Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing anti-incognito detection in Google Chrome

mishravikas.com

Post reply on HN
Print view View original

101–110 of 114 posts

Re: Bypassing anti-incognito detection in Google Chrome

#101

Post by 14of40 »

13of40 wrote: post #25
em-bee wrote: post #3

there is only one way to get around this. incognito mode needs to emulate all system resources without actually making them available. even without that consideration, for things like disk storage, there is no reason[1] why incognito mode should have less access than normal mode. all websites should function as normal. the only difference is that in incognito mode everything is wiped once it is closed, and nothing is…

I think there are two use cases for incognito mode: 1. I don't want others who have access to my client machine to be able to see a history of what I did online. 2. I don't want servers to be able to know anything about me except maybe my IP address. It feels like tying these two together under one setting makes them both fragile. E.g. for scenario 2, I don't care whether a web page can use local storage as long as t…

I want #1 for all machines, almost 100% of the time. Maybe 99%.

I try to wipe my drives and repartition every 30 to 60 days, with a full OS reinstall. The Virtual Machines I run with VirtualBox are even less persistent than the bare metal, often stateful for mere hours. I do not retain browser history, and I have only about 5 bookmarks, and trash my cookies and cache at least every day, multiple times usually.

But I want #2 for like 75% of the time. The other 25% of the time, that state almost never lasts 48 hours. When I go to bed, the current browser state dies forever. I usually have a hard time staying awake for 48 hours straight.

This means #2 will become 100% every 48 hours, with 48 hours being an extreme maximum lifetime for session data, and the true norm being 8 hours (9 to 5, each work day).

Considering that #1 & #2 are sure to intersect every 48 hours, dividing attention between them seems burdensome.

Re: Bypassing anti-incognito detection in Google Chrome

#102

Post by dredmorbius »

puzzledobserver wrote: post #88

Why is incognito mode so difficult for browsers to implement? If the browser already comes with support for profiles, then isn't switching to incognito mode the same as running from the empty profile? In particular, why do particular APIs need to be shimmed or disabled? In my empty-profile based proto-proposal, even if a website writes to disk, wouldn't closing the session cause any data written to be rolled back?

Not accidently unintentionally saving state is in fact hard.

Re: Bypassing anti-incognito detection in Google Chrome

#103

Post by dredmorbius »

TomAnthony wrote: post #11
ec109685 wrote: post #10

Earlier quoted context omitted.

If Chrome encrypted the data it wrote to disk, it can throw away the encryption key and delete the file when you close the incognito window, thus giving you access to the disk securely.

Any sort of file system imprint would at least leave a trace that incognito had been used. I’m not sure how much of a problem at is, and how much of a trace it currently leaves.

Initialising a fixed storage image with random data offers plausible deniability.

Re: Bypassing anti-incognito detection in Google Chrome

#104

Post by Shacklz »

hedora wrote: post #59

Am I the only one that wants their browser to be 100% stateless? I always run in incognito mode, and I have an external password manager. I have no problems with this setup except sites that detect and block incognito mode. Other than caching, there is no legitimate benefit to allow pages to store local state beyond a session, and I can forgo caching at this point in the game. (I don’t care about offline web apps, to…

Not the only one - there are probably dozens of us :)

I use Firefox for this purpose, not in private mode - I just let FF delete everything whenever I close it. It's not "100% stateless", as I still allow cookies and such while my browser is open (I use uBlock and Privacy-Badger to block out the worst), but whenever I close the browser I still have a "clean slate" whenever I reopen it.

There are definitely a few downsides (as much as I love the GDPR, the compliance banners are annoying), but together with a password manager, it's definitely a setup that works for me.

Re: Bypassing anti-incognito detection in Google Chrome

#105

Post by fghtr »

hedora wrote: post #59

Am I the only one that wants their browser to be 100% stateless? I always run in incognito mode, and I have an external password manager. I have no problems with this setup except sites that detect and block incognito mode. Other than caching, there is no legitimate benefit to allow pages to store local state beyond a session, and I can forgo caching at this point in the game. (I don’t care about offline web apps, to…

>Am I the only one that wants their browser to be 100% stateless?

I achieved it by using Disposable Virtual Machines in Qubes OS. Works flawlessly.

Re: Bypassing anti-incognito detection in Google Chrome

#106

Post by diafygi »

ShakataGaNai wrote: post #85
hedora wrote: post #59

Am I the only one that wants their browser to be 100% stateless? I always run in incognito mode, and I have an external password manager. I have no problems with this setup except sites that detect and block incognito mode. Other than caching, there is no legitimate benefit to allow pages to store local state beyond a session, and I can forgo caching at this point in the game. (I don’t care about offline web apps, to…

On HackerNews? You're probably not the only one. In the world of real users? You're probably the extreme minority. Most people want convenience, and will trade almost anything for it. Especially if they don't realize they are trading something like "privacy" or "trackability" for convenience.

When framed correctly, a stateless browser is totally acceptable for general users. General users have no concept of cookies, so if you describe browsers as just a dumb window to let you load websites, it totally makes sense that you would have to log back in when you close the window.

For example, I set my Mom up with a Firefox configuration that doesn't remember anything when you close the window (basically incognito by default). She has used that configuration for years and never complained. In fact, she always compliments me for how safe and reliable I've made her browser. When she sees other people on other computers just load their logged-in websites without having to log in, she thinks they're totally unsafe and exposed.

She associates closing the window == back to safety, so whenever she ends up on a scary website or sees a scary popup, she just closes firefox and opens it back up again. It's wonderful. I didn't have to teach her about cookies or sessions or anything. All I had to teach her was that if she ever got into a situation where she didn't know what to do, just close the window and you're safe again.

Anyway, I feel pretty strongly that if browsers were incognito by default and you had to opt-in to persist sessions (e.g. whitelist cookies), general users would get used to it pretty quickly and end up thinking the time back before was a very unsafe place (like the free love era before the AIDS epidemic).

Re: Bypassing anti-incognito detection in Google Chrome

#107

Post by jakeogh »

Wowfunhappy wrote: post #73
nsajko wrote: post #65

Earlier quoted context omitted.

I, too, almost always use Chromium so it is basically stateless (except when I want bookmarks). My way is better than Incognito mode because you can have multiple sessions (example: one for Google's services that require a login, one for Stack Exchange, one for browsing); and of course because it can not be detected, unlike Incognito mode. Take a look at my comment here: https://news.ycombinator.com/item?id=20484845

What do you do for sites that complain each session you're using an "unrecognized browser" and require additional forms of authentication? Just deal with it every single session?

For most services I cancel the account and explain why.

Re: Bypassing anti-incognito detection in Google Chrome

#108

Post by Kaiyou »

nsajko wrote: post #70
_underfl0w_ wrote: post #68

Earlier quoted context omitted.

Doesn't using Chromium in the first place kinda defeat the purpose? I mean, you'll thwart others' tracking with your methods (though you made no mention of blocking tracking scripts/images which is a huge piece) but you're still handing data directly to Google.

You can turn that off in the settings.

There's a setting, but it doesn't really prevent anything. You're still tracked.

Re: Bypassing anti-incognito detection in Google Chrome

#109

Post by zzo38computer »

dTal wrote: post #52
kijin wrote: post #6

Is there any legitimate reason to allow arbitrary web apps to use gigabytes of space on my precious SSD, especially on mobile devices? I'm becoming increasingly wary of web apps having all sorts of access to things outside of the browser, sometimes without explicit permission. Browsers should limit every app to the same amount, perhaps 100MB, or maybe even 10MB. Apps that need more should ask for permission.

In a distributed environment like the web, how do you define an 'app'? If the restriction is e.g. 10MB per domain, what stops an entity registering a hundred domains?

One possibility is to require the user to explicitly set up an "app", to allow the user to specify the limits independentlyf or each one, to allow the user to put multiple domains into an app if they wish, and to allow the user to define multiple apps for a single domain in case they want to have separate sets of data to send in different cases.

Re: Bypassing anti-incognito detection in Google Chrome

#110

Post by 13of40 »

14of40 wrote: post #101
13of40 wrote: post #25

Earlier quoted context omitted.

I think there are two use cases for incognito mode: 1. I don't want others who have access to my client machine to be able to see a history of what I did online. 2. I don't want servers to be able to know anything about me except maybe my IP address. It feels like tying these two together under one setting makes them both fragile. E.g. for scenario 2, I don't care whether a web page can use local storage as long as t…

I want #1 for all machines, almost 100% of the time. Maybe 99%. I try to wipe my drives and repartition every 30 to 60 days, with a full OS reinstall. The Virtual Machines I run with VirtualBox are even less persistent than the bare metal, often stateful for mere hours. I do not retain browser history, and I have only about 5 bookmarks, and trash my cookies and cache at least every day, multiple times usually. But I…

I'm going to go out on a limb and say you're not the typical user. Besides, in your case it would be a matter of selecting "hide from everyone" in the drop-down.
Post reply on HN