3 ms·

I, too, almost always use Chromium so it is basically stateless (except when I want bookmarks). My way is better than Incognito mode because you can have multip

by nsajko 7y ago

I, too, almost always use Chromium so it is basically stateless (except when I want bookmarks). My way is better than Incognito mode because you can have multiple sessions (example: one for Google's services that require a login, one for Stack Exchange, one for browsing); and of course because it can not be detected, unlike Incognito mode. Take a look at my comment here: https://news.ycombinator.com/item?id=20484845 https://news.ycombinator.com/item?id=20484845

Wowfunhappy 7y ago
What do you do for sites that complain each session you're using an "unrecognized browser" and require additional forms of authentication? Just deal with it every single session?
- nsajko 7y ago
  I assume by additional forms of authentication you mean codes sent over either email or SMS? Email is not a bother to deal with, because one can just copy the code over from the email; while phone SMS is not an issue because I did not confirm my phone number to any Web services. (For example, I think Paypal asks me to "confirm" my phone number every time I log in, even though Paypal knows the number is mine it is probably bound by regulation or law not to force multi-factor-authentication on me. So, just say no when asked about confirming your phone number.) Do you have an example of a site that requires "additional forms of authentication"? I remember something like that happening to me before, but I can not remember which site it happened on.
  - nine_k 7y ago
    Many sites ask for your phone just to simplify the "forgot my credentials, help me" customer support calls. Some, especially money-related, want to know your phone as a separate confirmation of your state-controlled identity, in countries where buying a SIM card required legal identification (which likely can be retrieved by a court order if need be). Yes, SMS can easily be diverted so it's not great for 2FA purposes; a voice call is often an option, and is harder to spoof. Sites that actually care about your security would go for things like TOTP, or SSH key, or a certificate. These forms do not map easily to your legal identity, but are more reliable proofs of knowing a secret.
  - jammygit 7y ago
    I made a Microsoft account to use Skype. Twitter too recently. Both sent me messages immediately saying I had either broken the terms of service, or had been potentially compromised, and needed sms second factor to log in. Since I had never used either account before this happened, it’s just a thinly veiled requirement that they can connect my account to an identifiable human. Perhaps twitters bot problem is some justification, but when they warned me about violating their rules I just deleted my almost-unused account. It was insulting
- inetknght 7y ago
  That's what I do.
- jakeogh 7y ago
  For most services I cancel the account and explain why.
MaxBarraclough 7y ago
> it can not be detected, unlike Incognito mode This may be true today, but that's because Chrome has a bug. (At least, I can't see why we wouldn't view it as a bug.) Incognito Mode shouldn't be detectable. Hopefully they'll fix that.
- nsajko 7y ago
  It is true that Google will supposedly start making an effort to make Incognito mode non-detectable [0], but Incognito mode is still crippled compared to the way I use Chromium (through a simple shell script), mostly because of the option to use multiple "sessions" simultaneously and whitelisting of browser data that gets copied/used. [0] https://www.blog.google/outreach-initiatives/google-news-initiative/protecting-private-browsing-chrome/ https://www.blog.google/outreach-initiatives/google-news-ini...

by nsajko 7y ago

Wowfunhappy 7y ago

What do you do for sites that complain each session you're using an "unrecognized browser" and require additional forms of authentication? Just deal with it every single session?

nsajko 7y ago
I assume by additional forms of authentication you mean codes sent over either email or SMS? Email is not a bother to deal with, because one can just copy the code over from the email; while phone SMS is not an issue because I did not confirm my phone number to any Web services. (For example, I think Paypal asks me to "confirm" my phone number every time I log in, even though Paypal knows the number is mine it is probably bound by regulation or law not to force multi-factor-authentication on me. So, just say no when asked about confirming your phone number.) Do you have an example of a site that requires "additional forms of authentication"? I remember something like that happening to me before, but I can not remember which site it happened on.
- nine_k 7y ago
  Many sites ask for your phone just to simplify the "forgot my credentials, help me" customer support calls. Some, especially money-related, want to know your phone as a separate confirmation of your state-controlled identity, in countries where buying a SIM card required legal identification (which likely can be retrieved by a court order if need be). Yes, SMS can easily be diverted so it's not great for 2FA purposes; a voice call is often an option, and is harder to spoof. Sites that actually care about your security would go for things like TOTP, or SSH key, or a certificate. These forms do not map easily to your legal identity, but are more reliable proofs of knowing a secret.
- jammygit 7y ago
  I made a Microsoft account to use Skype. Twitter too recently. Both sent me messages immediately saying I had either broken the terms of service, or had been potentially compromised, and needed sms second factor to log in. Since I had never used either account before this happened, it’s just a thinly veiled requirement that they can connect my account to an identifiable human. Perhaps twitters bot problem is some justification, but when they warned me about violating their rules I just deleted my almost-unused account. It was insulting
inetknght 7y ago
That's what I do.
jakeogh 7y ago
For most services I cancel the account and explain why.

MaxBarraclough 7y ago

> it can not be detected, unlike Incognito mode This may be true today, but that's because Chrome has a bug. (At least, I can't see why we wouldn't view it as a bug.) Incognito Mode shouldn't be detectable. Hopefully they'll fix that.

nsajko 7y ago
It is true that Google will supposedly start making an effort to make Incognito mode non-detectable [0], but Incognito mode is still crippled compared to the way I use Chromium (through a simple shell script), mostly because of the option to use multiple "sessions" simultaneously and whitelisting of browser data that gets copied/used. [0] https://www.blog.google/outreach-initiatives/google-news-initiative/protecting-private-browsing-chrome/ https://www.blog.google/outreach-initiatives/google-news-ini...