Bypassing anti-incognito detection in Google Chrome • Hacker News Board

Re: Bypassing anti-incognito detection in Google Chrome

#81

Post by jammygit » Sat, Jul 20, 2019, 5:41 PM UTC

nsajko wrote: post #74

Wowfunhappy wrote: post #73

Earlier quoted context omitted.

What do you do for sites that complain each session you're using an "unrecognized browser" and require additional forms of authentication? Just deal with it every single session?

I assume by additional forms of authentication you mean codes sent over either email or SMS? Email is not a bother to deal with, because one can just copy the code over from the email; while phone SMS is not an issue because I did not confirm my phone number to any Web services. (For example, I think Paypal asks me to "confirm" my phone number every time I log in, even though Paypal knows the number is mine it is pro…

I made a Microsoft account to use Skype. Twitter too recently. Both sent me messages immediately saying I had either broken the terms of service, or had been potentially compromised, and needed sms second factor to log in.

Since I had never used either account before this happened, it’s just a thinly veiled requirement that they can connect my account to an identifiable human.

Perhaps twitters bot problem is some justification, but when they warned me about violating their rules I just deleted my almost-unused account. It was insulting

Re: Bypassing anti-incognito detection in Google Chrome

#82

Post by diminoten » Sat, Jul 20, 2019, 5:44 PM UTC

hedora wrote: post #59

Am I the only one that wants their browser to be 100% stateless? I always run in incognito mode, and I have an external password manager. I have no problems with this setup except sites that detect and block incognito mode. Other than caching, there is no legitimate benefit to allow pages to store local state beyond a session, and I can forgo caching at this point in the game. (I don’t care about offline web apps, to…

I guess what benefits do you get out of that, and at what cost? I just don't see the amount of privacy I give up worth losing the convenience of the features.

Re: Bypassing anti-incognito detection in Google Chrome

#83

Post by MiddleEndian » Sat, Jul 20, 2019, 6:18 PM UTC

dreamcompiler wrote: post #76

The easy solution for sites that need revenue is to abandon this stupid arms race and do two things: 1. Force their ad networks to police ads for malware, movies, tracking code, and slow-loading crap. 2. Stop sharing private user data with others. I would turn off my ad blocker and incognito mode tomorrow if e.g. the Washington Post would take these steps.

Regarding 2: Probably impossible. Regarding 1: hold websites and ad networks legally culpable for delivering malware from ads. Probably also not possible.

Keep blocking ads.

Re: Bypassing anti-incognito detection in Google Chrome

#84

Post by scarejunba » Sat, Jul 20, 2019, 6:25 PM UTC

dreamcompiler wrote: post #76

The easy solution for sites that need revenue is to abandon this stupid arms race and do two things: 1. Force their ad networks to police ads for malware, movies, tracking code, and slow-loading crap. 2. Stop sharing private user data with others. I would turn off my ad blocker and incognito mode tomorrow if e.g. the Washington Post would take these steps.

If you have your ad blocker on and the WaPo did this, how would you know to turn it off?

Re: Bypassing anti-incognito detection in Google Chrome

#85

Post by ShakataGaNai » Sat, Jul 20, 2019, 6:28 PM UTC

hedora wrote: post #59

Am I the only one that wants their browser to be 100% stateless? I always run in incognito mode, and I have an external password manager. I have no problems with this setup except sites that detect and block incognito mode. Other than caching, there is no legitimate benefit to allow pages to store local state beyond a session, and I can forgo caching at this point in the game. (I don’t care about offline web apps, to…

On HackerNews? You're probably not the only one.

In the world of real users? You're probably the extreme minority.

Most people want convenience, and will trade almost anything for it. Especially if they don't realize they are trading something like "privacy" or "trackability" for convenience.

Re: Bypassing anti-incognito detection in Google Chrome

#86

Post by nessunodoro » Sat, Jul 20, 2019, 6:44 PM UTC

hedora wrote: post #59

Am I the only one that wants their browser to be 100% stateless? I always run in incognito mode, and I have an external password manager. I have no problems with this setup except sites that detect and block incognito mode. Other than caching, there is no legitimate benefit to allow pages to store local state beyond a session, and I can forgo caching at this point in the game. (I don’t care about offline web apps, to…

Do you use Firefox multi-account containers?

https://addons.mozilla.org/en-US/firefox/addon/multi-account...

It's the biggest reason I use Firefox. Intuitive, straightforward session partitioning. Every browser should have it.

Re: Bypassing anti-incognito detection in Google Chrome

#87

Post by glloydell » Sat, Jul 20, 2019, 6:45 PM UTC

MiddleEndian wrote: post #83

dreamcompiler wrote: post #76

The easy solution for sites that need revenue is to abandon this stupid arms race and do two things: 1. Force their ad networks to police ads for malware, movies, tracking code, and slow-loading crap. 2. Stop sharing private user data with others. I would turn off my ad blocker and incognito mode tomorrow if e.g. the Washington Post would take these steps.

Regarding 2: Probably impossible. Regarding 1: hold websites and ad networks legally culpable for delivering malware from ads. Probably also not possible. Keep blocking ads.

I agree with you on 2 most likely not being possible (or reasonable) given that the revenue model is based in sharing user data, but I'm not so sure that 1 is completely out of the question.

I don't necessarily think that it's reasonable to have a zero tolerance policy for ad networks or the sites serving them regarding malware (cuz perfect security doesn't exist), but what about requiring some basic standard of due diligence for the ad networks themselves?

Re: Bypassing anti-incognito detection in Google Chrome

#88

Post by puzzledobserver » Sat, Jul 20, 2019, 7:22 PM UTC

Why is incognito mode so difficult for browsers to implement? If the browser already comes with support for profiles, then isn't switching to incognito mode the same as running from the empty profile?

In particular, why do particular APIs need to be shimmed or disabled? In my empty-profile based proto-proposal, even if a website writes to disk, wouldn't closing the session cause any data written to be rolled back?

Re: Bypassing anti-incognito detection in Google Chrome

#89

Post by zrobotics » Sat, Jul 20, 2019, 7:26 PM UTC

SimeVidas wrote: post #60

hedora wrote: post #59

Am I the only one that wants their browser to be 100% stateless? I always run in incognito mode, and I have an external password manager. I have no problems with this setup except sites that detect and block incognito mode. Other than caching, there is no legitimate benefit to allow pages to store local state beyond a session, and I can forgo caching at this point in the game. (I don’t care about offline web apps, to…

What’s your motivation for doing this? Btw, I store my passwords in Firefox Sync. What would the benefit be of storing them in a third-party password manager, from a security and privacy perspective?

A concrete example of why a 3rd party pw manager is useful- git(hub/lab) credentials. On both sites, I can easily want to enter account credentials in a terminal as well as the browser. Not every password will exclusively be used in the browser, and 3rd party managers are handier outside the browser.

Re: Bypassing anti-incognito detection in Google Chrome

#90

Post by torgard » Sat, Jul 20, 2019, 7:30 PM UTC

_underfl0w_ wrote: post #68

hedora wrote: post #59

Am I the only one that wants their browser to be 100% stateless? I always run in incognito mode, and I have an external password manager. I have no problems with this setup except sites that detect and block incognito mode. Other than caching, there is no legitimate benefit to allow pages to store local state beyond a session, and I can forgo caching at this point in the game. (I don’t care about offline web apps, to…

Doesn't using Chromium in the first place kinda defeat the purpose? I mean, you'll thwart others' tracking with your methods (though you made no mention of blocking tracking scripts/images which is a huge piece) but you're still handing data directly to Google.

You could use ungoogled-chromium to circumvent the Google-parts.