search

stoically / temporary-containers

Firefox Add-on that lets you open automatically managed disposable containers
https://addons.mozilla.org/firefox/addon/temporary-containers/
MIT License
852 stars 60 forks source link

ETag cache tracking #394

Open stoically opened 4 years ago

stoically commented 4 years ago

As reported on reddit, containers are susceptible to ETag cache tracking, even though they shouldn't. Easily reproducible here. Not sure if an Bugzilla ticket already exists - might be worth filing one if not.

To mitigate right now using an Add-on, @claustromaniac's ETag Stoppa works well for that.

crssi commented 4 years ago

Are you sure? I do not have the same results as you. I might use something else to mitigate, but I am 99% sure that I rely just on TC for that... before TC I was using ETag Stoppa.

Will double check on a plain vanilla profile with TC only and report back today,

Cheers

crssi commented 4 years ago

Done testing. You are right, but AFAIK this was not the case in the past. I am sure I had done same tests before ditching ETag Stoppa, which was in this case duplicate.

Thank you for warning, getting ETag Stoppa back into profile right now. 😄

Cheer

stoically commented 4 years ago

Yeah, it's weird that containers don't cover that, must be a bug. I guess I could add the ETag Stoppa functionality as advanced preference into TC as well :thinking:

stoically commented 4 years ago

ClearURLs filters ETag headers by default as well.

stoically commented 3 years ago

Should be fixed by Firefox 85+

crssi commented 3 years ago

Hmm... FF ver 85. If I open https://lucb1e.com/rp/cookielesscookies/ in one container and set some value. Then I open the same link in another container, reload twice and I get the value entered in the first container.

But using ETag Stoppa extension everything is OK.

stoically commented 3 years ago

Hm, true. So they missed Etag in their attempt to fix the supercookie problem (https://blog.mozilla.org/security/2021/01/26/supercookie-protections/)? oof