Featured Articles

WordPress Profiling with XHProf (Debugging & Optimizing Speed)
Introducing BusKill: A Kill Cord for your Laptop
Trusted Boot (Anti-Evil-Maid, Heads, and PureBoot)
Why I was banned from GrapheneOS by Daniel Micay
Techlore Interview (BusKill, Interdiction, and OpSec)
Continuous Documentation: Hosting Read the Docs on GitHub Pages (2/2)
WordPress Multisite on the Darknet (Mercator .onion alias)
Detecting (Malicious) Unicode in GitHub PRs
Hardening Guide for phpList
Crowdfunding on Crowd Supply (Review of my experience)
previous arrow
next arrow

Persistent, Sandboxed, Single-Site Browser (firejail and proxychains)

Persistent, Sandboxed, Single-Site, Browser

Or how to avoid getting locked-out of another Google Account

This guide will describe how to setup a persistent browser (for Evil Corp) that’s isolated in a sandbox (with firejail) and forced to use a SOCKS5 proxy to retain a static IP address (using proxychains)

Have you ever been locked out of your own account, and then got an email for your service provider annoyingly letting you know that they’ve “blocked a login attempt — for your protection?“

There’s countless reports of frustrated users who have permanently lost access to their own gmail accounts because of Google’s faulty “fraud protection” systems that locked the account owner out of their own account, due to false-positives.

Problem

Especially the past 10 years, large corporations have been using machine learning anomaly detection systems on their login pages. Unfortunately, sometimes this is (ab)used to have priority over credential authentication challenges.

Even if you enter your username, password, and 2FA credentials correctly on the very first login attempt, you may get locked out of your own account because you “look different”

Even if you enter your username, password, and 2FA credentials correctly on the very first login attempt, you may get locked
. . . → Read More: Persistent, Sandboxed, Single-Site Browser (firejail and proxychains)

Using uBlock Origin to Whitelist

As some mega websites deploy APIs that are used nearly ubiquitously on most of the Internet’s websites (I’m looking at you Facebook & Google), I’ve begun to compartmentalize my browsers to “jail” specific website usage to a single, sandboxed browser (profile). This is sometimes referred to as a Site-Specific Browser (SSB).

Besides making sure that your SSB is isolated in that it cannot access your regular browser’s data (a configuration I plan to document in the future), it’s essential to block all network traffic from/to your SSB and all websites, except a whitelist. Unfortunately, getting block-all-then-whitelist functionality in uBlock Origin was annoyingly not documented, so I decided to publish it.

If you want uBlock Origin to block all traffic, add the following line to the textbox in your “My filters” tab of uBlock’s Dashboard.

*.* Michael Altfield

Hi, I’m Michael Altfield. I write articles about opsec, privacy, and devops ➡

About Michael


. . . → Read More: Using uBlock Origin to Whitelist