Brute Force Incognito Browsing
nullprogram.com
Brute Force Incognito Browsing
1–10 of 50 posts
Re: Brute Force Incognito Browsing
#2I noticed a while back that Safari disallows HTML storage in private browsing more - dead giveaway. Chrome and FF allow it but probably clear storage when the session ends.
Re: Brute Force Incognito Browsing
#3The annoying first-time experience can be disabled by putting some files in the new profile. i.e. instead of creating a new empty profile every time, clone one that is already initialized.
Re: Brute Force Incognito Browsing
#4I noticed a while back that Safari disallows HTML storage in private browsing more - dead giveaway. Chrome and FF allow it but probably clear storage when the session ends.
Safari private browsing is to the point where if you open a new tab you're not signed into the same websites as your other tabs.
It's pretty annoying actually, but it's a good feature.
Re: Brute Force Incognito Browsing
#5These are great! Thank you for the writeup and code.
Do you have a way to donate to you to thank you? Or do you have a favorite charity?
Re: Brute Force Incognito Browsing
#6tl;dr create a brand new, disposable profile. instead of the browser built-in private mode.
Re: Brute Force Incognito Browsing
#7I noticed a while back that Safari disallows HTML storage in private browsing more - dead giveaway. Chrome and FF allow it but probably clear storage when the session ends.
Safari private browsing is to the point where if you open a new tab you're not signed into the same websites as your other tabs. It's pretty annoying actually, but it's a good feature.
I think they may have relaxed that requirement a bit recently, so that you remain logged in if you click a link that opens in a new tab.
Re: Brute Force Incognito Browsing
#8I do something very similar; there are two main differences
* I make a copy of a special default profile instead of a fresh one - eliminating a bunch of annoying popups and preserving add-ons
* I set it as my default browsing experience ('web') so that anything that tries to launch a browser window also gets contained
Re: Brute Force Incognito Browsing
#9This sounds like pretty much the same argument that @eganist and I made to Google and Mozilla a little while back before demoing an HPKP supercookie (https://github.com/cyph/hpkp-supercookie) at Black Hat and DEF CON.
Our position was that doing just about anything less than what Chris did here was essentially lying to users about incognito mode's threat model, but if I recall correctly both teams viewed other security tradeoffs (such as carrying over HPKP and HSTS state) as worth considering infringing on incognito's stated purpose.
In the end they did both follow our suggested mitigation for the HPKP issue (before Google turned around and deprecated HPKP out of nowhere ಠ_ಠ), but it isn't surprising to hear that similar issues may still exist.
Re: Brute Force Incognito Browsing
#10I use Firefox Focus on my mobile devices. It blocks trackers and you can easily delete your history and cookies.