4 ms·

PSA: Facebook looks at what websites you visit in an incognito window, provided that the incognito window is open the same time as a regular browser.

tlb 9y ago
How does it do this?
- richardfeynman 9y ago
  Apparently, incognito mode uses the same temporary cookies folder as regular chrome, so FB looks at this folder if incognito is open in one window while FB is being used in another.
  - JoshMnem 9y ago
    Are you sure about that? Wouldn't it mean that all third party trackers could continue to track you while in incognito mode? How could it be called incognito mode if sites can still read your non-incognito cookies?
    - richardfeynman 9y ago
      I'm 95% confident. And yes, I think it does mean that. The trackers have to be active in a non-incognito window for it to work. It reads the shared temporary cookie folder.
      - JoshMnem 9y ago
        If incognito mode is that broken in Chrome, and still allows sites that are open in normal tabs to track you, that would be very newsworthy.
        richardfeynman 9y ago
        agreed
        JoshMnem 9y ago
        I had to know the answer, so I wrote a quick script to test it. It appears that incognito windows can't read cookies from normal windows. I've linked to the source code there. If I've missed anything, let me know. https://cookiechecker.netlify.com/ https://cookiechecker.netlify.com/
        richardfeynman 9y ago
        So cool that you built that! Here's what Google says about cookies in incognito mode: "If you use Chrome in incognito mode (or in guest mode on Chrome OS), it will not transmit any pre-existing cookies to sites that you visit. Sites may deposit new cookies on your system while you are in these modes; these cookies will only be temporarily stored and transmitted to sites while you remain in incognito / guest mode. They will be deleted when you close the browser, close all open incognito windows or exit guest mode." Source: https://www.google.com/chrome/browser/privacy/archive/20140826/index.html https://www.google.com/chrome/browser/privacy/archive/201408... I first noticed that FB might be able to detect sites you visit while in incognito mode when I noticed that I was personally being retargeted by sites I visited in incognito mode while on Facebook. Here's an interesting quora thread I found while looking into it: "Also the cookies act too important role here. Cookies during Incognito Mode are saved in temporary folder, and they get purged after session ends. But when browsing Facebook and Google in the same session, they both share same cookies folder and cookies help to send tailored ads to users." https://www.quora.com/Im-using-Incognito-mode-for-Google-searching-but-Facebook-still-shows-ads-relevant-to-my-searches-How-is-that-possible https://www.quora.com/Im-using-Incognito-mode-for-Google-sea... Curious for your take.
        richardfeynman 9y ago
        "It appears that incognito window can't read from cookies from normal windows." To be clear, the claim I'm making is that normal windows can read cookies from incognito windows.
      - gruez 9y ago
        link to proof of concept? edit: tried it on chromium 66: doesn't work. steps to reproduce: 1. open new (non-private) tab, go to http://httpbin.org/cookies/set?k1=v1&k2=v2 http://httpbin.org/cookies/set?k1=v1&k2=v2 2. check http://httpbin.org/cookies/ http://httpbin.org/cookies/, the two cookies should be there, and if you check the dev console, the expiry date is 1970-01-01 - 1 second. firefox says it's "until end of session". 3. open new private tab, go to http://httpbin.org/cookies http://httpbin.org/cookies 4. cookies from above do not show up.
gruez 9y ago
no it doesn't. https://news.ycombinator.com/item?id=16908185 https://news.ycombinator.com/item?id=16908185
- thotaway 9y ago
  Yes, it does. And your client side “steps to reproduce” do not, in fact, reproduce server-side client fingerprinting to correlate between two disconnected browser identities.

tlb 9y ago

How does it do this?

richardfeynman 9y ago
Apparently, incognito mode uses the same temporary cookies folder as regular chrome, so FB looks at this folder if incognito is open in one window while FB is being used in another.
- JoshMnem 9y ago
  Are you sure about that? Wouldn't it mean that all third party trackers could continue to track you while in incognito mode? How could it be called incognito mode if sites can still read your non-incognito cookies?
  - richardfeynman 9y ago
    I'm 95% confident. And yes, I think it does mean that. The trackers have to be active in a non-incognito window for it to work. It reads the shared temporary cookie folder.
    - JoshMnem 9y ago
      If incognito mode is that broken in Chrome, and still allows sites that are open in normal tabs to track you, that would be very newsworthy.
      - richardfeynman 9y ago
        agreed
        JoshMnem 9y ago
        I had to know the answer, so I wrote a quick script to test it. It appears that incognito windows can't read cookies from normal windows. I've linked to the source code there. If I've missed anything, let me know. https://cookiechecker.netlify.com/ https://cookiechecker.netlify.com/
        richardfeynman 9y ago
        So cool that you built that! Here's what Google says about cookies in incognito mode: "If you use Chrome in incognito mode (or in guest mode on Chrome OS), it will not transmit any pre-existing cookies to sites that you visit. Sites may deposit new cookies on your system while you are in these modes; these cookies will only be temporarily stored and transmitted to sites while you remain in incognito / guest mode. They will be deleted when you close the browser, close all open incognito windows or exit guest mode." Source: https://www.google.com/chrome/browser/privacy/archive/20140826/index.html https://www.google.com/chrome/browser/privacy/archive/201408... I first noticed that FB might be able to detect sites you visit while in incognito mode when I noticed that I was personally being retargeted by sites I visited in incognito mode while on Facebook. Here's an interesting quora thread I found while looking into it: "Also the cookies act too important role here. Cookies during Incognito Mode are saved in temporary folder, and they get purged after session ends. But when browsing Facebook and Google in the same session, they both share same cookies folder and cookies help to send tailored ads to users." https://www.quora.com/Im-using-Incognito-mode-for-Google-searching-but-Facebook-still-shows-ads-relevant-to-my-searches-How-is-that-possible https://www.quora.com/Im-using-Incognito-mode-for-Google-sea... Curious for your take.
        richardfeynman 9y ago
        "It appears that incognito window can't read from cookies from normal windows." To be clear, the claim I'm making is that normal windows can read cookies from incognito windows.
    - gruez 9y ago
      link to proof of concept? edit: tried it on chromium 66: doesn't work. steps to reproduce: 1. open new (non-private) tab, go to http://httpbin.org/cookies/set?k1=v1&k2=v2 http://httpbin.org/cookies/set?k1=v1&k2=v2 2. check http://httpbin.org/cookies/ http://httpbin.org/cookies/, the two cookies should be there, and if you check the dev console, the expiry date is 1970-01-01 - 1 second. firefox says it's "until end of session". 3. open new private tab, go to http://httpbin.org/cookies http://httpbin.org/cookies 4. cookies from above do not show up.

gruez 9y ago

no it doesn't. https://news.ycombinator.com/item?id=16908185 https://news.ycombinator.com/item?id=16908185

thotaway 9y ago
Yes, it does. And your client side “steps to reproduce” do not, in fact, reproduce server-side client fingerprinting to correlate between two disconnected browser identities.