5 ms·

Wouldn't this make it obvious that the user is browsing in private mode? While I get that might be preferable to leaking information, its also not an ideal sol

Wouldn't this make it obvious that the user is browsing in private mode? While I get that might be preferable to leaking information, its also not an ideal solution either.

ZenoArrow 9y ago
Two questions: 1. What does it matter if the creators of a website are aware that a user is using private browsing to view the site? In other words, what would they do with this information? 2. As it's possible to strip out referral information using other means, assuming there's a practical use for this "private browser user" information, what could the site creators do to guard against false positives?
- rodorgas 9y ago
  There are some news websites that blocks private browsing[1]. Private browsing is a method of bypass the paywall, so they they make a private-browsing-wall. 1: https://imgur.com/a/gXEtl https://imgur.com/a/gXEtl
  - darkstar999 9y ago
    What is the current mechanism for them to know that you are in private browsing mode?
    - gruez 9y ago
      probably checking whether the DNT header is set to 1, or whether a known tracking domain is blocked (firefox has tracking protection by default in private browsing).
    - cpeterso 9y ago
      Websites can use IndexedDB to test for PBM. Firefox and Edge don't support IndexedDB in PBM. Chrome supports it using a temporary database.
ovao 9y ago
Not practically, no, since the approach is the same as setting the Referrer-Policy header to strict-origin-when-cross-origin. In most cases it can't be reliably deduced whether a visitor legitimately came from https://reddit.com/ https://reddit.com/ (from the root origin) or some path on https://reddit.com/ https://reddit.com/.
groovecoder 9y ago
Disclaimer: I'm the Firefox engineer who wrote the patch and the blog post. I'm very interested in this thread. Other replies here are correct - there are many ways that sites try to detect private browsing, and many ways they can get it right or wrong. How do people feel about the "stealth" design goal of private browsing? Should it be a goal? What about a hide-in-a-big-crowd tactic? (E.g., how Tor tries to make all its users look identical.)
- alkonaut 9y ago
  > How do people feel about the "stealth" design goal of private browsing? I think this shouldn't just be a goal for private browsing, this should be a goal for browsing period. Shouldn't the default be to just send the top level domain (if anything) of the source site as soon as you go somewhere else? The next site can't possibly use the complete url of the referring site for any (non-shady) purpose?

Wouldn't this make it obvious that the user is browsing in private mode? While I get that might be preferable to leaking information, its also not an ideal solution either.

ZenoArrow 9y ago

Two questions: 1. What does it matter if the creators of a website are aware that a user is using private browsing to view the site? In other words, what would they do with this information? 2. As it's possible to strip out referral information using other means, assuming there's a practical use for this "private browser user" information, what could the site creators do to guard against false positives?

rodorgas 9y ago
There are some news websites that blocks private browsing[1]. Private browsing is a method of bypass the paywall, so they they make a private-browsing-wall. 1: https://imgur.com/a/gXEtl https://imgur.com/a/gXEtl
- darkstar999 9y ago
  What is the current mechanism for them to know that you are in private browsing mode?
  - gruez 9y ago
    probably checking whether the DNT header is set to 1, or whether a known tracking domain is blocked (firefox has tracking protection by default in private browsing).
  - cpeterso 9y ago
    Websites can use IndexedDB to test for PBM. Firefox and Edge don't support IndexedDB in PBM. Chrome supports it using a temporary database.

ovao 9y ago

Not practically, no, since the approach is the same as setting the Referrer-Policy header to strict-origin-when-cross-origin. In most cases it can't be reliably deduced whether a visitor legitimately came from https://reddit.com/ https://reddit.com/ (from the root origin) or some path on https://reddit.com/ https://reddit.com/.

groovecoder 9y ago

Disclaimer: I'm the Firefox engineer who wrote the patch and the blog post. I'm very interested in this thread. Other replies here are correct - there are many ways that sites try to detect private browsing, and many ways they can get it right or wrong. How do people feel about the "stealth" design goal of private browsing? Should it be a goal? What about a hide-in-a-big-crowd tactic? (E.g., how Tor tries to make all its users look identical.)

alkonaut 9y ago
> How do people feel about the "stealth" design goal of private browsing? I think this shouldn't just be a goal for private browsing, this should be a goal for browsing period. Shouldn't the default be to just send the top level domain (if anything) of the source site as soon as you go somewhere else? The next site can't possibly use the complete url of the referring site for any (non-shady) purpose?