List of Interesting Experimental Flags for Google Chrome to Try Out

[Ink]

@Windows_Security
Thoughts about using Isolate additional origins, if know-how is possible?
chrome://flags/#isolate-origins

Requires dedicated processes for an additional set of origins, specified as a comma-separated list. – Mac, Windows, Linux, Chrome OS, Android

Disabled by default;
Chrome 75.x

 

[Windows_Security]

@Windows_Security
Thoughts about using Isolate additional origins, if know-how is possible?
chrome://flags/#isolate-origins

View attachment 215612

Disabled by default;
Chrome 75.x

It is for corporate use (protecting tailor made web applications) Isolated Origins

 

[Windows_Security]

@Windows_Security
Thoughts about using Isolate additional origins, if know-how is possible?
chrome://flags/#isolate-origins

View attachment 215612

Disabled by default;
Chrome 75.x

EDIT: site isolation is set to ON by default for ALL domains. When SITE ISOLATION is DISABLED, it is possible to ENABLE site isolation for the domains specified with this flag: e.g. ENABLE and add in the text box WEBSITE1.COM, DOMAIN2.ORG, etc

SO when your favourite gaming website would require you to disable SITE ISOLATION (for all), you can still list your favourite XXX websiites here, so you can watch human interaction videos at ease knowing that they are still running in the safer "Site Isolation mode"

The per process means that the domains specified are run in a seperate process using SITE ISOLATION.

 

[Ink]

Thanks for the updated information, it makes a lot more sense now.

 

[bjm_]

Um, what happened to these flags .....

.... flags not found with Version 78.0.3904.70 (Official Build) (64-bit)

 

[HarborFront]

You can enable DNS-over-HTTPS by enabling

Secure DNS lookups

and some new flags in Chrome 78

Google Chrome 78 is out: Forced dark mode, DoH trials, no more XSS Auditor

Password Checkup tool makes its debut and the New Tab page gets more customization features.

www.zdnet.com

 

[cryogent]

DoH Update: Due to a last minute technical issue, we have postponed this experiment to Chrome 79.

 

[HarborFront]

DoH Update: Due to a last minute technical issue, we have postponed this experiment to Chrome 79.

Your article in the link was dated

Tuesday, September 10, 2019

 

[cryogent]

Yes indeed, the z....com article is written in octomber ...but is in one of the links provided by them..
"read the upcoming release notes for details about DoH policies which will be published on our Chrome Enterprise blog."
And in my stable 78 Chrome release this flag/settings is not available...and in article is mentioned is in a Chrome stable release.
I hope i dind't miss understand the article.

 

[bjm_]

Any way to display the full URL address again in the address bar/omnibox.
I used these flags in 77.0 #85.
https://www.askvg.com/tip-restore-https-and-www-in-website-urls-in-google-chrome-address-bar/
Now, in 78.0 those flags are gone.
Any way to display the full URL address in the omnibox without double click?

 

[oldschool]

Anyone using Cross Origin Isolation flag? I now see it in Brave.

 

[Moonhorse]

Anyone using Cross Origin Isolation flag? I now see it in Brave.

I enabled it now for vivaldi, thought it would be already enabled by browser

 

[cryogent]

This flags:
"Prefetch requests for cross-origin main resources are fetched with a special NetworkIsolationKey "
or
"Prefetch request properties are updated to be privacy-preserving "

must be enabled if "Cross Origin Isolation" is enabled?

This flags is in Brave.

 

[SeriousHoax]

Anyone using Cross Origin Isolation flag? I now see it in Brave.

Is it similar to Firefox's "first party isolation"?

 

[Lenny_Fox]

I use the experiments below for enhanced privacy, security and performance.

Privacy

• Anonymize local IPs exposed by WebRTC (only shows public IP, not home network IP)
• Reduce default 'referer' header granularity (only provides domain name as referer)
• Prefetch request properties are updated to be privacy-preserving (block referer and credentials for cross origin prefetch request)

Security

• Cross Origin Isolation (enables cross origin opener and embedder policy to reduce risk of speculative attacks)
• Strict Origin Isolation (strengthens the site isolation policy further by blocking cross origin frames in same site scripts)
• Treat risky downloads over insecure connections as active mixed content (blocks download of executable content over HTTP)
• Secure DNS lookups (Enables DNS over HTTPS, Opera users should use Secure DNS)
• Extension Content Verification - Enforce strict (verifies contents of the files from extensions are what they should be)

Performance

• Parallel downloading (enable to accelerate download speed)
• Load Media Router Component Extension (prevents loading of media router extension at startup).
  The media router allows the client to negotiate a peer-to-peer media streaming session via WebRtc and Cast Streaming.

 

[Sampei Nihira]

I use the experiments below for enhanced privacy, security and performance.

Privacy

• Anonymize local IPs exposed by WebRTC (only shows public IP, not home network IP)
• Reduce default 'referer' header granularity (only provides domain name as referer)
• Prefetch request properties are updated to be privacy-preserving (block referer and credentials for cross origin prefetch request)

Security

• Cross Origin Isolation (enables cross origin opener and embedder policy to reduce risk of speculative attacks)
• Strict Origin Isolation (strengthens the site isolation policy further by blocking cross origin frames in same site scripts)
• Treat risky downloads over insecure connections as active mixed content (blocks download of executable content over HTTP)
• Secure DNS lookups (Enables DNS over HTTPS, Opera users should use Secure DNS)
• Extension Content Verification - Enforce strict (verifies contents of the files from extensions are what they should be)

Performance

• Parallel downloading (enable to accelerate download speed)
• Load Media Router Component Extension (prevents loading of media router extension at startup).
  The media router allows the client to negotiate a peer-to-peer media streaming session via WebRtc and Cast Streaming.

Of your list I don't use:

Anonymize local IPs exposed by WebRTC = UBO
Load Media Router Component Extension

But I add to Chrome the 2 Command Line Switches that I have mentioned several times.

 

[oldschool]

What about "TLS 1.3 hardening for local anchors"?

 

[ForgottenSeer 85179]

What about "TLS 1.3 hardening for local anchors"?

Anyone know why this isn't present in Chromium-Edge?

 

[Sampei Nihira]

What about "TLS 1.3 hardening for local anchors"?

Better to disable TLS 1.0 and TLS 1.1.

Anyone know why this isn't present in Chromium-Edge?

The Command Line Switch for disabling TLS 1.0 and TLS 1.1 also works in Chromium/Edge.

 

[ForgottenSeer 85179]

The Command Line Switch for disabling TLS 1.0 and TLS 1.1 also works in Chromium/Edge.

Also if someone need: The command line switch for that is:

 --ssl-version-min=tls1.2

Site to verify the setting: https://clienttest.ssllabs.com:8443/ssltest/viewMyClient.html