4 ms·

Why not let incognito mode write to disk, but entirely encrypted and randomly padded (to avoid size memorization attacks), with keys only stored in memory? That

by btown 7y ago

Why not let incognito mode write to disk, but entirely encrypted and randomly padded (to avoid size memorization attacks), with keys only stored in memory? That way you can use practically the entire storage space and avoid quota mismatches, as well as service attempts to fill the storage for detection. And in the event of a crash or power outage, no data is recoverable.

kpU8efre7r 7y ago
I've wondered why many things don't do this. Is it because it's difficult to guarantee that writing to memory doesn't eventually get swapped to disk by the OS?
- atonse 7y ago
  In some OS’s you can specify that certain pages of memory should never be swapped.
xg15 7y ago
I wonder if encryption is even necessary. Isn't the purpose of Incognito mode to protect against tracking inside the browser? At least I haven't heard so far that its also supposed to shield data from access outside the browser. So, wouldn't be enough to simply delete the space after closing the tab? (Or use a new, empty storage location for each newly opened tab)
- AbacusAvenger 7y ago
  Deletion doesn't mean the data is actually gone from disk though, so it would basically leave unencrypted evidence of incognito browsing history. There are multiple use cases for incognito, and tracking inside the browser is only one of them.
inlined 7y ago
Random padding can be detected and the existence of encrypted files would be a giveaway that users use incognito often (which may not be wanted) Iirc on *nix there’s a difference between inodes and vnodes that you might be able to take advantage of as well. The supervisor would create, open, and delete the directory before filling it. Holding the directory open gives it a vnode count of one and deleting it gives an inode count of zero thus making the current process the last thing to ever be able to reach the directory. You’d have to make sense of a full disk binary scan to guess what used to there if the disk wasn’t zeroed out, so encryption could help there too.

by btown 7y ago

kpU8efre7r 7y ago

I've wondered why many things don't do this. Is it because it's difficult to guarantee that writing to memory doesn't eventually get swapped to disk by the OS?

atonse 7y ago
In some OS’s you can specify that certain pages of memory should never be swapped.

xg15 7y ago

I wonder if encryption is even necessary. Isn't the purpose of Incognito mode to protect against tracking inside the browser? At least I haven't heard so far that its also supposed to shield data from access outside the browser. So, wouldn't be enough to simply delete the space after closing the tab? (Or use a new, empty storage location for each newly opened tab)

AbacusAvenger 7y ago
Deletion doesn't mean the data is actually gone from disk though, so it would basically leave unencrypted evidence of incognito browsing history. There are multiple use cases for incognito, and tracking inside the browser is only one of them.

inlined 7y ago

Random padding can be detected and the existence of encrypted files would be a giveaway that users use incognito often (which may not be wanted) Iirc on *nix there’s a difference between inodes and vnodes that you might be able to take advantage of as well. The supervisor would create, open, and delete the directory before filling it. Holding the directory open gives it a vnode count of one and deleting it gives an inode count of zero thus making the current process the last thing to ever be able to reach the directory. You’d have to make sense of a full disk binary scan to guess what used to there if the disk wasn’t zeroed out, so encryption could help there too.