Sanitizing on shutdown?

[enoryw]

Disclaimer: general questions not necessarily specific to Betterfox

People use Temporary Containers and settings like sanitizing on shutdown (e.g. deleting cookies on shutdown) for privacy/security reasons. Besides cookies, fingerprintable data like IP address, hardware/software configuration, etc. already contribute to the identity of the the user the user is presumably trying to avoid. When you login and use web services, they can already record everything about you regardless of cookies.

• I don't see the point of creating cookies, deleting, re-creating them again, etc. throughout a session.

• Similarly, I don't see how deleting cookies and session data at the end of a session helps at all when they get re-created again--it just seems to inconvenient the user. I believe this is a really old and outdated advice by tinkers who think everything that can be wiped should be wiped. Technically it would be useful if a malicious actor has access to your logged in system, but in that scenario you've already lost everything.

Basically, with Total Cookie Protection alone coupled with basic use of containers as a convenient way to use multiple logins to the same web service at the same time, it seems like using any other cookie/container-related extension for privacy/security reasons is at best providing a false sense of security (akin to spoofing your user agent) or is redundant, and at worse may conflict with other privacy/security-related settings, potentially even doing the opposite of what's intended. Of course, there may still be other reasons to use such extensions for general convenience (e.g. cookie deleting button to log out of website or more nuisanced rules for e.g. automatically associating different domains with particular containers as a way to visually identify a collection of similar tabs). I'd be curious what container-related extensions people use because I still plan on using containers and would like to automate as much as possible (and not consciously manage containers themselves).

Unrelated, but is there anything else considered useful among the plethora of popular privacy/security-related extensions besides simply using TCP and Ublock Origin extension? With fingerprintable data seemingly practically impossible to avoid, I'm not even sure VPN is as important for privacy even if it is useful for other reasons.

[yokoffing]

Total Cookie Protection (TCP), Firefox with Strict Enhanced Tracking Protection (ETP), and uBlock Origin (uBO) already handles cross-site tracking, yes.

Technically [deleting cookies and site data] would be useful if a malicious actor has access to your logged in system, but in that scenario you've already lost everything.

It depends on what access and privilege the malicious software has. You're approaching this from a privacy lens, which there is some benefit, but I primarily look at wiping out cookies as a protection again session hijacking. Session cookies are bearer tokens — whoever holds them is treated as you. Traditional MFA (like SMS or push notifications) protects the login process, not the session itself. Once a session cookie is issued, attackers can steal that cookie through methods like malware or phishing and use it to sidestep MFA entirely. So, to your point, sanitizing on shutdown only protects against post-session theft. If malware is already on your machine during an active session, it can grab cookies from memory in real time. But it can be better than nothing.

Another way to think of it too is that session cookies are not always stolen in real time. If your session cookies are destroyed when the browser closes, there's nothing for infostealer malware to steal later. Infostealer malware doesn't sit there watching your browser in real-time (usually). It sweeps through the browser's cookie storage files on disk. If you've closed Firefox and cleared session cookies, that sweep finds nothing. The attacker's stolen token log is empty for those sessions.

Unrelated, but is there anything else considered useful among the plethora of popular privacy/security-related extensions besides simply using TCP and Ublock Origin extension? With fingerprintable data seemingly practically impossible to avoid, I'm not even sure VPN is as important for privacy even if it is useful for other reasons.

Fingerprinting relies on signals like screen resolution, installed fonts, GPU details, and timezone, none of which a VPN touches. A VPN changes your apparent location and keeps your ISP from logging your browsing traffic, which meaningfully reduces your exposure to mass data collection. But then you're trading the trust of your ISP to a random VPN company. So it's about who you trust more in that scenario.

Most other privacy extensions add little nowadays. User-agent switchers make you more identifiable rather than less, since they create an unusual fingerprint of their own. Standalone tracker blockers duplicate what uBlock Origin already does.

Tor Browser meaningfully counters advanced fingerprinting techniques. You could use that if you need anonymity, but it's probably overkill for casual use. See https://thenewoil.org/en/guides/prologue/secprivanon/