Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing anti-incognito detection in Google Chrome

mishravikas.com

Post reply on HN
Print view View original

31–40 of 114 posts

Re: Bypassing anti-incognito detection in Google Chrome

#31

Post by em-bee »

shakna wrote: post #22
em-bee wrote: post #8

Earlier quoted context omitted.

nice. can't see any difference in firefox. however, it is still possible to detect incognite mode in firefox as i have just been to a site that did so. (they didn't detect reader-mode however, so i was able to read the article after all)

For Firefox it's simple enough - can you open indexedDB? That goes the same for IE 10+. If instead it's Safari, can you successfully modify localStorage? Unfortunately, every browser seems to change it's behaviour as soon as you try not to store your history. Some browsers do try and stop these detection methods... And by the time they've patched them out new methods have emerged.

wait what? safari blocks access to localStorage in incognito mode? that ought to break some sites functionality.

Re: Bypassing anti-incognito detection in Google Chrome

#32

Post by em-bee »

nsajko wrote: post #29
em-bee wrote: post #7

Earlier quoted context omitted.

a profile that removes all history still writes to disk, and potentially leaves traces behind. (a backup could be running while the session is open, or a data could be left behind on a disk block because the files are deleted but not wiped) incognite mode is useful for two situations: A: you want to hide the fact that you visited a site. B: you want to hide from the site that you have visited before. the incognito-de…

It does not have to be cumbersome if you do it like I do: https://news.ycombinator.com/item?id=20484845

that doesn't help. having a profile that cleans itself isn't the problem. switching between a normal and a cleaning profile is.

for most of my stuff i want to keep the history and whatever else around. i also never restart my browser or my machine if i can't avoid it. (restarts happen when i don't want them, and that's when i don't want to loose my current state). so i am still stuck with specific sites that i need a second, cleanable mode for. it's the mode switching that is the issue. switching into incognito mode or to a new browser group is easy enough. so fixing either is the way to go.

Re: Bypassing anti-incognito detection in Google Chrome

#33

Post by mcherm »

13of40 wrote: post #25
em-bee wrote: post #3

there is only one way to get around this. incognito mode needs to emulate all system resources without actually making them available. even without that consideration, for things like disk storage, there is no reason[1] why incognito mode should have less access than normal mode. all websites should function as normal. the only difference is that in incognito mode everything is wiped once it is closed, and nothing is…

I think there are two use cases for incognito mode: 1. I don't want others who have access to my client machine to be able to see a history of what I did online. 2. I don't want servers to be able to know anything about me except maybe my IP address. It feels like tying these two together under one setting makes them both fragile. E.g. for scenario 2, I don't care whether a web page can use local storage as long as t…

Yes! I think this is exactly the way to think about it. Especially the part about giving the user control over just what sites they hide in this manner.

Re: Bypassing anti-incognito detection in Google Chrome

#34

Post by realusername »

em-bee wrote: post #31
shakna wrote: post #22

Earlier quoted context omitted.

For Firefox it's simple enough - can you open indexedDB? That goes the same for IE 10+. If instead it's Safari, can you successfully modify localStorage? Unfortunately, every browser seems to change it's behaviour as soon as you try not to store your history. Some browsers do try and stop these detection methods... And by the time they've patched them out new methods have emerged.

wait what? safari blocks access to localStorage in incognito mode? that ought to break some sites functionality.

yes that does break a lot of websites, the Safari team hasn't made the best choices on this one.

Re: Bypassing anti-incognito detection in Google Chrome

#35

Post by radisb »

13of40 wrote: post #25
em-bee wrote: post #3

there is only one way to get around this. incognito mode needs to emulate all system resources without actually making them available. even without that consideration, for things like disk storage, there is no reason[1] why incognito mode should have less access than normal mode. all websites should function as normal. the only difference is that in incognito mode everything is wiped once it is closed, and nothing is…

I think there are two use cases for incognito mode: 1. I don't want others who have access to my client machine to be able to see a history of what I did online. 2. I don't want servers to be able to know anything about me except maybe my IP address. It feels like tying these two together under one setting makes them both fragile. E.g. for scenario 2, I don't care whether a web page can use local storage as long as t…

What if you want both?

Re: Bypassing anti-incognito detection in Google Chrome

#36

Post by lol768 »

swinglock wrote: post #26

What sites worry about incognito mode and why?

To give one legitimate use:

One of the clients I work with is a university. Staff are forced to set-up 2FA.

We received numerous support calls, particularly from users of Safari, who would find themselves accidentally in incognito/private browsing mode - and then complain that the "remember my device" functionality (which relies on a cookie) didn't work.

We solved this with a visible warning to users who are in incognito mode to remind them that they will need to provide a new code each time they login.

Re: Bypassing anti-incognito detection in Google Chrome

#37

Post by patrec »

radisb wrote: post #35
13of40 wrote: post #25

Earlier quoted context omitted.

I think there are two use cases for incognito mode: 1. I don't want others who have access to my client machine to be able to see a history of what I did online. 2. I don't want servers to be able to know anything about me except maybe my IP address. It feels like tying these two together under one setting makes them both fragile. E.g. for scenario 2, I don't care whether a web page can use local storage as long as t…

What if you want both?

Indeed – I have a hard time believing that the vast majority of people who want one of these things wouldn't also want the other.

Re: Bypassing anti-incognito detection in Google Chrome

#38

Post by chrisan »

remus wrote: post #23
reaktivo wrote: post #14

This could also be solved by having any FileSystem API be unaccessible until a User Permission request is accepted. Both in incognito and normal mode.

You might solve the incognito detection problem but you open up the opportunity for notification-fatigue if users end up getting lots of these permission requests.

Plus it wouldnt get around the root problem, which I assume to believe is

"you have reached your monthly limit of articles, please pay"

opens private tab to read article

"we see you are in a private window, please load our site in a normal window"

browser perfectly mimics regular mode but now you need to grant permission

"we see you havent granted permission, please allow access to read our article"

Re: Bypassing anti-incognito detection in Google Chrome

#39

Post by nsajko »

em-bee wrote: post #32
nsajko wrote: post #29

Earlier quoted context omitted.

It does not have to be cumbersome if you do it like I do: https://news.ycombinator.com/item?id=20484845

that doesn't help. having a profile that cleans itself isn't the problem. switching between a normal and a cleaning profile is. for most of my stuff i want to keep the history and whatever else around. i also never restart my browser or my machine if i can't avoid it. (restarts happen when i don't want them, and that's when i don't want to loose my current state). so i am still stuck with specific sites that i need a…

I do not quite understand what do you mean by "switching".

In my workflow, when I want "Incognito", I just start a new Chromium session on tmpfs. No switching needed.

Re: Bypassing anti-incognito detection in Google Chrome

#40

Post by pbhjpbhj »

em-bee wrote: post #7
jalk wrote: post #5

How is an additional chrome user profile that removes all history/cookies/ local storage on close different tracing-wise from an incognito session?

a profile that removes all history still writes to disk, and potentially leaves traces behind. (a backup could be running while the session is open, or a data could be left behind on a disk block because the files are deleted but not wiped) incognite mode is useful for two situations: A: you want to hide the fact that you visited a site. B: you want to hide from the site that you have visited before. the incognito-de…

A lot of people will be trackable still under B by IP address (yes, I know it's not identifying in general).

I get arbitrary IP addresses from my ISP but if my router isn't reset then it can be the same for weeks; Brave solves this with incognito+tor.

Post reply on HN