Live data from Hacker News

Bypassing anti-incognito detection in Google Chrome

mishravikas.com

21–30 of 114 posts

Re: Bypassing anti-incognito detection in Google Chrome

#22
post #8
post #4

See the result your browser https://luke.lol/check-fs-quota.php

nice. can't see any difference in firefox. however, it is still possible to detect incognite mode in firefox as i have just been to a site that did so. (they didn't detect reader-mode however, so i was able to read the article after all)

For Firefox it's simple enough - can you open indexedDB? That goes the same for IE 10+. If instead it's Safari, can you successfully modify localStorage?

Unfortunately, every browser seems to change it's behaviour as soon as you try not to store your history.

Some browsers do try and stop these detection methods... And by the time they've patched them out new methods have emerged.

Re: Bypassing anti-incognito detection in Google Chrome

#23

This could also be solved by having any FileSystem API be unaccessible until a User Permission request is accepted. Both in incognito and normal mode.

You might solve the incognito detection problem but you open up the opportunity for notification-fatigue if users end up getting lots of these permission requests.

Re: Bypassing anti-incognito detection in Google Chrome

#24
post #3

there is only one way to get around this. incognito mode needs to emulate all system resources without actually making them available. even without that consideration, for things like disk storage, there is no reason[1] why incognito mode should have less access than normal mode. all websites should function as normal. the only difference is that in incognito mode everything is wiped once it is closed, and nothing is…

Incognito mode was conceived to not leave traces in your local system, hence its shortcomings to bypass paywalls. Making websites unaware of incognito mode was not part of the original design.

Re: Bypassing anti-incognito detection in Google Chrome

#25
post #3

there is only one way to get around this. incognito mode needs to emulate all system resources without actually making them available. even without that consideration, for things like disk storage, there is no reason[1] why incognito mode should have less access than normal mode. all websites should function as normal. the only difference is that in incognito mode everything is wiped once it is closed, and nothing is…

I think there are two use cases for incognito mode:

1. I don't want others who have access to my client machine to be able to see a history of what I did online.

2. I don't want servers to be able to know anything about me except maybe my IP address.

It feels like tying these two together under one setting makes them both fragile. E.g. for scenario 2, I don't care whether a web page can use local storage as long as they don't have access to the data between sessions.

I'd much rather have two options - hide from the server and hide from your boss (or whoever). And maybe some UI to help me always hide from specific servers or delete all the artifacts from a specific session after the fact.

Re: Bypassing anti-incognito detection in Google Chrome

#29
post #7
post #5

How is an additional chrome user profile that removes all history/cookies/ local storage on close different tracing-wise from an incognito session?

a profile that removes all history still writes to disk, and potentially leaves traces behind. (a backup could be running while the session is open, or a data could be left behind on a disk block because the files are deleted but not wiped) incognite mode is useful for two situations: A: you want to hide the fact that you visited a site. B: you want to hide from the site that you have visited before. the incognito-de…

It does not have to be cumbersome if you do it like I do:

https://news.ycombinator.com/item?id=20484845

Post reply on HN