Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Chrome Incognito Mode Can Still Be Detected

bleepingcomputer.com

Post reply on HN
Print view View original

111–120 of 201 posts

Re: Google Chrome Incognito Mode Can Still Be Detected

#111

Post by gfosco »

millstone wrote: post #110
DenisM wrote: post #15

Can this fight ever be won? If you've been browsing the internet for more than 5 minutes you already have cookies from some of the major ad networks. Therefore if you do not have cookies from the major ad networks, you're either a brand-new device or an incognito browser. All that is left to do is get in bed with the ad network to ask them if they have good cookies for this session. As it so happens most of the compa…

The big idea here is that the web advertising economy is user-hostile, and has to go. Someone - Apple, Chrome extension, whatever - will go nuclear, and craft the AI ad blocker that will do to ads what Gmail did to spam. God willing.

I think the solution lies in a system that doesn't use HTTP. Been thinking about it for years.

Re: Google Chrome Incognito Mode Can Still Be Detected

#112

Post by chmod775 »

alasdair_ wrote: post #76
wolco wrote: post #34

Earlier quoted context omitted.

They do both or at least google does.

Even if they do both, if the bots always follow what is entered in robots.txt and humans do not, it won’t be long before that’s the primary factor.

I've seen stuff in the robots.txt get crawled anyways if enough people link to it. In Google's results it will still only show up without any contextual information though.

Re: Google Chrome Incognito Mode Can Still Be Detected

#113

Post by Dylan16807 »

kspacewalk2 wrote: post #44
Sir_Cmpwn wrote: post #28

Earlier quoted context omitted.

How about passing laws which forbid tracking users like this and levying steep, business-ending fines against the companies who don't step in line?

No problem. All your favourite online services are no longer free though, what a bummer. Will it be a lite, regular or premium Google maps subscription? How about Facebook Messenger?

If the lite subscriptions are comparable to the current content it'll be pennies per day, and only on days I actually use the service. That's acceptable.

And then I can buy a 'regular' subscription for google products that comes with actual support? It's like a dream world.

Re: Google Chrome Incognito Mode Can Still Be Detected

#114

Post by nyuszika7h »

IX-103 wrote: post #102
na85 wrote: post #64

Earlier quoted context omitted.

I feel as though your argument is predicated on browsers that leak tracking data such as cookies, etc. If the browser vendors would tighten their products up and start considering things like profiling the user's installed fonts as a security vulnerability, then we might see some progress. Unfortunately Google has a financial incentive to make Chrome trackable to advertisers.

Don't forget that the advertisers don't get income directly from tracking you. They get income based on how good they have a profile of your interests (and things that you would buy). If they can get a good enough profile without tracking then maybe they'll stop tracking. Or maybe it would be easier to block the few that continue taking than wave war on an entire industry.... There's already been some talk about chan…

I think you accidentally a word

Re: Google Chrome Incognito Mode Can Still Be Detected

#115

Post by sgentle »

foota wrote: post #11
NickGerleman wrote: post #9

I’m a bit surprised Chrome developers went the route of an in memory filesystem instead of trying to sandbox and clear real disk access. Silently using up to 120MB without realizing sounds pretty bad.

You can't allow for bytes to sit around on disk in case of crash. Maybe they could encrypt with a key kept in memory? That'd still allow detection of use though.

I wonder if the privacy threat model includes being able to prove that you used incognito mode at all, when, or how much. I can imagine all sorts of leaks in that regard (how many incognito disk files were created, size/ctime/mtime, system logging, indexes etc). None of these would require physical access to the machine at the time of incognito browsing, just subsequently.

Might seem like an incidental concern, but being able to vacuum up a pattern of incognito sessions from a seized laptop (at a border crossing, say) and correlate it with the activity of an online pseudonym could be pretty useful.

Re: Google Chrome Incognito Mode Can Still Be Detected

#116

Post by envolt »

aasasd wrote: post #87
madars wrote: post #30

This is annoying so I just use fresh browser profile every time I encounter such site, i.e. have a short-cut for: $ cat ~/bin/chrome-new #!/bin/sh TMPDIR=`mktemp -d /dev/shm/chrome-XXXXX` google-chrome --user-data-dir=$TMPDIR --no-first-run --no-make-default-browser "$@" rm -rf $TMPDIR

In FF, this seems to be solved with the mechanism of containers and extensions like ‘Temporary Containers.’

Temporary Containers is a savior when it comes to paywalled articles.

Re: Google Chrome Incognito Mode Can Still Be Detected

#117

Post by JMTQp8lwXL »

0xADEADBEE wrote: post #85
DenisM wrote: post #15

Can this fight ever be won? If you've been browsing the internet for more than 5 minutes you already have cookies from some of the major ad networks. Therefore if you do not have cookies from the major ad networks, you're either a brand-new device or an incognito browser. All that is left to do is get in bed with the ad network to ask them if they have good cookies for this session. As it so happens most of the compa…

In the same way that ublock is a must-have extension for many people, I won't browse without cookieAutoDelete [0]. Mostly I don't bother authenticating with websites anymore, and (I think about 3 maybe? And I just reauthenticate when I want to use those) and for mobile browsing I mostly use Firefox Focus [1]. The ad networks are down to browser fingerprinting now, which will be devastatingly accurate but realisticall…

The browser shouldn't be providing a User Agent anyways. No matter what device I use, my user agent should have no bearing on the HTML or JS I receive.

Re: Google Chrome Incognito Mode Can Still Be Detected

#119

Post by toper-centage »

nikolay wrote: post #118

Yes. I just open an incognito window in Chrome and go to www.instagram.com and then it prompts me to log in via a list of Instagram accounts I've ever logged in in the non-incognito Window.

If you use Chrome, did you really expect any kind of privacy to be respected?

Re: Google Chrome Incognito Mode Can Still Be Detected

#120

Post by half-kh-hacker »

coldtea wrote: post #81
hueving wrote: post #51

Earlier quoted context omitted.

>the actual important pages that people want to use? Where is this special list of important pages? Are the sites I want to use not important? Does your comment need to be so simultaneously defeatist and hostile?

> Where is this special list of important pages? Are the sites I want to use not important? Does your comment need to be so simultaneously defeatist and hostile? Or, as I like to call it, pragmatic. Visits are a power law distribution, 80% of people's visits go to 20% of sites, and so on, recursively. s So unless e.g. the top 1000 (which may vary depending on country) people want to use are there, e.g. the social med…

> Sites that "still work with JS disabled" are in the minority on those lists.

You'd be surprised how many sites are still viewable without JS enabled.

Post reply on HN