Proposal: Private browsing by default, or Firefox Focus mode

[pmac]

I've been using a Focus beta on my phone as my default browser for a few days now and I really like it. It allows me to protect my privacy by default, but easily switch to full Firefox if I want or need to for my passwords or existing sessions. This has gotten me thinking that I'd love that workflow on my desktop. Here's how I think it could work and how it will be even better because of container tabs:

1. Click a link in another application
2. Opens a new tab in a private browsing window
3. Add buttons to private mode to easily move (or close and open) said tab to either default mode or one of the configured containers, very much like the hover on the new tab button works now.

This means that if I click something that I don't want in my history this is the default. If I want to do normal stuff I can move it to normal window or immediately open it in a container. I should still be able to directly use the normal Firefox browsing mode, but this would be the flow for external links and opening new tabs. It's pretty much the exact opposite of the current normal vs. private browsing mode use case.

It could be that this is possible today via a collection of addons, and if so I'd be happy to hear about it. But I do think that this more private by default mode without having to go full "always private mode" would be a nice built-in feature for the browser eventually.

This is perhaps a conversation for the broader Firefox community, but I thought I'd see what this group thought first since I feel like it fits nicely with the container concepts.

[jonathanKingston]

I agree this could be an option that we should consider in this experiment. Where the user opening a link from an external application gets a private tab or even "first party isolation" for this link (where external app opening both example.com and otherexample.com are considered separate browsing contexts). The user then has to assign it into a container with either #311 or the new assign feature released today.

Related bugs:

• Consider a tab context menu option to convert a normal tab to a container #311 moving a tab into a different container
• Disable history per-container setting #47 disable history per container
• Set a default container for new tabs #356 default no container

Questions:

• Would this only be for external applications opening a link?
• By private browsing, what features are you after?
  • Tracking protection
  • Forgetting history
  • Making all cookies at most session cookies
  • Isolation from normal non container tabs
• Would a warning about opening a tab and picking a container be enough instead?

Note:
"always private mode" currently doesn't work, it does in Nightly but not for this experiment. Mostly due to WebExtensions not being able to show this and time constraints.

[CircleCode]

thinking about this feature, a mode where each new tab, wherever it comes from (external, link from another tab, etc.) is opened with full isolation (like if it is alone in its new temp container) if it is not assigned to a given container would be interesting.
there, one could move the tab to the good container with help to #311

[pmac]

Would this only be for external applications opening a link?

Potentially, but I could also see links from sites that open a new tab to a different domain.

By private browsing, what features are you after?

• Tracking protection
• Forgetting history
• Making all cookies at most session cookies
• Isolation from normal non container tabs

All of the above. I'm mostly after the isolation and tracking protection, but it all sounds appropriate.

Would a warning about opening a tab and picking a container be enough instead?

This could be enough, but getting in the way of opening a site the user has clicked on might be enough of an annoyance to have the feature disabled. I thought having the default context into which a new tab is opened be private by default would be a good compromise, and for me it's what's working well on my phone.

I saw someone say that per-container session and privacy prefs would be a way to solve this. That seems plausible. One could just set the default container to be like private browsing, and the others to preserve more stuff. But I do like what you said about "first party isolation", because even a fully private mode default container would allow sites you open in the same session to leak to each other.

[jonathanKingston]

I saw someone say that per-container session and privacy prefs would be a way to solve this. That seems plausible.

If we are adding this UI then we likely would need to let the users control what "non container" looks like also as per #356

[jillesvangurp]

What I've been looking for is a private by default mode unless the domain is whitelisted. Private here would mean, no history, cookies, caches, local storage, etc. survive the browser session. A whitelist would allow the user to choose whom to trust and not trust anything else by default. For most users this would be a small list of domains.

The current setup is more of a all or nothing approach, which makes using private browsing unnecessarily complicated since you are now signed out of all the stuff you'd normally have white listed just so you can visit that one domain you want to keep private. Having to alt tab between windows to go private is tedious and error prone (one click in the wrong window and you are now back to non private mode).

I'd like similar a whitelist approach for things like auto playing video, begging for notification privileges, and other annoyances that mostly seem to be abused by obnoxious websites rather than be of genuine use but there are the occasional websites where I actually do want this. Just auto denying any privileges until I say otherwise would be perfect. This seems to be hard/impossible currently and I've found no good extensions that do this either (I've been looking).

[stoically]

Since I'd say this is somewhat similar to #929 and that is marked as "extra add-on", I thought I'll leave a link to an Add-on I'm building here that aims to achieve "Container isolated browsing by default"

[ChaoticMind]

In case someone finds this workaround useful, I've already been mimicking this behavior on Linux for quite a while now (minus the whitelisting of websites), by making firefox -private-window %u my default browser. Works great for me!

The way to do this depends on your DE. Also, some apps don't respect xdg-open (e.g. pidgin, which has its own configurable setting instead). The vast majority, however, do.

If Firefox is not already open, this results in only opening a new Firefox private instance (similar behavior as launching firefox --private-browsing. To "recover" your tabs, it's sufficient to simply hit ctrl+n. From my experience, the behavior doesn't generally interfere with your session in any unexpected ways.

[ArchangeGabriel]

@ChaoticMind Interesting, but I think setting browser.privatebrowsing.autostart to true would be more robust and still allow your workflow.

[pmac]

For anyone still following along, @stoically (above) has continued to do an amazing job on the "Temporary Containers" extension:

https://addons.mozilla.org/en-US/firefox/addon/temporary-containers/

I also recommend reading the Medium article linked in the addon description. Check out the code here:

https://github.com/stoically/temporary-containers

Mad kudos to @stoically for this extension. The available options are great, and it's a huge win for web privacy!

[grahamperrin]

Consider the workflow (and variations) at #469 (comment)