4 ms·

Direct link to the underlying paper: https://arxiv.org/abs/1907.06520 https://arxiv.org/abs/1907.06520 The "even in incognito mode" part seems odd: > What Ja

Direct link to the underlying paper: https://arxiv.org/abs/1907.06520 https://arxiv.org/abs/1907.06520 The "even in incognito mode" part seems odd: > What Jack does not know is that incognito mode only ensures his browsing history is not stored on his computer. The sites he visits, aswell as any third-party trackers, may observe and record his online actions

luckylion 7y ago
Yeah, a bit misleading, given that incognito mode doesn't share cookies (but does disk cache!) with the main profile. It's correct that they "may observe" as in "the browser still sends requests", but unless they do additional fingerprinting or use other information to correlate (IP), they can't easily connect the two observed users. It may be useful to tighten up anti-tracking-tech in incognito windows. Currently, since plugins aren't enabled in incognito windows by default, it has the opposite effect: while your cookies are hidden, you're loading each and every tracker when in incognito mode.
WA 7y ago
I think it's not that odd. People assume that incognito means, well, "incognito" – like "anonymous browsing". But there are obviously more ways to identify a user besides cookies that are cleared/reset when incognito mode is closed and re-opened. Edit: To clarify: The easiest would be an IP address check. More sophisticated techniques are browser fingerprinting. And I think there's no reason to assume that Google/Facebook/AdTech companies DON'T use these techniques.
- luckylion 7y ago
  > To clarify: The easiest would be an IP address check. More sophisticated techniques are browser fingerprinting. And I think there's no reason to assume that Google/Facebook/AdTech companies DON'T use these techniques. Regarding IPs: it would be legally problematic and might be exposed leading to terrible press, large fines and a strong argument for more regulation, so there's a lot of incentive not to use it, and I'm not sure they would even need it given the vast amount of information they have on users. Regarding fingerprinting: I believe somebody would have noticed. Google and FB are generally scrutinized much more than a random small ad-tech vendor.
  - WA 7y ago
    Sorry, are you serious or is this sarcasm? Facebook has shown in the recent months that they try to obtain data about users in every possible way. Collecting and comparing the IP address is the simplest exercise in the book. This, of course, is probably sold as "making your account more secure". It's incredible that on a site like HN people truly seem to believe that "incognito mode" equals some sort of anonymity and that there is such as thing like goodwill of Ad companies and that they won't take whatever data that is served on a silver plate (like the IP address). And you know what's really troublesome? One's sexual preferences are unlikely to change by a lot. Once captured by tracking companies, it's in your profile. Doesn't matter if you prevent tracking later on.
    - luckylion 7y ago
      > Collecting and comparing the IP address is the simplest exercise in the book. This, of course, is probably sold as "making your account more secure". Sure, and if you agree to it, they can. If you don't, however, and somebody blows the whistle, they'll be looking at huge fines in Europe and most of their lobbying will be void because their bought politicians will look very corrupt if they try to stop regulations. Again, I don't believe that they don't do it because "it's not ethical". Rather, it's going to cost them lots of money if they do and get caught (and lots of good will, too), and I doubt that they need it. IPs would be another data point, but they have so many already that it may not add as much value. That's for FB, Google & co, of course, for small ad-tech companies it's different. > Once captured by tracking companies, it's in your profile. Doesn't matter if you prevent tracking later on. That's true, and the reason why you'd want to disable tracking completely. As a user, you gain nothing from companies being able to track you, but you lose plenty. Again, I'm not suggesting that companies aren't tracking users, I'm saying that Google and FB are likely not operating that obviously that far outside the law. They can, sure, but they'll need to run a large conspiracy to keep it secret, and large conspiracies are hard and rare.
      - WA 7y ago
        Facebook collects phone numbers of random people, if a FB user uploads their contact list. Facebook collects data in shadow profiles. Facebook collects login credentials for email accounts. Facebook asks for phone numbers for "two-factor authentication" and then uses it in different ways. Similar for Google. Most default options are enabled if you set up an Android phone (and these options and settings track you). Opt-in? Off by default? Nothing. Just to name one example. Dark patterns to give consent everywhere, like buttons suggesting that opt-in is the only way to do it and so on. All of this is kinda known, and illegal under GDPR. Consequences so far? None.
- wongarsu 7y ago
  I just checked both Firefox and Chrome. When you open an incognito window both show a text snippet explaining what incognito mode is, and both go out of their way to explain that incognito mode does not make you anonymous to the website operator. It only claims to help against local users looking at your browsing history.
pdkl95 7y ago
Why is that odd? "Incognito mode" is a feature to hide your browsing history locally. Usually this meant hiding your porn browsing from your parents/roommate/etc. Hiding anything from the server was (unfortunately) never a design goal. The scope of incognito mode has recently expanded, but browsers still trust servers far too much (e.g. the Referrer header still exists, which is designed to leak private information).
- donkeyd 7y ago
  Chrome literally says this when you open incognito mode: > Your activity might still be visible to: > - Websites you visit > - Your employer or school > - Your internet service provider
  - dhimes 7y ago
    I remember when they used to also say "secret agents." Then after Snowden that disclaimer went away.
tlibert 7y ago
Second author here. The paper is written for a social-science audience (I'm the CS person, hence ACM template), so it is written that way to help get non-experts on board. Otherwise, there is ample research people don't understand how private browsing works, and there are plenty of ways to track people during privacy sessions. There are some very creative people working in adtech today and I don't doubt there are numerous methods that are being used to get around every single protection out there. I'd vastly prefer that creative energy be directed to socially beneficial ends, but I have respect for the technical chops of people in adtech. However, it is fundamentally depressing that so many smart people spend their lives shattering the bounds of decency to get an ad impression for some useless item that will go into a landfill in 18 months. Aside from privacy the biggest tragedy here is the waste of brainpower spent promoting mindless consumerism in a world rapidly moving towards climate catastrophe.

luckylion 7y ago

Yeah, a bit misleading, given that incognito mode doesn't share cookies (but does disk cache!) with the main profile. It's correct that they "may observe" as in "the browser still sends requests", but unless they do additional fingerprinting or use other information to correlate (IP), they can't easily connect the two observed users. It may be useful to tighten up anti-tracking-tech in incognito windows. Currently, since plugins aren't enabled in incognito windows by default, it has the opposite effect: while your cookies are hidden, you're loading each and every tracker when in incognito mode.

WA 7y ago

I think it's not that odd. People assume that incognito means, well, "incognito" – like "anonymous browsing". But there are obviously more ways to identify a user besides cookies that are cleared/reset when incognito mode is closed and re-opened. Edit: To clarify: The easiest would be an IP address check. More sophisticated techniques are browser fingerprinting. And I think there's no reason to assume that Google/Facebook/AdTech companies DON'T use these techniques.

luckylion 7y ago
> To clarify: The easiest would be an IP address check. More sophisticated techniques are browser fingerprinting. And I think there's no reason to assume that Google/Facebook/AdTech companies DON'T use these techniques. Regarding IPs: it would be legally problematic and might be exposed leading to terrible press, large fines and a strong argument for more regulation, so there's a lot of incentive not to use it, and I'm not sure they would even need it given the vast amount of information they have on users. Regarding fingerprinting: I believe somebody would have noticed. Google and FB are generally scrutinized much more than a random small ad-tech vendor.
- WA 7y ago
  Sorry, are you serious or is this sarcasm? Facebook has shown in the recent months that they try to obtain data about users in every possible way. Collecting and comparing the IP address is the simplest exercise in the book. This, of course, is probably sold as "making your account more secure". It's incredible that on a site like HN people truly seem to believe that "incognito mode" equals some sort of anonymity and that there is such as thing like goodwill of Ad companies and that they won't take whatever data that is served on a silver plate (like the IP address). And you know what's really troublesome? One's sexual preferences are unlikely to change by a lot. Once captured by tracking companies, it's in your profile. Doesn't matter if you prevent tracking later on.
  - luckylion 7y ago
    > Collecting and comparing the IP address is the simplest exercise in the book. This, of course, is probably sold as "making your account more secure". Sure, and if you agree to it, they can. If you don't, however, and somebody blows the whistle, they'll be looking at huge fines in Europe and most of their lobbying will be void because their bought politicians will look very corrupt if they try to stop regulations. Again, I don't believe that they don't do it because "it's not ethical". Rather, it's going to cost them lots of money if they do and get caught (and lots of good will, too), and I doubt that they need it. IPs would be another data point, but they have so many already that it may not add as much value. That's for FB, Google & co, of course, for small ad-tech companies it's different. > Once captured by tracking companies, it's in your profile. Doesn't matter if you prevent tracking later on. That's true, and the reason why you'd want to disable tracking completely. As a user, you gain nothing from companies being able to track you, but you lose plenty. Again, I'm not suggesting that companies aren't tracking users, I'm saying that Google and FB are likely not operating that obviously that far outside the law. They can, sure, but they'll need to run a large conspiracy to keep it secret, and large conspiracies are hard and rare.
    - WA 7y ago
      Facebook collects phone numbers of random people, if a FB user uploads their contact list. Facebook collects data in shadow profiles. Facebook collects login credentials for email accounts. Facebook asks for phone numbers for "two-factor authentication" and then uses it in different ways. Similar for Google. Most default options are enabled if you set up an Android phone (and these options and settings track you). Opt-in? Off by default? Nothing. Just to name one example. Dark patterns to give consent everywhere, like buttons suggesting that opt-in is the only way to do it and so on. All of this is kinda known, and illegal under GDPR. Consequences so far? None.
wongarsu 7y ago
I just checked both Firefox and Chrome. When you open an incognito window both show a text snippet explaining what incognito mode is, and both go out of their way to explain that incognito mode does not make you anonymous to the website operator. It only claims to help against local users looking at your browsing history.

pdkl95 7y ago

Why is that odd? "Incognito mode" is a feature to hide your browsing history locally. Usually this meant hiding your porn browsing from your parents/roommate/etc. Hiding anything from the server was (unfortunately) never a design goal. The scope of incognito mode has recently expanded, but browsers still trust servers far too much (e.g. the Referrer header still exists, which is designed to leak private information).

donkeyd 7y ago
Chrome literally says this when you open incognito mode: > Your activity might still be visible to: > - Websites you visit > - Your employer or school > - Your internet service provider
- dhimes 7y ago
  I remember when they used to also say "secret agents." Then after Snowden that disclaimer went away.

tlibert 7y ago

Second author here. The paper is written for a social-science audience (I'm the CS person, hence ACM template), so it is written that way to help get non-experts on board. Otherwise, there is ample research people don't understand how private browsing works, and there are plenty of ways to track people during privacy sessions. There are some very creative people working in adtech today and I don't doubt there are numerous methods that are being used to get around every single protection out there. I'd vastly prefer that creative energy be directed to socially beneficial ends, but I have respect for the technical chops of people in adtech. However, it is fundamentally depressing that so many smart people spend their lives shattering the bounds of decency to get an ad impression for some useless item that will go into a landfill in 18 months. Aside from privacy the biggest tragedy here is the waste of brainpower spent promoting mindless consumerism in a world rapidly moving towards climate catastrophe.