6 ms·

NY Times Blocking Incognito Browsers

34 points by joegahona 8y ago

joegahona 8y ago
I was not able to replicate (the article suggests it might be a test).
- dekhn 8y ago
  I can. It doesn't always happen, but I have seen it.
olliej 8y ago
It seems like the best option given the business model. Essentially, if they want to limit a given person to N articles a month they need to be able to in some way identify them. If a person is using private mode then theoretically there isn’t a way to track them, so your option is to either not allow them to read articles at all, or actively search for, and exploit, some break in privacy. I like to imagine that many companies think that is not the right thing to do.
rahimnathwani 8y ago
This will probably stop working. From the bottom of the article: "There is one way the timing is odd, though. In order to treat incognito browsers differently, a website needs to be able to determine that they’re incognito browsers. Earlier this month, it came out that Google Chrome, the web’s most popular browser, was working to prevent sites from doing just that. Code that blinds servers to private browsing has already been added to the current Canary version of Chrome (a version used for early developer testing). New features in Canary, if all goes well, typically roll out to the standard Google Chrome in three or four months — so this sort of tactic will likely break by summer in the browser that currently has 63 percent market share. By the way, I tested this out: Running the current Google Chrome Canary (74.0.3718.0) and turning on the internal setting for the change (#enable-filesystem-in-incognito in chrome://flags) meant the Times suddenly lost its ability to detect incognito mode."
Scoundreller 8y ago
I cringe the day where my connection gets temp-banned because my browser rendered the site too quickly because I disabled all the junk a page loads.
cylinder 8y ago
I've been wondering about this and was about to make an HN thread asking about it as I couldn't find anything online. I'm no longer able to bypass the paywall via Incognito Mode. It appears to be IP-based and perhaps even guessing based on geolocation? I sometimes can't even get around it by using a VPN in a different country. And now, I've seen it block Incognito browers (I have to login to be able to read in Incognito). But oddly, I left the browser open on that page and about ten minutes later the paywall disappeared and I could see the full article. NYT should just go full paywall like FT. No way around it. if you are paying for a subscription you should feel confident knowing there's no way to bypass and get the content free. the dumbest paywall is the Australian Financial Review's. you can just hit Escape and stop the page before the paywall loads. or use Outline.com or Textise as the content is all there, it's just behind a css element. and they charge subscribers like $1,000 per year.
- thenanyu 8y ago
  I could have sworn you can get to FT articles by googling for the headline and using outline
- joegahona 8y ago
  Instead of incognito, what if you just march through a bunch of different browsers in their non-incognito modes?
thenanyu 8y ago
I wonder when a newspaper will try pay-as-you-go. $10 gets you 20 additional article credits in your allowance. Or maybe a cheaper lite subscription with a higher article limit or just A-section or something.
- dominicr 8y ago
  You mean something like Blendle? https://launch.blendle.com/ https://launch.blendle.com/ Basically top up your credit and pay per article from a range of news sources. Although it's not (yet?) as integrated, featured and wide spread as it needs to be to be really useful.
sublupo 8y ago
Can someone explain how they can detect if you are in incognito mode? I didn't understand the article's explanation. From what I understand, it checks if you can store cookies. But doesn't incognito store cookies until you close the window? When I just opened YouTube in incognito, I get generic recommendations. But after watching several videos, I get recommendations based on what I watched, which I presume, are stored as cookies.
- RandomBK 8y ago
  Some web APIs are disabled in incognito mode, yet are almost universally present on modern browsers. By attempting to use these APIs, a web page can detect if you are in Incognito. If the API is blocked, they can reasonably assume you are.
  - sublupo 8y ago
    Thanks. What were some examples of those APIs?
    - JonoW 8y ago
      I believe FileSystem API is one of them.
    - frosted-flakes 8y ago
      The localStorage API on Safari too, I believe.
  - yellowapple 8y ago
    Sounds like the reasonable thing to do would be to shim those APIs to make them look like they're functional (in fact, it sounds like Chrome Canary is doing exactly that with the filesystem API).
    - RandomBK 8y ago
      I wonder how far you'd need to shim before you can stamp out detection. I.e. does it really matter if you shim the Filesystem API? A program can just write some data and try to read it back. If the shims just no-oped those API calls, it'd be pretty easy to detect, no? Chrome Canary's workaround is to store blobs in memory, which one can argue is akin to actually implementing the API and not disabling it.
netsharc 8y ago
This style of article of "Let's post 4-5 random tweets of people mentioning the points!" annoys me... My main browser is Vivaldi, I now have Firefox set-up to clear cookies, etc, on exit, so if I want to browse WaPo I load up Firefox and the website thinks I'm just a fresh user (although this too has stopped working with WaPo's site...).
_khau 8y ago
the NYT has really done downhill over the years, so I'm exactly bristling at the thought of losing access to it.
dandersh 8y ago
Disabling JavaScript should be a suitable work around as it requires JS to run their check for private browsing. Also I have JS disabled by default and I have no issues accessing articles from the NYT, WaPo, etc.
GeekyBear 8y ago
Browser extensions that automatically delete site cookies when you close all the tabs for a given site (unless you manually add the site to your whitelist) still work and involve the least amount of ongoing user hassle. Cookie Autodelete on Firefox, for example. https://addons.mozilla.org/en-US/firefox/addon/cookie-autodelete/ https://addons.mozilla.org/en-US/firefox/addon/cookie-autode...
js2 8y ago
Disable JavaScript. Bonus: the site loads much faster.

34 points by joegahona 8y ago

joegahona 8y ago

I was not able to replicate (the article suggests it might be a test).

dekhn 8y ago
I can. It doesn't always happen, but I have seen it.

olliej 8y ago

It seems like the best option given the business model. Essentially, if they want to limit a given person to N articles a month they need to be able to in some way identify them. If a person is using private mode then theoretically there isn’t a way to track them, so your option is to either not allow them to read articles at all, or actively search for, and exploit, some break in privacy. I like to imagine that many companies think that is not the right thing to do.

rahimnathwani 8y ago

This will probably stop working. From the bottom of the article: "There is one way the timing is odd, though. In order to treat incognito browsers differently, a website needs to be able to determine that they’re incognito browsers. Earlier this month, it came out that Google Chrome, the web’s most popular browser, was working to prevent sites from doing just that. Code that blinds servers to private browsing has already been added to the current Canary version of Chrome (a version used for early developer testing). New features in Canary, if all goes well, typically roll out to the standard Google Chrome in three or four months — so this sort of tactic will likely break by summer in the browser that currently has 63 percent market share. By the way, I tested this out: Running the current Google Chrome Canary (74.0.3718.0) and turning on the internal setting for the change (#enable-filesystem-in-incognito in chrome://flags) meant the Times suddenly lost its ability to detect incognito mode."

Scoundreller 8y ago

I cringe the day where my connection gets temp-banned because my browser rendered the site too quickly because I disabled all the junk a page loads.

cylinder 8y ago

I've been wondering about this and was about to make an HN thread asking about it as I couldn't find anything online. I'm no longer able to bypass the paywall via Incognito Mode. It appears to be IP-based and perhaps even guessing based on geolocation? I sometimes can't even get around it by using a VPN in a different country. And now, I've seen it block Incognito browers (I have to login to be able to read in Incognito). But oddly, I left the browser open on that page and about ten minutes later the paywall disappeared and I could see the full article. NYT should just go full paywall like FT. No way around it. if you are paying for a subscription you should feel confident knowing there's no way to bypass and get the content free. the dumbest paywall is the Australian Financial Review's. you can just hit Escape and stop the page before the paywall loads. or use Outline.com or Textise as the content is all there, it's just behind a css element. and they charge subscribers like $1,000 per year.

thenanyu 8y ago
I could have sworn you can get to FT articles by googling for the headline and using outline
joegahona 8y ago
Instead of incognito, what if you just march through a bunch of different browsers in their non-incognito modes?

thenanyu 8y ago

I wonder when a newspaper will try pay-as-you-go. $10 gets you 20 additional article credits in your allowance. Or maybe a cheaper lite subscription with a higher article limit or just A-section or something.

dominicr 8y ago
You mean something like Blendle? https://launch.blendle.com/ https://launch.blendle.com/ Basically top up your credit and pay per article from a range of news sources. Although it's not (yet?) as integrated, featured and wide spread as it needs to be to be really useful.

sublupo 8y ago

Can someone explain how they can detect if you are in incognito mode? I didn't understand the article's explanation. From what I understand, it checks if you can store cookies. But doesn't incognito store cookies until you close the window? When I just opened YouTube in incognito, I get generic recommendations. But after watching several videos, I get recommendations based on what I watched, which I presume, are stored as cookies.

RandomBK 8y ago
Some web APIs are disabled in incognito mode, yet are almost universally present on modern browsers. By attempting to use these APIs, a web page can detect if you are in Incognito. If the API is blocked, they can reasonably assume you are.
- sublupo 8y ago
  Thanks. What were some examples of those APIs?
  - JonoW 8y ago
    I believe FileSystem API is one of them.
  - frosted-flakes 8y ago
    The localStorage API on Safari too, I believe.
- yellowapple 8y ago
  Sounds like the reasonable thing to do would be to shim those APIs to make them look like they're functional (in fact, it sounds like Chrome Canary is doing exactly that with the filesystem API).
  - RandomBK 8y ago
    I wonder how far you'd need to shim before you can stamp out detection. I.e. does it really matter if you shim the Filesystem API? A program can just write some data and try to read it back. If the shims just no-oped those API calls, it'd be pretty easy to detect, no? Chrome Canary's workaround is to store blobs in memory, which one can argue is akin to actually implementing the API and not disabling it.

netsharc 8y ago

This style of article of "Let's post 4-5 random tweets of people mentioning the points!" annoys me... My main browser is Vivaldi, I now have Firefox set-up to clear cookies, etc, on exit, so if I want to browse WaPo I load up Firefox and the website thinks I'm just a fresh user (although this too has stopped working with WaPo's site...).

_khau 8y ago

the NYT has really done downhill over the years, so I'm exactly bristling at the thought of losing access to it.

dandersh 8y ago

Disabling JavaScript should be a suitable work around as it requires JS to run their check for private browsing. Also I have JS disabled by default and I have no issues accessing articles from the NYT, WaPo, etc.

GeekyBear 8y ago

Browser extensions that automatically delete site cookies when you close all the tabs for a given site (unless you manually add the site to your whitelist) still work and involve the least amount of ongoing user hassle. Cookie Autodelete on Firefox, for example. https://addons.mozilla.org/en-US/firefox/addon/cookie-autodelete/ https://addons.mozilla.org/en-US/firefox/addon/cookie-autode...

js2 8y ago

Disable JavaScript. Bonus: the site loads much faster.