Live data from Hacker News

Bypassing anti-incognito detection in Google Chrome

mishravikas.com

1–10 of 114 posts

Re: Bypassing anti-incognito detection in Google Chrome

#3
there is only one way to get around this. incognito mode needs to emulate all system resources without actually making them available.

even without that consideration, for things like disk storage, there is no reason[1] why incognito mode should have less access than normal mode. all websites should function as normal. the only difference is that in incognito mode everything is wiped once it is closed, and nothing is written to disk.

[1] ok, so the reason for the limitation is that the disk has to be emulated in memory because incognito mode must not write to the disk which could leave artifacts behind.

this makes me wonder if it is possible to detect a difference in timing for example when writing lots of data with an emulated disk vs a real one.

Re: Bypassing anti-incognito detection in Google Chrome

#6
Is there any legitimate reason to allow arbitrary web apps to use gigabytes of space on my precious SSD, especially on mobile devices?

I'm becoming increasingly wary of web apps having all sorts of access to things outside of the browser, sometimes without explicit permission. Browsers should limit every app to the same amount, perhaps 100MB, or maybe even 10MB. Apps that need more should ask for permission.

Re: Bypassing anti-incognito detection in Google Chrome

#7
post #5

How is an additional chrome user profile that removes all history/cookies/ local storage on close different tracing-wise from an incognito session?

a profile that removes all history still writes to disk, and potentially leaves traces behind. (a backup could be running while the session is open, or a data could be left behind on a disk block because the files are deleted but not wiped)

incognite mode is useful for two situations:

A: you want to hide the fact that you visited a site.

B: you want to hide from the site that you have visited before.

the incognito-detection is largely against the second case (B), so your suggested workaround would work. what would also work is firefox tab groups. since each tab-group starts off empty.

the problem is that both ways are cumbersome. you have to open a new browser with that profile or you have to create a new tab-group and remove it after each use.

in firefox the problem could be solved by adding a "wipe, but don't delete tab group" feature. for the profile method you'd need a feature to "open link in new profile" to make that convenient.

Re: Bypassing anti-incognito detection in Google Chrome

#8
post #4

See the result your browser https://luke.lol/check-fs-quota.php

nice. can't see any difference in firefox. however, it is still possible to detect incognite mode in firefox as i have just been to a site that did so. (they didn't detect reader-mode however, so i was able to read the article after all)

Re: Bypassing anti-incognito detection in Google Chrome

#10
post #3

there is only one way to get around this. incognito mode needs to emulate all system resources without actually making them available. even without that consideration, for things like disk storage, there is no reason[1] why incognito mode should have less access than normal mode. all websites should function as normal. the only difference is that in incognito mode everything is wiped once it is closed, and nothing is…

If Chrome encrypted the data it wrote to disk, it can throw away the encryption key and delete the file when you close the incognito window, thus giving you access to the disk securely.
Post reply on HN