Google Chrome Incognito Mode Can Still Be Detected

https://www.bleepingcomputer.com/news/google/google-chrome-incognito-mode-can-still-be-detected-by-these-methods/

by nradov • 7 years ago

440 193 7 years ago

Rapzid3• 7 years ago

Pretty embarrassing TBH. Both of those detection methods immediately come to mind when reading about their in-memory solution to the storage API problem. I can only imagine Google phoned it in on this one.

rasz• 7 years ago

in a galaxy far far away Opera 12.x offered fully customization local storage, with per domain/subdomain enable/disable/quota/delete on exit options. Google owns our browsers and wont let us do anything crazy like configure away stuff useful for ad targeting.

420codebro• 7 years ago

I believe google has cut a deal with advertisers to ensure they can always identify incognito.

adrianmonk2• 7 years ago

Workaround for now:

1. Open the profile menu. (This is the icon in the top right, just to the left of the three vertical dots.)

2. Click "Manage people", click "Add person" (lower right).

3. Type "Darned Newspapers!" and click "Add".

4. When you get blocked, copy URL, use the profile menu to navigate to open a new "Darned Newspapers!" window, paste URL.

It's a real profile, so it should behave quite closely and should be harder to detect. Of course, unlike incognito mode, it will save your history, so be aware of that.

towndrunk• 7 years ago

Your other left. :)

adrianmonk2• 7 years ago

Oops, I'll fix that.

thaumasiotes• 7 years ago

Another workaround:

Disable javascript on the newspapers' sites. They load the full article and then use JS to hide it. (They also use JS to do the incognito detection in the first place.)

denkmoon• 7 years ago

Often doesn't work, they now take a new approach by only loading in the extra content if you pass their checks (using JS). Not using JS will get you the first paragraph.

koolba• 7 years ago

I hope this never changes. It’s so easy and works so well, even on mobile!

Talking about this makes me feel the same as when I discuss youtube-dl.

irq11• 7 years ago

I have started giving websites a one-strike rule for javascript. If you pop up a paywall, a modal, an autoplay video, or anything else that distracts me, you permanently lose js execution privileges on my browser.

The world would be a better place if developers knew that they can’t count on javascript.

schma• 7 years ago

Alternatively you could use Firefox's Container Tabs.

shade• 7 years ago

This works especially well when combined with the Cookie auto-delete extension.

Vinnl• 7 years ago

Link: https://addons.mozilla.org/en-US/firefox/addon/multi-account...

crazygringo2• 7 years ago

Is this a cat-and-mouse game that's worth playing for Chrome?

Browsers are so complex that I imagine incognito mode is always going to leave some kinds of statistical signatures that can be detected and exploited through merely moderate cleverness, but will be much harder to hide on Chrome's side.

Is it worth it for Chrome? Or would resources be better spent on other parts of the browser?

It's not really a privacy/security problem or anything as far as I can tell -- just a way to bypass paywalls, right? "Sites not detecting my incognito mode" never felt like part of the web's "contract" to me.

breatheoften• 7 years ago

Pretty important for scrapers ...

asdfasgasdgasdg• 7 years ago

As far as cat and mouse games go, it's one that's tilted heavily in favor of the Chrome devs. The mice have to advertise themselves very conspicuously in order to gain utility from their workarounds. Cats can usually catch mice that announce themselves.

All they have to do is navigate to a site using incognito mode detection and briefly review the code to find the next hole to plug. In this case, probably stop advertising the correct limit for incognito mode, and introduce latencies on writes to mimic a real file system. These are not a trivial fixes, but they also are not hard.

PeterisP• 7 years ago

One part of the "web's contract" is that googlebot and other scrapers should get what the users get. And vice versa - if you're telling googlebot that there's a particular text available to the public; I'd expect to get the same content that you just gave googlebot and not something else, thank you very much.

jacquesm• 7 years ago

That used to be the case. But Google has long ago given certain sites a pass on that.

crazygringo2• 7 years ago

What do scrapers and indexing engines have to do with it? Is it normal for them to run a full headless browser in incognito mode?

I was under the impression that they're either just doing straight HTTP requests for HTML only... or they're running a full headless browser in normal mode.

So I'm not getting what's different here?

Sites have a long history of serving up different content to different users, e.g. to paying users, or blocking certain countries based on content contracts. It's certainly not part of the "web's contract" that scrapers get paywalled content they haven't paid for.

NickGerleman• 7 years ago

I’m a bit surprised Chrome developers went the route of an in memory filesystem instead of trying to sandbox and clear real disk access. Silently using up to 120MB without realizing sounds pretty bad.

foota2• 7 years ago

You can't allow for bytes to sit around on disk in case of crash.

Maybe they could encrypt with a key kept in memory? That'd still allow detection of use though.

samtheprogram• 7 years ago

Why not just use a temporary file system like /tmp?

EDIT: I suppose these are often backed by memory anyway, so not sure if this would solve the problem, but interested in hearing arguments around it nonetheless.

oconnor6632• 7 years ago

You could encrypt both the regular one and the incognito one, with the only difference being that you persist the key for the regular one.

Rapzid3• 7 years ago

On the surface this sounds like a good approach. The overhead of encryption should be very consistent and get buried in general file-system latency.

sgentle• 7 years ago

I wonder if the privacy threat model includes being able to prove that you used incognito mode at all, when, or how much. I can imagine all sorts of leaks in that regard (how many incognito disk files were created, size/ctime/mtime, system logging, indexes etc). None of these would require physical access to the machine at the time of incognito browsing, just subsequently.

Might seem like an incidental concern, but being able to vacuum up a pattern of incognito sessions from a seized laptop (at a border crossing, say) and correlate it with the activity of an online pseudonym could be pretty useful.

Reason0772• 7 years ago

"You can't allow for bytes to sit around on disk in case of crash."

Just check periodically (at startup?) for orphaned temporary storage data. I'm sure there are other parts of the browser that need to do this sort of thing anyway - expired cache data, for example.

robocat• 7 years ago

But it is super easy to use 120MB by including images or other resources, or by creating elements, SVG, javascript etc.

A browser requires a generic solution to prevent denial of service due to excessive resource consumption.

Rapzid3• 7 years ago

If it were actually the case that these detection methods were not known when they shipped the in-memory storage solution.. I would find that incredible.

JaRail• 7 years ago

The point of incognito was never to hide that fact from the sites you're visiting. The point was to not leave a trace on the machine you're doing it from. Basically, it's for porn, not news.

Mindwipe5• 7 years ago

Yeah, it's weird to do this strategic about turn on it. It feels very much like the personal grievance of someone on the Chrome team rather than a thought through feature.

DenisM• 7 years ago

Can this fight ever be won?

If you've been browsing the internet for more than 5 minutes you already have cookies from some of the major ad networks. Therefore if you do not have cookies from the major ad networks, you're either a brand-new device or an incognito browser. All that is left to do is get in bed with the ad network to ask them if they have good cookies for this session. As it so happens most of the companies trying to bust the incognito mode are already in that crowded bed.

The next loops in this spiral are: 1) an incognito mode that seeds good-looking ad cookies 2) ML models trying to distinguish synthetic/cloned/5-seconds-old cookies from genuine ones 3) matching ML models trying to out-fox the models from step 2, and so on.

The last fit of madness will be a hidden session in Chrome browsing the web on your behalf, building up a bogus profile for the ad networks, and the ad networks trying to figure out if the clicks in your fake session are sufficiently human-like.

And whoever wins in this war, the ad networks will end up collecting even more data than they do now.

underwater• 7 years ago

Alternatively, Google starts crawling the web in incognito mode; punishes websites that hide content.

adtac• 7 years ago

I understand the point of using a special user-agent to crawl webpages for indexing, but search engines should use a "regular" browser UA string (full JavaScript, etc. to simulate an actual browser) occasionally. From a different IP range too, of course. If the contents of the page are wildly different, penalise the site.

propogandist2• 7 years ago

Google is an advertising company and everything they do is to improve the core ad-business. If Google had it their way every website would be using AMP, allowing google to have more control over the web, allowing them to become the only ad-network.

djflutt3rshy• 7 years ago

The last fit of madness will be a hidden session in Chrome browsing the web on your behalf, building up a bogus profile for the ad networks, and the ad networks trying to figure out if the clicks in your fake session are sufficiently human-like.

The first parts of this have already been tested by Mozilla: https://trackthis.link/

dorgo• 7 years ago

https://trackthis.link/

It opens 100 tabs? With third-party ressources and javascript blocked, it will do little in terms of shaping my ad-profile. But maybe 4GB are not enough to open 100 tabs, so I skipt this.

tfha• 7 years ago

Just don't use sites that dont respect your privacy. If it doesn't like you blocking cookies, walk away.

TylerE4• 7 years ago

So, don't use the internet? Because that's what you're describing.

Better cut the power cord, too, just to be safe.

tomjen33• 7 years ago

I highly recommend Temporary Containers for Firefox. It can be set up so that every time you open a new tab, that is a new context, new logins, new cookies.

No reason to block sites that set cookies, since in a few minutes they will be deleted anyway.

Sir_Cmpwn2• 7 years ago

How about passing laws which forbid tracking users like this and levying steep, business-ending fines against the companies who don't step in line?

kspacewalk2• 7 years ago

No problem. All your favourite online services are no longer free though, what a bummer. Will it be a lite, regular or premium Google maps subscription? How about Facebook Messenger?

nashashmi• 7 years ago

As for cookies against ad networks, I browse with all third party cookies blocked. Some cookies from third parties are allowed. So that would not be the effective against people with high security settings.

And there is also the possibility of a brand new computer with no cookies. Then that kind of detection will not necessarily work for every one.

onion2k• 7 years ago

The owners of these websites don't care about false positives (like people on new computers). Their interest is in maximising the number of ads shown and nothing else.

auslander3• 7 years ago

.. Chrome browsing the web on your behalf, building up a bogus profile for the ad networks

Chrome is an ad network itself, well, a biggest player. I'm browsing in default Private mode on Safari for years, so yes, my fight is over, no cookies for me, lol. And on always-on VPN.

microcolonel• 7 years ago

Maybe they should start randomly sharing adtech cookies through the cloud.

aeternus• 7 years ago

This is similar to what I'd like to see. Sharing cookies is somewhat dangerous since they could have login/user data, but it would totally work to avoid browser fingerprinting. With all the fingerprinting methods (screen resolution, GPU, HW, font-list, etc.) it's a losing proposition to attempt to remove all traces of a unique fingerprint.

Instead I'd like to see a browser that generates such a noisy fingerprint that it is useless: Each time I start an 'anonymous' session, grab a fingerprint from a pool that is sufficiently similar to mine that things render properly (matching resolution for example) but that has also been used by thousands/millions of others.

elorant• 7 years ago

The fight can be won if you block 3rd party JavaScript. Just install uMatrix and enjoy browsing the web in half the time it takes without it. No ads, no trackers, no Facebook widgets, just the web we learn to love. Sanity.

rocky1138• 7 years ago

Do you know of any way through the about:config editor to do this? I'd hate to have to install yet another browser plugin.

dheera2• 7 years ago

What is nytimes.com using now to detect incognito? Enabling filesystem in incognito used to work until a few days ago.

alacombe• 7 years ago

IIRC, the trick is to time filesystem access and deduce you're running from RAM rather than disk, thus in incognito mode.

fourthark• 7 years ago

The article says they are using the quota trick.

oconnor6632• 7 years ago

Sites don't want to bust the experience for brand new devices I think. That would include things like internet cafes where you log into a clean desktop environment, or browsers you use rarely like maybe one in your car. I think if Google can just get a real disk-backed implementation working for Incognito mode, such that there actually is no difference between Incognito and a new regular browser, this feature will be valuable.

cortesoft• 7 years ago

If they want to block incognito mode, wouldn't they also want to block someone from an Internet cafe? If the reason you block incognito mode is because you can't track the user, you don't want a user coming from an Internet cafe that you can't track.

na852• 7 years ago

I feel as though your argument is predicated on browsers that leak tracking data such as cookies, etc.

If the browser vendors would tighten their products up and start considering things like profiling the user's installed fonts as a security vulnerability, then we might see some progress. Unfortunately Google has a financial incentive to make Chrome trackable to advertisers.

jolux• 7 years ago

Safari has already started introducing protections for attacks like font profiling and knowing the Chrome security team I would be surprised if they haven’t at least considered that as well.

IX-103• 7 years ago

Don't forget that the advertisers don't get income directly from tracking you. They get income based on how good they have a profile of your interests (and things that you would buy). If they can get a good enough profile without tracking then maybe they'll stop tracking. Or maybe it would be easier to block the few that continue taking than wave war on an entire industry....

There's already been some talk about changing things so that tracking is less necessary (https://webkit.org/blog/8943/privacy-preserving-ad-click-att...) and I wouldn't be surprised if a lot more comes out by the end of the year.

Anyway, anyone that knows the details of the web could have seen this coming. [Private mode is not private](https://brave.com/private-mode-is-not-really-private/). Websites can calculate fingerprints from users just by running JavaScript (they can easily get the processor speed, GPU version, local IP, and other details) so they can identify you even if you clear cookies. And the funny thing is that all of these APIs have reasonable intended uses and getting rid of them would large portions of content on the web.

0xADEADBEE• 7 years ago

In the same way that ublock is a must-have extension for many people, I won't browse without cookieAutoDelete [0]. Mostly I don't bother authenticating with websites anymore, and (I think about 3 maybe? And I just reauthenticate when I want to use those) and for mobile browsing I mostly use Firefox Focus [1]. The ad networks are down to browser fingerprinting now, which will be devastatingly accurate but realistically be the next frontier in the privacy war. I habitually roll IP addresses from different VPS service providers but I'm not sure there's much more an end user can do currently. Fascinated to see how this front will develop - if things like GDPR are coming into effect, then it's only a matter of time before a gratuitous misuse of data is closed in on, though I suspect it's too late for the current generation.

[0] https://addons.mozilla.org/en-US/firefox/addon/cookie-autode...

[1] https://support.mozilla.org/en-US/kb/focus

kevin_thibedeau• 7 years ago

Random user agent to throw off the fingerprinting. Decentraleyes to defeat CDN tracking.

JMTQp8lwXL• 7 years ago

The browser shouldn't be providing a User Agent anyways. No matter what device I use, my user agent should have no bearing on the HTML or JS I receive.

millstone• 7 years ago

The big idea here is that the web advertising economy is user-hostile, and has to go. Someone - Apple, Chrome extension, whatever - will go nuclear, and craft the AI ad blocker that will do to ads what Gmail did to spam. God willing.

gfosco• 7 years ago

I think the solution lies in a system that doesn't use HTTP. Been thinking about it for years.

B-Con• 7 years ago

All that is left to do is get in bed with the ad network to ask them if they have good cookies for this session.

What's funny is that this is pretty much what ReCaptcha v3 is. Asking how "authentic" the Google cookie looks.

sgjohnson• 7 years ago

If you've been browsing the internet for more than 5 minutes you already have cookies from some of the major ad networks.

I don't, as I block all third party cookies. No exceptions.

m12k• 7 years ago

Interesting. Are there any legitimate uses for third party cookies (i.e. functionality that you as the user actually care about) or are they only ever used for tracking?

swebs2• 7 years ago

I remember around 10 years ago people were calling Stallman paranoid for this. Now he seems more like a prophet:

I generally do not connect to web sites from my own machine, aside from a few sites I have some special relationship with. I usually fetch web pages from other sites by sending mail to a program (see https://git.savannah.gnu.org/git/womb/hacks.git) that fetches them, much like wget, and then mails them back to me. Then I look at them using a web browser, unless it is easy to see the text in the HTML page directly. I usually try lynx first, then a graphical browser if the page needs it (using konqueror, which won't fetch from other sites in such a situation).

https://stallman.org/stallman-computing.html

shultays2• 7 years ago

Well, that is a bit paranoid.

walrus01• 7 years ago

I mean, if you want to be super paranoid like that there's no need to use a script to fetch webpages into email format. Use some sort of vnc-over-ssh session to a disposable virtual machine hosted 9500 km away, to browse interactively in a GUI, running firefox+sensible privacy extensions inside xfce4/xorg. With the right automation you could have the vm overwrite itself from an image file every day.

This could be done on the CPU+RAM+disk resources of a $4.50/month vm.

For the purpose of not being tracked by advertising networks (not a nation-state intelligence agency), a stateless vm located on a static ipv4 /32 in bulgaria that saves absolutely no data would be rather hard to track back to its actual user.

imgabe• 7 years ago

Ultimately, if you block ads isn't the tracking useless?

Sure, you can figure out the perfect ad to show me, but if I'm never going to see it, you're wasting your time.

yummypaint• 7 years ago

That arms race is winnable because its a question of economics, not capability. As long as the cost of unmasking people remains higher than the expected profit from doing so, the fight is won.

NullPrefix• 7 years ago

If you've been browsing the internet for more than 5 minutes you already have cookies from some of the major ad networks

This does not really work without 3rd party cookies, does it?

tinus_hn• 7 years ago

Yes, Google is committed to patching out anything used to detect incognito mode. If they make good on that promise detection will become harder and harder until it becomes practically impossible.

Incognito mode can be made to look exactly as if you opened your browser after creating a new profile and immediately opening the site. As long as they can’t afford to block these users it can be made to work.

anticensor• 7 years ago

You can remove the as long out of the last sentence and it still makes sense.

madars• 7 years ago

This is annoying so I just use fresh browser profile every time I encounter such site, i.e. have a short-cut for:

  $ cat ~/bin/chrome-new 
  #!/bin/sh
  TMPDIR=`mktemp -d /dev/shm/chrome-XXXXX`
  google-chrome --user-data-dir=$TMPDIR --no-first-run --no-make-default-browser "$@"
  rm -rf $TMPDIR

IggleSniggle2• 7 years ago

Very nice!

aasasd2• 7 years ago

In FF, this seems to be solved with the mechanism of containers and extensions like ‘Temporary Containers.’

envolt• 7 years ago

Temporary Containers is a savior when it comes to paywalled articles.

appleflaxen• 7 years ago

This is really an awesome command line hack.

For those like me who need a bit more detail:

1) make a text file called chrome-new

2) put the following contents in the file in a POSIX-like OS

  #!/bin/sh
  TMPDIR=`mktemp -d /dev/shm/chrome-XXXXX`
  chromium-browser --user-data-dir=$TMPDIR --no-first-run --no-make-default-browser "$@"
  rm -rf $TMPDIR

3) make the text file executable:

  chmod u+x chrome-new

This also uses the chromium executable for chrome, which I think is the default on debian-based systems. If this isn't applicable to you, change "chromium-browser" on the third line to whatever the executable is for chrome on your system.

m-p-3• 7 years ago

Firefox Containers¹ are nice for that. Put the website in its own sandbox.

1: https://addons.mozilla.org/firefox/addon/multi-account-conta...

My only gripe is that the containers won't be in sync accross systems, which is already time-consuming to setup..

ridaj2• 7 years ago

Partly for this reason I use Firefox with its "delete cookies when quitting" mode instead.

auslander3• 7 years ago

Why not use Permanent browsing mode?

auslander3• 7 years ago

I meant Always use Private browsing checkbox.

hellotoby• 7 years ago

You may like the Temporary Container add-on https://addons.mozilla.org/en-US/firefox/addon/temporary-con...

wintorez• 7 years ago

Client tracking throw Browser Fingerprinting is a spooky tech. Check these two websites to see for yourself. Try using different browsers, even aVPN connection, and see how trackable you are:

1) https://panopticlick.eff.org 2) https://amiunique.org

anamexis• 7 years ago

The amiunique.org one was very enlightening - along with my user agent, my content language header was giving away a huge amount of information around me. Long ago I selected German (second language) as a secondary language, and that combination is the rarest thing I have going for me.

kristopolous• 7 years ago

These things state I'm unique every time I go to them. That's the problem with the tech, it can't track very well.

TazeTSchnitzel• 7 years ago

It's stable but not over a long period because your browser will change. But it could be used to link two identifiers together, for example when your IP address changes, to create a chain that can track you over time.

swebs2• 7 years ago

Goddamnit, I'm blocking everything except CSS and images through uMatrix and it was still able to determine I was unique due to the "If none match" header.

crb002• 7 years ago

So do random cookies?

mark_l_watson• 7 years ago

OK, this article was not what I expected. I use incognito mode whenever doing online banking, searching for medical information, etc. I don’t care if a web site knows I am in incognito mode. Indeed, I think it is a web site’s right to know because they may need to enforce free access quotas, etc.

zzo38computer2• 7 years ago

I think they would have no right to USE YOUR COMPUTER to enforce such quotas, please.

git-pull• 7 years ago

They can paywall / block incognito all they want.

Just delist the (paywall'd) articles. That's the annoying thing - when articles come up on Google and you can't read them. Please fix this.

If people want to pay, that's fine. Perhaps ISP's should pay for these websites via their plans so there's no more need to login.

I don't want to login to something just to browse a feed. I believe people would be happy to pay for these websites, but in a convenient way, ahead of time. Allow IP ranges, create a browser plugin that reauthorizes the site session even in incognito / w/o password saving. Innovate like Spotify did.

Annoying and badgering the user is 101 UX antipattern. One reason some don't buy is they don't want to encourage it.

It's fair to hold them to a high standard because many of these websites are articles and presentation is supposed to be a forte. You don't battle the adblockers and incognito modes - you fight to make it easier and more convenient for your readership.

redleggedfrog• 7 years ago

"Can this fight ever be won?"

No, the point is to make the people subverting this for their own nefarious gains (looking at you, NYT) put so much effort, money, and time into it, that eventually they die a slow horrible death and, maybe, just maybe, something better and more relevant and less evil comes along (or maybe NYT changes their ways - either works).

I mean, look at this thread, so may great undermining methods! Beautiful.

BurningFrog• 7 years ago

After all the newspapers die a slow horrible death, I think the world will figure something better out.

But it might take a few decades of uninformed confusion.

caf• 7 years ago

Seems like the TWTF is that in normal browsing mode, sites are allowed to use considerably more than 120MB of "temporary" storage on the filesystem.

zzo38computer2• 7 years ago

I agree; by default it shouldn't be so much. (Maybe the user could configure it (to any range between zero and 4 GB, perhaps), but even then, the limit should not differ for incognito mode unless the user configures it the same.)

mirimir• 7 years ago

They can track Mirimir all they like. Not that it'll do them much good. Because Mirimir only does stuff that I'm OK with everyone knowing about Mirimir. And none of it is connected to my meatspace identity, or to other personas.

Unless you're really paranoid, all you need is a VM, which hits the Internet through a VPN service. You use the host machine for meatspace stuff, and the VM for private stuff.

nikolay2• 7 years ago

Yes. I just open an incognito window in Chrome and go to www.instagram.com and then it prompts me to log in via a list of Instagram accounts I've ever logged in in the non-incognito Window.

toper-centage• 7 years ago

If you use Chrome, did you really expect any kind of privacy to be respected?

nikolay2• 7 years ago

Well, they should be sued for false advertising. I know Google slices and dices all my info, but I expect them to honor my privacy when in incognito mode.

Lukesys• 7 years ago

Well duh, it is Google we are talking about!

NKCSS2• 7 years ago

The dutch cable company 'Ziggo' (owned by Liberty Global) also does Incognito mode detection in their web-based tv player and does not allow streaming.

https://imgur.com/a/TacdDRm

You can check it yourself here: https://www.ziggogo.tv/

Mindwipe5• 7 years ago

I don't believe that's actually their fault, HTML5 EME implementations don't work in incognito mode in Chrome.

But that is another way in which newspaper sites could do this detection is they wanted to, send an HTML5 EME clearkey to a one pixel video in the corner and get back the error response.

I think Google are on to a complete loser here tbh, and I'm not sure why they're wasting development resource. As much as using incognito mode to bypass soft paywalls might be fun for a user, there's no real moral justification. There's no privacy issue here in a newspaper giving a clear and unambiguous statement before you enter that you've got to disable incognito, and a user can either choose or refuse to do it. It's probably the clearest consent screen in the world.

NKCSS2• 7 years ago

Yeah, I know, but the article seems to not know about this.

Another avenue could be that they just check the uniqueness of your signature; if it's too generic: block content, and only lift it after installing a first party extension or something, that way, for most people it will just work and for the few that are false positives, you have a workaround. The whole goal of the incognito modus is also a way to detect it.

It's the same for adblockers; just serve a unique content key with the ad and check back via the ad provider if it was loaded before proceeding to serve content.

Only serving ad-free content to crawlers is no problem either, because ip ranges for the big ones are known and you can't spoof them in TCP. It's all a question of effort Vs reward. They probably know just a very small percentage of users will abuse it, so it's not worth it for them to spend a lot of effort blocking it.

For example: in a retail store, if there's a difference in expected vs actual money of ~€4, it's not even worth it to investigate, because it will cost more than you'll get back from resolving it. It's sometimes hard for me to comply because I always want to have stuff match 100%, but it's always a effort Vs reward dilemma that you have to work with.

tomjen33• 7 years ago

The moral justification could just as easily be turned around: a website does not get to run arbitrary code on my computer, so I can (and do, by default) turn of javascript.

anilakar• 7 years ago

Keeping local storage in memory might make sense if Incognito Mode had separate storage for every tab. However, it's just another browser session that gets wiped when the the last tab gets closed – you cannot have multiple parallel ephemeral sessions. I remember having to install Chrome Canary because I needed four separate Chrome sessions simultaneously.

mdaniel• 7 years ago

Your workflow is your workflow, but as an FYI Chrome profiles _also_ get their own everything, plus each profile also gets its own incognito session

There is an added benefit to using profiles in that if any other window is open from a separate profile, then all profile context menus acquire an "Open link in ..." menu item which will then list all the other profile names. Unknown why it doesn't do that context menu modification all the time.

If your other profiles are only used for development-time scenarios, you can also choose to "Clear Browsing Data..." on them at will, since you won't be losing anything valuable

Reason0772• 7 years ago

Seems like it was a mistake to use a RAM disk to back the storage API in incognito mode?

Why not just create a new "real" storage db on disk, deleting it when the incognito window/tab is closed? It seems like this approach would defeat all of this class of attacks.

martin-adams• 7 years ago

If Google really wants to fix this, they could always have Incognito mode detection as a negative ranking factor.

Traster• 7 years ago

I wonder if it's occured to these sites that essentially they're poking the bear. Sure, Chrome can slowly patch these issues, but there's always a possibility that Google just turns around and says "Hey guys! I search engine crawler looks like incognito chrome! Fuck you!"

JangoSteve• 7 years ago

Alternatively, instead of fixing these issues by making the incognito mode detection break, they should fix them by making regular mode look like incognito mode. Suddenly, all readers are blocked from reading NYTimes for half a day while they scramble to remove it from their site. Then they can start teaching sites that relying on hacks isn't a viable, sustainable strategy.

morgengold• 7 years ago

Why not just forbid the storage of user data? It would solve most problems. Why needs a whole society to be taken hostage for the profit of some companies?

I seriously do not understand.

Google Chrome Incognito Mode Can Still Be Detected

Related Stories