> I'm curious as to what users said as to why they didn't expect this behavior.
Users expect that the same account isn't logged in in multiple containers. For example, if I'm logged in to my gmail work account in my work container, I should be logged into it on my personal container. So your assumption that they expect to have explicitly logged in is right.
Further, I assume they may have enabled MS SSO and forgot about it or they thought it was only going to log them in the "No container" bubble. I haven't tested it myself but I guess MS SSO doesn't apply to private browsing right? Lots of container users are seeing them as a "private browsing from other container that persists reboots". So again, it breaks their expectation that something they consider only tied up to the "No container" is also affecting their containers.
Finally, they don't know that the login cookies for MS SSO aren't shared across containers but that they are logged with a new cookie "session" in each of them. That's where they might think the isolation is broken. On top of that, even if the cookies aren't shared, since you're logged to the MS account isn't it any risk now that data can be shared from one MS session to the other and in fact breaks the expected isolation?
Bug 1800971 Comment 5 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
> I'm curious as to what users said as to why they didn't expect this behavior.
Users expect that the same account isn't logged in in multiple containers. For example, if I'm logged in to my gmail work account in my work container, I shouldn't be logged into it on my personal container. So your assumption that they expect to have explicitly logged in is right.
Further, I assume they may have enabled MS SSO and forgot about it or they thought it was only going to log them in the "No container" bubble. I haven't tested it myself but I guess MS SSO doesn't apply to private browsing right? Lots of container users are seeing them as a "private browsing from other container that persists reboots". So again, it breaks their expectation that something they consider only tied up to the "No container" is also affecting their containers.
Finally, they don't know that the login cookies for MS SSO aren't shared across containers but that they are logged with a new cookie "session" in each of them. That's where they might think the isolation is broken. On top of that, even if the cookies aren't shared, since you're logged to the MS account isn't it any risk now that data can be shared from one MS session to the other and in fact breaks the expected isolation?