Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing anti-incognito detection in Google Chrome

mishravikas.com

Post reply on HN
Print view View original

61–70 of 114 posts

Re: Bypassing anti-incognito detection in Google Chrome

#61

Post by em-bee »

amelius wrote: post #57
em-bee wrote: post #3

there is only one way to get around this. incognito mode needs to emulate all system resources without actually making them available. even without that consideration, for things like disk storage, there is no reason[1] why incognito mode should have less access than normal mode. all websites should function as normal. the only difference is that in incognito mode everything is wiped once it is closed, and nothing is…

We need the same thing on mobile apps too. If the Facebook app wants access to my entire storage or else it refuses to take a picture, then why not show it a facade filesystem instead?

indeed, i come across that several times. for some apps that i don't trust i'd like them to get access to a private storage. or a fake location. some apps insist that they need my real location in order to serve me properly. sure, that would make things convenient, but i am perfectly fine with using the app with out that convenience.

Re: Bypassing anti-incognito detection in Google Chrome

#62

Post by hermanradtke »

SimeVidas wrote: post #60
hedora wrote: post #59

Am I the only one that wants their browser to be 100% stateless? I always run in incognito mode, and I have an external password manager. I have no problems with this setup except sites that detect and block incognito mode. Other than caching, there is no legitimate benefit to allow pages to store local state beyond a session, and I can forgo caching at this point in the game. (I don’t care about offline web apps, to…

What’s your motivation for doing this? Btw, I store my passwords in Firefox Sync. What would the benefit be of storing them in a third-party password manager, from a security and privacy perspective?

To make the browser stateless and, thus, harder to track.

Re: Bypassing anti-incognito detection in Google Chrome

#63

Post by [deleted] »

Zarel wrote: post #50
haunter wrote: post #42

Earlier quoted context omitted.

Wonder if it's possible to make something like that on Windows

Chrome does have guest profiles: Click your user icon, and there'll be an "Open Guest Window" button. > "You’re browsing as a Guest" > "Pages you view in this window won’t appear in the browser history and they won’t leave other traces, like cookies, on the computer after you close all open Guest windows. Any files you download will be preserved, however." It's kind of like Incognito, except none of your preferences…

[deleted]

Re: Bypassing anti-incognito detection in Google Chrome

#65

Post by nsajko »

hedora wrote: post #59

Am I the only one that wants their browser to be 100% stateless? I always run in incognito mode, and I have an external password manager. I have no problems with this setup except sites that detect and block incognito mode. Other than caching, there is no legitimate benefit to allow pages to store local state beyond a session, and I can forgo caching at this point in the game. (I don’t care about offline web apps, to…

I, too, almost always use Chromium so it is basically stateless (except when I want bookmarks). My way is better than Incognito mode because you can have multiple sessions (example: one for Google's services that require a login, one for Stack Exchange, one for browsing); and of course because it can not be detected, unlike Incognito mode.

Take a look at my comment here: https://news.ycombinator.com/item?id=20484845

Re: Bypassing anti-incognito detection in Google Chrome

#66

Post by SimeVidas »

hermanradtke wrote: post #62
SimeVidas wrote: post #60

Earlier quoted context omitted.

What’s your motivation for doing this? Btw, I store my passwords in Firefox Sync. What would the benefit be of storing them in a third-party password manager, from a security and privacy perspective?

To make the browser stateless and, thus, harder to track.

Do you use any form of tracking protection (either as a built-in browser feature or via browser extensions)?

Re: Bypassing anti-incognito detection in Google Chrome

#67

Post by nsajko »

SimeVidas wrote: post #60
hedora wrote: post #59

Am I the only one that wants their browser to be 100% stateless? I always run in incognito mode, and I have an external password manager. I have no problems with this setup except sites that detect and block incognito mode. Other than caching, there is no legitimate benefit to allow pages to store local state beyond a session, and I can forgo caching at this point in the game. (I don’t care about offline web apps, to…

What’s your motivation for doing this? Btw, I store my passwords in Firefox Sync. What would the benefit be of storing them in a third-party password manager, from a security and privacy perspective?

> What’s your motivation for doing this?

Maybe he, like me, just thinks there is no reason for history, form data, cookies and all that stuff to be saved after starting a new browser instance, except in rare circumstances.

> What would the benefit be of storing them in a third-party password manager

Decoupling, less dependance on a specific browser. "Unix philosphy".

Re: Bypassing anti-incognito detection in Google Chrome

#68

Post by _underfl0w_ »

hedora wrote: post #59

Am I the only one that wants their browser to be 100% stateless? I always run in incognito mode, and I have an external password manager. I have no problems with this setup except sites that detect and block incognito mode. Other than caching, there is no legitimate benefit to allow pages to store local state beyond a session, and I can forgo caching at this point in the game. (I don’t care about offline web apps, to…

Doesn't using Chromium in the first place kinda defeat the purpose? I mean, you'll thwart others' tracking with your methods (though you made no mention of blocking tracking scripts/images which is a huge piece) but you're still handing data directly to Google.

Re: Bypassing anti-incognito detection in Google Chrome

#69

Post by inlined »

btown wrote: post #41

Why not let incognito mode write to disk, but entirely encrypted and randomly padded (to avoid size memorization attacks), with keys only stored in memory? That way you can use practically the entire storage space and avoid quota mismatches, as well as service attempts to fill the storage for detection. And in the event of a crash or power outage, no data is recoverable.

Random padding can be detected and the existence of encrypted files would be a giveaway that users use incognito often (which may not be wanted)

Iirc on *nix there’s a difference between inodes and vnodes that you might be able to take advantage of as well. The supervisor would create, open, and delete the directory before filling it. Holding the directory open gives it a vnode count of one and deleting it gives an inode count of zero thus making the current process the last thing to ever be able to reach the directory. You’d have to make sense of a full disk binary scan to guess what used to there if the disk wasn’t zeroed out, so encryption could help there too.

Re: Bypassing anti-incognito detection in Google Chrome

#70

Post by nsajko »

_underfl0w_ wrote: post #68
hedora wrote: post #59

Am I the only one that wants their browser to be 100% stateless? I always run in incognito mode, and I have an external password manager. I have no problems with this setup except sites that detect and block incognito mode. Other than caching, there is no legitimate benefit to allow pages to store local state beyond a session, and I can forgo caching at this point in the game. (I don’t care about offline web apps, to…

Doesn't using Chromium in the first place kinda defeat the purpose? I mean, you'll thwart others' tracking with your methods (though you made no mention of blocking tracking scripts/images which is a huge piece) but you're still handing data directly to Google.

You can turn that off in the settings.
Post reply on HN