store the password in clear text (unless some kind of zeroknowledge/homomorphic encryption magic i've not heard of.)


That is not the password though. They call that the 'Security Number'.

After entering the two digits of the 'Security Number' you then receive a 'One Time Access Code' through a text or phone call, although I have never logged in to my account before, and seem to be unable to get past this step now.

I think you then enter your proper password in, which I would hope is not stored in plain text, although the article I linked seemed to imply this was the case back in 2012.


Depending on the length of the password, it's possible to encode/hash (+salt) all possible outputs of challenge combinations at the point of storing your password.

It's a bit like having a number of related passwords, which the bank can ask you for any of them, and then verify is correct.


I have an account at Metro Bank in UK. One day I was on the phone with them, and to authenticate myself they asked me for characters 2/4/7 from the password.

At the same time, they advise you to never give your password away, and that they will never ask you for your (full) password.

Talk about a mixed message...


Most UK Banks use HSM modules to store 'pins' (Similar process to Apple with iCloud) which remain separate to passwords which are hash + salted


This is pretty standard for UK banks.

They'd do a hash of each character of the password (in Lloyds' case, your "memorable word" combo), to compare your entries to.


Wait, that's still awful! It allows you to crack each character individually. For instance, a 10-letter password requires 26^10 ~= 1.4e14 attempts to test every option if you only have a hash of the full password, but only 10*26 = 260 attempts to test every option for every individual character.


I have to use two passwords to login to Lloyds bank. One conventional password (which is presumably stored salted and hashed) and one where I have to enter characters from three positions they choose. The latter is intended to mitigate the risk of using your account from a vulnerable computer. The former takes care of vulnerabilities on their end (as far as any password can).


Could they implement something like:

Password: money

Secret word: ABCD

If they're going to ask for two characters from the secret word, they could then hash

  saltmoneyAB
  saltmoneyAC
  saltmoneyAD
  saltmoneyBC
  saltmoneyBD
  saltmoneyCD
and check against the relevant one.


I may be incorrect on the "hash each letter individually" part. But this is combined with a password.


He does have a point though.

In type design, curves and points will usually extend out further then straight square edges to stop them looking like they have stopped just short.

If you blow up some text large and draw a line on the baseline between an 'x' and rounded character like an 'o', the o will go slightly beyond the line. If it didn't, it would look too small to the eye. This is what you would call 'optically correct'. (Its the same for typefaces with pointy 'w's and stuff)

The stem of the bottom of the 'r' in the logo is rounded, so that could make the straight edge of the 'l' look out of place to the human eye, even though that when you draw a line, they line up.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: