Google Quietly Enables 'Site Isolation' Feature for 99% of Chrome Desktop Users

Google has quietly enabled a security feature called Site Isolation for 99% of its desktop users on Windows, Mac, Linux, and Chrome OS. This happened in Chrome 67, released at the end of May. From a report: Site Isolation isn't a new feature per-se, being first added in Chrome 63, in December 2017. Back then, it was only available if users changed a Chrome flag and manually enabled it in each of their browsers. The feature is an architectural shift in Chrome's modus operandi because when Site Isolation is enabled, Chrome runs a different browser process for each Internet domain. Initially, Google described Site Isolation as an "additional security boundary between websites," and as a way to prevent malicious sites from messing with the code of legitimate sites.

10%

[phantomfive]

10% memory usage increase, according to the article. Defends against spectre and meltdown somewhat.

Re:

[Z00L00K]

But is the site isolation complete so that all cached info is now tied to the site you browse and third party cookies and cached data as well is living in total separation?

Re:

[phantomfive]

I was wondering that, too. Merely forking the code isn't enough, if your stored passwords get forked, too. I didn't wonder enough to read the source code, though.

Re:

[DontBeAMoran]

We need this running on a Raspberry Pi Zero, so I can have an independant DNS server internally that all our devices can connect to it (Nintendo, Playstation, Xbox, PCs/Macs, smartphones, tablets, etc).

Re:Registered /.ers review of the Win64 model

[nullbort]

https://pi-hole.net/ [pi-hole.net]

Re:

[DontBeAMoran]

Thank you.

Re:

[f3rret]

The switched your meds again, eh?

Re:

[f3rret]

Actually dude my legal name is f3rret.

Huh.

[waspleg]

I was under the impression they were already doing that. I don't use Chrome, though, so I guess I didn't notice.

Is it just for the URL in the address bar?

[dwywit]

Or does it cover each and every third-party domain, e.g. all the advertising domains pinged by landing on a web page?

Those domains are just as dangerous, if not more so, than the domain shown in the address bar.

Disabled by default?

[iamagloworm]

99% of users? I am on the latest chrome and it was disabled for me. Check at chrome://flags/#enable-site-per-process

Re:

[Gavagai80]

Same for me, on Chrome 67. Perhaps it's only enabled for new installations for now?

Re:

[Actually, I do RTFA]

Same for me, on Chrome 67. Perhaps it's only enabled for new installations for now?

Given the number of users Slashdot has, and the sampling bias in reporting bugs, it seems far more likely you and the GP are just still part of the 1%.

Re:

[Gavagai80]

Well, it's nice to finally be part of the 1% even if it's the wrong 1%.

Re:

[onco_p53]

Yes off for me as well, thanks for the link to change the option.

Re:

[Pepsiman]

The description of the flag says:
"When disabled, the site isolation mode will be determined by enterprise policy or field trial."

The flag is shown as disabled for me, but it's obvious from Chrome's task manager that site isolation is enabled.

Re:

[arglebargle_xiv]

99% of users? I am on the latest chrome and it was disabled for me. Check at chrome://flags/#enable-site-per-process

I've tried this with my copy of Chrome and it reports: "Firefox error: The address isnâ(TM)t valid". I'm running Chrome version.... um, 61 "Quantum". Maybe that's the problem, I need to wait for Mozilla to release version 67?

Well great

[Niobe]

Now I don't need to turn it on manually.

So the approved ads

[AHuxley]

really know the user is looking and only approved ads get displayed.

Is this just Specter, etc?

[Actually, I do RTFA]

Since the pages can communicate to each other (and presumably access information on each other as allowed by the JS spec), is this just about protecting people from Specter, etc?

Re:

[Specter]

Muhahaha! There is no protection from me!

Site/Tab isolation

[EdmundSS]

What I'd like to see is more extensive than that: If you log in to a website in tab A, then tab B has no access to that (especially cookies) unless tab B is created off tab A (e.g. Open in New Window), or explicitly authorised.