Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Chrome Incognito Mode Can Still Be Detected

bleepingcomputer.com

Post reply on HN
Print view View original

101–110 of 201 posts

Re: Google Chrome Incognito Mode Can Still Be Detected

#101

Post by artificial »

kevin_thibedeau wrote: post #99
0xADEADBEE wrote: post #85

Earlier quoted context omitted.

In the same way that ublock is a must-have extension for many people, I won't browse without cookieAutoDelete [0]. Mostly I don't bother authenticating with websites anymore, and (I think about 3 maybe? And I just reauthenticate when I want to use those) and for mobile browsing I mostly use Firefox Focus [1]. The ad networks are down to browser fingerprinting now, which will be devastatingly accurate but realisticall…

Random user agent to throw off the fingerprinting. Decentraleyes to defeat CDN tracking.

Another fun one is viewport tracking.

Re: Google Chrome Incognito Mode Can Still Be Detected

#102

Post by IX-103 »

na85 wrote: post #64
DenisM wrote: post #15

Can this fight ever be won? If you've been browsing the internet for more than 5 minutes you already have cookies from some of the major ad networks. Therefore if you do not have cookies from the major ad networks, you're either a brand-new device or an incognito browser. All that is left to do is get in bed with the ad network to ask them if they have good cookies for this session. As it so happens most of the compa…

I feel as though your argument is predicated on browsers that leak tracking data such as cookies, etc. If the browser vendors would tighten their products up and start considering things like profiling the user's installed fonts as a security vulnerability, then we might see some progress. Unfortunately Google has a financial incentive to make Chrome trackable to advertisers.

Don't forget that the advertisers don't get income directly from tracking you. They get income based on how good they have a profile of your interests (and things that you would buy). If they can get a good enough profile without tracking then maybe they'll stop tracking. Or maybe it would be easier to block the few that continue taking than wave war on an entire industry....

There's already been some talk about changing things so that tracking is less necessary (https://webkit.org/blog/8943/privacy-preserving-ad-click-att...) and I wouldn't be surprised if a lot more comes out by the end of the year.

Anyway, anyone that knows the details of the web could have seen this coming. [Private mode is not private](https://brave.com/private-mode-is-not-really-private/). Websites can calculate fingerprints from users just by running JavaScript (they can easily get the processor speed, GPU version, local IP, and other details) so they can identify you even if you clear cookies. And the funny thing is that all of these APIs have reasonable intended uses and getting rid of them would large portions of content on the web.

Re: Google Chrome Incognito Mode Can Still Be Detected

#103

Post by stiray »

toby- wrote: post #37
TylerE wrote: post #24

Earlier quoted context omitted.

So, don't use the internet? Because that's what you're describing. Better cut the power cord, too, just to be safe.

Plenty of sites respect user privacy. I should know; I run dozens of them.

If plenty is "a few" than I would agree (and I am glad you respect privacy). I am still searching for one site that I could give an example for GDPR and they are all blatantly violating it. In most cases they just give you fake impression they respect privacy (by setting banner to "opt-out" (which is violation on its own) after the tracking 3rd party scripts are already loaded).

The whole privacy deal on the web just shows moral corrosion. It is putting IT neck to neck with scammers.

Re: Google Chrome Incognito Mode Can Still Be Detected

#104

Post by hdfbdtbcdg »

propogandist wrote: post #72
rocky1138 wrote: post #62

Earlier quoted context omitted.

Do you know of any way through the about:config editor to do this? I'd hate to have to install yet another browser plugin.

uMatrix is a must have add-on and nothing else comes close to matching its functionality. It pairs well with uBlock Origin (same dev). Add-ons like Decentraleyes is also good as it prevents persistent tracking from shared web libraries, like Google ajax, that everyone seems to use... it's free and widely available for a reason. Google is also working to update Chrome APIs that will cripple privacy centric add-ons and…

These addons work fine in Firefox.

Re: Google Chrome Incognito Mode Can Still Be Detected

#105

Post by JaRail »

NickGerleman wrote: post #9

I’m a bit surprised Chrome developers went the route of an in memory filesystem instead of trying to sandbox and clear real disk access. Silently using up to 120MB without realizing sounds pretty bad.

The point of incognito was never to hide that fact from the sites you're visiting. The point was to not leave a trace on the machine you're doing it from. Basically, it's for porn, not news.

Re: Google Chrome Incognito Mode Can Still Be Detected

#106

Post by onion2k »

nashashmi wrote: post #29
DenisM wrote: post #15

Can this fight ever be won? If you've been browsing the internet for more than 5 minutes you already have cookies from some of the major ad networks. Therefore if you do not have cookies from the major ad networks, you're either a brand-new device or an incognito browser. All that is left to do is get in bed with the ad network to ask them if they have good cookies for this session. As it so happens most of the compa…

As for cookies against ad networks, I browse with all third party cookies blocked. Some cookies from third parties are allowed. So that would not be the effective against people with high security settings. And there is also the possibility of a brand new computer with no cookies. Then that kind of detection will not necessarily work for every one.

The owners of these websites don't care about false positives (like people on new computers). Their interest is in maximising the number of ads shown and nothing else.

Re: Google Chrome Incognito Mode Can Still Be Detected

#107

Post by quantumwannabe »

jacquesm wrote: post #18
PeterisP wrote: post #14

Earlier quoted context omitted.

One part of the "web's contract" is that googlebot and other scrapers should get what the users get. And vice versa - if you're telling googlebot that there's a particular text available to the public; I'd expect to get the same content that you just gave googlebot and not something else, thank you very much.

That used to be the case. But Google has long ago given certain sites a pass on that.

Google will index paywalled content from news sites provided they annotate it correctly. [1]

[1] https://developers.google.com/search/docs/data-types/paywall...

Re: Google Chrome Incognito Mode Can Still Be Detected

#108

Post by dorgo »

djflutt3rshy wrote: post #21
DenisM wrote: post #15

Can this fight ever be won? If you've been browsing the internet for more than 5 minutes you already have cookies from some of the major ad networks. Therefore if you do not have cookies from the major ad networks, you're either a brand-new device or an incognito browser. All that is left to do is get in bed with the ad network to ask them if they have good cookies for this session. As it so happens most of the compa…

>The last fit of madness will be a hidden session in Chrome browsing the web on your behalf, building up a bogus profile for the ad networks, and the ad networks trying to figure out if the clicks in your fake session are sufficiently human-like. The first parts of this have already been tested by Mozilla: https://trackthis.link/

> https://trackthis.link/

It opens 100 tabs? With third-party ressources and javascript blocked, it will do little in terms of shaping my ad-profile. But maybe 4GB are not enough to open 100 tabs, so I skipt this.

Re: Google Chrome Incognito Mode Can Still Be Detected

#110

Post by millstone »

DenisM wrote: post #15

Can this fight ever be won? If you've been browsing the internet for more than 5 minutes you already have cookies from some of the major ad networks. Therefore if you do not have cookies from the major ad networks, you're either a brand-new device or an incognito browser. All that is left to do is get in bed with the ad network to ask them if they have good cookies for this session. As it so happens most of the compa…

The big idea here is that the web advertising economy is user-hostile, and has to go. Someone - Apple, Chrome extension, whatever - will go nuclear, and craft the AI ad blocker that will do to ads what Gmail did to spam. God willing.
Post reply on HN