multi-account-containers
multi-account-containers copied to clipboard
mozilla
Add option to disable "Open this site in your assigned container?" confirmation page
When I click the Always Open in This Container button, I always want new tabs to open there. Having to then navigate to the same URL in a new tab to set this is a bit of a pain. An option to not prompt for this for every site would be ideal (I assume not everyone wants this behaviour).
One neat way to do it might be to have two checkboxes:
- [ ] Remember my decision for this site
- [ ] Remember my decision for all sites
┆Issue is synchronized with this Jira Task
@groovecoder I think we discussed this at one point right?
The rationale here is basically that it prevents the user from being sent to: https://bank.com/pay/account?user=bad&amount=100000
Without this a website could potentially XSS you again and also craft a clever redirection link to break through the containers advantages also.
Given this, if we were to do this I would like the global allow to be more educational than just a tick box. I also think it should be container specific still.
The rationale here is basically that it prevents the user from being sent to:
https://bank.com/pay/account?user=bad&amount=100000Without this a website could potentially XSS you again and also craft a clever redirection link to break through the containers advantages also.
Okay, so the concern is that a site in your dodgy sites container can redirect you to a site in your banking container, where you might be already logged in and thus be exposed? I guess that makes sense as a concern (although that sounds like it might be more an issue with the banking website).
Given this, if we were to do this I would like the global allow to be more educational than just a tick box. I also think it should be container specific still.
Fine by me, doing it containers.length times is a lot better than doing it for every site. FWIW I don't use containers for the security reasons, I just like to have different sessions for work/personal/coding (with the neat hide all tabs from this container option etc.). So I'm not too bothered by the security issues.
I think doing it on a per-container basis should resolve some of those security issues (you'd leave it unchecked for your banking container).
(although that sounds like it might be more an issue with the banking website).
It is, however until same site cookies become popular and well used this is still a high risk that we are preventing with containers.
I think doing it on a per-container basis should resolve some of those security issues (you'd leave it unchecked for your banking container).
Agreed, I just would like some nice tutorial that you have to click through that explains the risks. (users don't read often nor are the privacy/security risks obvious)
They still like the prompt page...why o WHY?
Operator: Unplugs computer from wall. Computer: Are you sure? :rofl:
I would love to see this feature implemented as well. I understand the concern raised by @jonathanKingston and it's a valid concern however most people are simply accepting the "Open this site in your assigned container?" with the "Remember my decision for this site" checked and now they're exposed if a vulnerability exists and the extra dialog is just a nuisance the first time. If you allow that "Remember my decision for this site" option then why not in the "Multi-Account Containers" settings page add an "Auto Open This Site in" which assumes your consent for "Remember my decision for this site" and gives you one warning the first time you ever use that functionality and that's it.
So for anything sensitive use "Always Open This Site in" and that continues to work the way it did before (possibly take away the "Remember my decision for this site" option and the "Auto Open This Site In" can assume consent.
I just want to reiterate that I really love Multi-Account Containers and thank you for creating and working on it. I myself am surprised at how annoying it is to achieve the "Auto Open This Site in" functionality with the current options. It comes up frequently and especially for sites that require a login it results in you having to login 2 times and can be frustrating.
Somewhat off-topic …
⚠ Wording
This has probably been said in any number of other issues, but here goes:
- it is inescapably wrong to begin with an "always" offer when the UX that follows (not necessarily immediately) treats the user as if something other than always was chosen.
I don't doubt the overall rationales, but fixing this particular outset wrongness will require a broad and thoughtful UX shake-up that is (off-topic) beyond the scope of this issue.
OK, I got that I added my site to "Always Open in This Container" list (I clicked "Always open in this in a Container"). How could I remove it from this list?
One thing that might work is to make a new container, assign it to that new container, then delete the container There might be a better way, but that should work. I can at least flip the "default" container it asks for by assigning a new container.
Removing a site from the site list
Re: https://github.com/mozilla/multi-account-containers/issues/796#issuecomment-830688363
Use the page context menu. Change from:
☑ Always Open in This Container
– to:
☐ Always Open in This Container
Screenshot
For example, aiming to make the change for github.com:
@grahamperrin hm, looks like this option isn't available on FF 89.0beta on Windows.
looks like this option isn't available …
@RredCat that's a separate issue. Can you move your comment? To #1996
Wow, this has been an issue since 2017??? This is clearly a sought after feature by many users so why not implement it in an informative way where the security risks of crossing containers via links is explained? I love this plugin and its wonderful reliability. I thank you all for making such an awesome plugin! But it is also always frustrating to see a widespread feature request among users which developers ignore for years on end.
@groovecoder I think we discussed this at one point right?
The rationale here is basically that it prevents the user from being sent to:
https://bank.com/pay/account?user=bad&amount=100000Without this a website could potentially XSS you again and also craft a clever redirection link to break through the containers advantages also.
While I don't understand the danger you describe, I am confident that it is real. How about this: Let you rank the sensitivity of a container in that somebody using the dodgy_sites container could not let you redirect to a site that uses the Banking container... or maybe only then give that popup.
Currently that pop-up that appears when I go to Google only gives the choice of the container used on that tab previously and my Personal container. I have no clue why I would want to choose the container that I was using for my bank would be one of the choices. Maybe offer a third choice for the Misc container, if the option to open in the same container you used previously is useful to somebody.
This is the #1 issue for Firefox! Multi account containers is the most useful thing about Firefox. People use it to manage many github accounts, AWS accounts. etc.
This is how it should work:
If I open a site in a container, any other link opened from that container tab should open in a new tab in the same container with no confirmation
Get rid of the confirmation message and get rid of the remember checkbox because they just don't work! Just try it with many AWS accounts and you will know that it's unusable.
Just fix this trash, it don't work state management don't work. I click on remember it don't remember shit. And I can't even stop it from asking me without offing the entire plugin. Please use the last money left from google to fix this ty.
I don't know what's scuffed maybe like when you remember decision for using page WITHOUT a container that saves like container: null and keep reasking which is STUP IIDDD FIX PLEASE FIIXXS THISHTIASHufhaldheiupjnae
P.S: if this is some kind of state inconsistency problem still give the user the option to either easily to modify this said state or reset it in some careful way like cmon. Or just fix the new tab logic like
