Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Chrome Incognito Mode Can Still Be Detected

bleepingcomputer.com

Post reply on HN
Print view View original

151–160 of 201 posts

Re: Google Chrome Incognito Mode Can Still Be Detected

#151

Post by mort96 »

shultays wrote: post #147
swebs wrote: post #133

Earlier quoted context omitted.

I remember around 10 years ago people were calling Stallman paranoid for this. Now he seems more like a prophet: >I generally do not connect to web sites from my own machine, aside from a few sites I have some special relationship with. I usually fetch web pages from other sites by sending mail to a program (see https://git.savannah.gnu.org/git/womb/hacks.git ) that fetches them, much like wget, and then mails them b…

Well, that is a bit paranoid.

It's not though? If your goal is to avoid having your every move online tracked by companies hoping to earn money from spying on you, what Stallman does is one of the few strategies which work.

Re: Google Chrome Incognito Mode Can Still Be Detected

#153

Post by imgabe »

DenisM wrote: post #15

Can this fight ever be won? If you've been browsing the internet for more than 5 minutes you already have cookies from some of the major ad networks. Therefore if you do not have cookies from the major ad networks, you're either a brand-new device or an incognito browser. All that is left to do is get in bed with the ad network to ask them if they have good cookies for this session. As it so happens most of the compa…

Ultimately, if you block ads isn't the tracking useless?

Sure, you can figure out the perfect ad to show me, but if I'm never going to see it, you're wasting your time.

Re: Google Chrome Incognito Mode Can Still Be Detected

#154

Post by Reason077 »

Seems like it was a mistake to use a RAM disk to back the storage API in incognito mode?

Why not just create a new "real" storage db on disk, deleting it when the incognito window/tab is closed? It seems like this approach would defeat all of this class of attacks.

Re: Google Chrome Incognito Mode Can Still Be Detected

#155

Post by yummypaint »

DenisM wrote: post #15

Can this fight ever be won? If you've been browsing the internet for more than 5 minutes you already have cookies from some of the major ad networks. Therefore if you do not have cookies from the major ad networks, you're either a brand-new device or an incognito browser. All that is left to do is get in bed with the ad network to ask them if they have good cookies for this session. As it so happens most of the compa…

That arms race is winnable because its a question of economics, not capability. As long as the cost of unmasking people remains higher than the expected profit from doing so, the fight is won.

Re: Google Chrome Incognito Mode Can Still Be Detected

#156

Post by Reason077 »

foota wrote: post #11
NickGerleman wrote: post #9

I’m a bit surprised Chrome developers went the route of an in memory filesystem instead of trying to sandbox and clear real disk access. Silently using up to 120MB without realizing sounds pretty bad.

You can't allow for bytes to sit around on disk in case of crash. Maybe they could encrypt with a key kept in memory? That'd still allow detection of use though.

> "You can't allow for bytes to sit around on disk in case of crash."

Just check periodically (at startup?) for orphaned temporary storage data. I'm sure there are other parts of the browser that need to do this sort of thing anyway - expired cache data, for example.

Re: Google Chrome Incognito Mode Can Still Be Detected

#157

Post by walrus01 »

swebs wrote: post #133
DenisM wrote: post #15

Can this fight ever be won? If you've been browsing the internet for more than 5 minutes you already have cookies from some of the major ad networks. Therefore if you do not have cookies from the major ad networks, you're either a brand-new device or an incognito browser. All that is left to do is get in bed with the ad network to ask them if they have good cookies for this session. As it so happens most of the compa…

I remember around 10 years ago people were calling Stallman paranoid for this. Now he seems more like a prophet: >I generally do not connect to web sites from my own machine, aside from a few sites I have some special relationship with. I usually fetch web pages from other sites by sending mail to a program (see https://git.savannah.gnu.org/git/womb/hacks.git ) that fetches them, much like wget, and then mails them b…

I mean, if you want to be super paranoid like that there's no need to use a script to fetch webpages into email format. Use some sort of vnc-over-ssh session to a disposable virtual machine hosted 9500 km away, to browse interactively in a GUI, running firefox+sensible privacy extensions inside xfce4/xorg. With the right automation you could have the vm overwrite itself from an image file every day.

This could be done on the CPU+RAM+disk resources of a $4.50/month vm.

For the purpose of not being tracked by advertising networks (not a nation-state intelligence agency), a stateless vm located on a static ipv4 /32 in bulgaria that saves absolutely no data would be rather hard to track back to its actual user.

Re: Google Chrome Incognito Mode Can Still Be Detected

#158

Post by NullPrefix »

DenisM wrote: post #15

Can this fight ever be won? If you've been browsing the internet for more than 5 minutes you already have cookies from some of the major ad networks. Therefore if you do not have cookies from the major ad networks, you're either a brand-new device or an incognito browser. All that is left to do is get in bed with the ad network to ask them if they have good cookies for this session. As it so happens most of the compa…

>If you've been browsing the internet for more than 5 minutes you already have cookies from some of the major ad networks

This does not really work without 3rd party cookies, does it?

Re: Google Chrome Incognito Mode Can Still Be Detected

#159

Post by TazeTSchnitzel »

kristopolous wrote: post #125
wintorez wrote: post #40

Client tracking throw Browser Fingerprinting is a spooky tech. Check these two websites to see for yourself. Try using different browsers, even aVPN connection, and see how trackable you are: 1) https://panopticlick.eff.org 2) https://amiunique.org

These things state I'm unique every time I go to them. That's the problem with the tech, it can't track very well.

It's stable but not over a long period because your browser will change. But it could be used to link two identifiers together, for example when your IP address changes, to create a chain that can track you over time.

Re: Google Chrome Incognito Mode Can Still Be Detected

#160

Post by appleflaxen »

madars wrote: post #30

This is annoying so I just use fresh browser profile every time I encounter such site, i.e. have a short-cut for: $ cat ~/bin/chrome-new #!/bin/sh TMPDIR=`mktemp -d /dev/shm/chrome-XXXXX` google-chrome --user-data-dir=$TMPDIR --no-first-run --no-make-default-browser "$@" rm -rf $TMPDIR

This is really an awesome command line hack.

For those like me who need a bit more detail:

1) make a text file called chrome-new

2) put the following contents in the file in a POSIX-like OS

  #!/bin/sh
  TMPDIR=`mktemp -d /dev/shm/chrome-XXXXX`
  chromium-browser --user-data-dir=$TMPDIR --no-first-run --no-make-default-browser "$@"
  rm -rf $TMPDIR
3) make the text file executable:

  chmod u+x chrome-new
This also uses the chromium executable for chrome, which I think is the default on debian-based systems. If this isn't applicable to you, change "chromium-browser" on the third line to whatever the executable is for chrome on your system.
Post reply on HN