Live data from Hacker News

Bypassing anti-incognito detection in Google Chrome

mishravikas.com

71–80 of 114 posts

Re: Bypassing anti-incognito detection in Google Chrome

#71
post #5

How is an additional chrome user profile that removes all history/cookies/ local storage on close different tracing-wise from an incognito session?

If the computer or Chrome crashes during an incognito session a nanny thread would leave the incognito history on disk forever. It’s better to use lower level tools.

Re: Bypassing anti-incognito detection in Google Chrome

#72

What sites worry about incognito mode and why?

Buying airplane tickets.

For those who don’t understand this one, airlines will sometimes artificially inflate tickets faster for people who visit their site multiple times to create a sense of urgency. I always shop for airline tickets in incognito and only log in at checkout.

Re: Bypassing anti-incognito detection in Google Chrome

#73
post #65
post #59

Am I the only one that wants their browser to be 100% stateless? I always run in incognito mode, and I have an external password manager. I have no problems with this setup except sites that detect and block incognito mode. Other than caching, there is no legitimate benefit to allow pages to store local state beyond a session, and I can forgo caching at this point in the game. (I don’t care about offline web apps, to…

I, too, almost always use Chromium so it is basically stateless (except when I want bookmarks). My way is better than Incognito mode because you can have multiple sessions (example: one for Google's services that require a login, one for Stack Exchange, one for browsing); and of course because it can not be detected, unlike Incognito mode. Take a look at my comment here: https://news.ycombinator.com/item?id=20484845

What do you do for sites that complain each session you're using an "unrecognized browser" and require additional forms of authentication? Just deal with it every single session?

Re: Bypassing anti-incognito detection in Google Chrome

#74
post #65

Earlier quoted context omitted.

I, too, almost always use Chromium so it is basically stateless (except when I want bookmarks). My way is better than Incognito mode because you can have multiple sessions (example: one for Google's services that require a login, one for Stack Exchange, one for browsing); and of course because it can not be detected, unlike Incognito mode. Take a look at my comment here: https://news.ycombinator.com/item?id=20484845

What do you do for sites that complain each session you're using an "unrecognized browser" and require additional forms of authentication? Just deal with it every single session?

I assume by additional forms of authentication you mean codes sent over either email or SMS? Email is not a bother to deal with, because one can just copy the code over from the email; while phone SMS is not an issue because I did not confirm my phone number to any Web services. (For example, I think Paypal asks me to "confirm" my phone number every time I log in, even though Paypal knows the number is mine it is probably bound by regulation or law not to force multi-factor-authentication on me. So, just say no when asked about confirming your phone number.)

Do you have an example of a site that requires "additional forms of authentication"? I remember something like that happening to me before, but I can not remember which site it happened on.

Re: Bypassing anti-incognito detection in Google Chrome

#75
post #59

Am I the only one that wants their browser to be 100% stateless? I always run in incognito mode, and I have an external password manager. I have no problems with this setup except sites that detect and block incognito mode. Other than caching, there is no legitimate benefit to allow pages to store local state beyond a session, and I can forgo caching at this point in the game. (I don’t care about offline web apps, to…

I'd like every single tab to be stateless which I believe Firefox has an end goal of with containers

Re: Bypassing anti-incognito detection in Google Chrome

#76
The easy solution for sites that need revenue is to abandon this stupid arms race and do two things:

1. Force their ad networks to police ads for malware, movies, tracking code, and slow-loading crap.

2. Stop sharing private user data with others.

I would turn off my ad blocker and incognito mode tomorrow if e.g. the Washington Post would take these steps.

Re: Bypassing anti-incognito detection in Google Chrome

#77
post #74

Earlier quoted context omitted.

What do you do for sites that complain each session you're using an "unrecognized browser" and require additional forms of authentication? Just deal with it every single session?

I assume by additional forms of authentication you mean codes sent over either email or SMS? Email is not a bother to deal with, because one can just copy the code over from the email; while phone SMS is not an issue because I did not confirm my phone number to any Web services. (For example, I think Paypal asks me to "confirm" my phone number every time I log in, even though Paypal knows the number is mine it is pro…

Many sites ask for your phone just to simplify the "forgot my credentials, help me" customer support calls. Some, especially money-related, want to know your phone as a separate confirmation of your state-controlled identity, in countries where buying a SIM card required legal identification (which likely can be retrieved by a court order if need be).

Yes, SMS can easily be diverted so it's not great for 2FA purposes; a voice call is often an option, and is harder to spoof.

Sites that actually care about your security would go for things like TOTP, or SSH key, or a certificate. These forms do not map easily to your legal identity, but are more reliable proofs of knowing a secret.

Re: Bypassing anti-incognito detection in Google Chrome

#78
post #65
post #59

Am I the only one that wants their browser to be 100% stateless? I always run in incognito mode, and I have an external password manager. I have no problems with this setup except sites that detect and block incognito mode. Other than caching, there is no legitimate benefit to allow pages to store local state beyond a session, and I can forgo caching at this point in the game. (I don’t care about offline web apps, to…

I, too, almost always use Chromium so it is basically stateless (except when I want bookmarks). My way is better than Incognito mode because you can have multiple sessions (example: one for Google's services that require a login, one for Stack Exchange, one for browsing); and of course because it can not be detected, unlike Incognito mode. Take a look at my comment here: https://news.ycombinator.com/item?id=20484845

> it can not be detected, unlike Incognito mode

This may be true today, but that's because Chrome has a bug. (At least, I can't see why we wouldn't view it as a bug.)

Incognito Mode shouldn't be detectable. Hopefully they'll fix that.

Re: Bypassing anti-incognito detection in Google Chrome

#79
post #59

Am I the only one that wants their browser to be 100% stateless? I always run in incognito mode, and I have an external password manager. I have no problems with this setup except sites that detect and block incognito mode. Other than caching, there is no legitimate benefit to allow pages to store local state beyond a session, and I can forgo caching at this point in the game. (I don’t care about offline web apps, to…

If you assume (big ask) that your browser is trustworthy and your computer won’t be compromised, it’s nice to have bookmarks, history, and a password manager built in.

Re: Bypassing anti-incognito detection in Google Chrome

#80
post #59

Am I the only one that wants their browser to be 100% stateless? I always run in incognito mode, and I have an external password manager. I have no problems with this setup except sites that detect and block incognito mode. Other than caching, there is no legitimate benefit to allow pages to store local state beyond a session, and I can forgo caching at this point in the game. (I don’t care about offline web apps, to…

Doesn't using Chromium in the first place kinda defeat the purpose? I mean, you'll thwart others' tracking with your methods (though you made no mention of blocking tracking scripts/images which is a huge piece) but you're still handing data directly to Google.

Better to use brave maybe? Or Firefox?
Post reply on HN