5 ms·

Does Google Chrome set DoNotTrack by default in incognito mode? If not, why not?

by pacala 6y ago

pmiller2 6y ago
I'm not sure if they do, but one potential reason not to do it is that setting DNT literally gives the server 1 additional bit of information about your configuration. This could be used to track you more effectively.
- pacala 6y ago
  1 extra bit is the last of my concerns, there's plenty of bits to uniquely fingerprint a browser anyways. I'd gladly trade one inconsequential bit, which requires malicious intent to misuse, to keep my privacy safe when dealing with honorable entities like, I presume, Google. https://blog.mozilla.org/internetcitizen/2018/07/26/this-is-your-digital-fingerprint https://blog.mozilla.org/internetcitizen/2018/07/26/this-is-... What goes into one's fingerprint: 1. navigator.userAgent, 2. navigator.language, 3. navigator.doNotTrack, 4. screen.width, 5. screen.height, 6. screen.colorDepth, 7. Intl.DateTimeFormat().resolvedOptions().timeZone, 8. navigator.platform, 9. navigator.hardwareConcurrency, 10. GPU vendor and renderer, 11. isTouch, 12. storage types, 13. font-list, 14. canvas-hash
  - pmiller2 6y ago
    Oh, there is so much more that can go into a browser fingerprint. There is no one, single "browser fingerprint." Basically any API your browser exposes can leak information that can be used for fingerprinting. See: https://panopticlick.eff.org/ https://panopticlick.eff.org/
    - pacala 6y ago
      I don't understand. There are dozens, if not hundreds, or even thousands of bits to use to identify any given browser, but providing one extra such bit that politely asks 'Do Not Track' is now a problem because it makes tracking slightly easier?
staticassertion 6y ago
DNT is broken for the exact reason stated earlier, it adds one more signal to use to track users. The lawsuit is ridiculous. Incognito mode is extremely clear about what it does and does not protect against. The irony brought up is that for Google to respect incognito they would have to then break it even more.
fsaintjacques 6y ago
Because it would be a trivial indicator that you're in incognito mode.
kevincox 6y ago
I don't think it does. One possible explanation is that they don't want the "Edge Effect". If the header is set by everyone than people will just ignore it. Since Edge started setting it for everyone the header is basically useless already. It would also provide an interesting way to identify incognito users which chrome has been trying to prevent websites from doing it. Of course it won't be perfect, but probably more than 99% of DNT headers would be incognito if they did this because I would bet that very few people enable it manually.
- pacala 6y ago
  If everyone has a lock on their door, then people will just ignore it and break into the house anyways.
  - amenod 6y ago
    > If everyone has a "Under video surveillance" sticker on their door... Ftfy.
  - gizmo385 6y ago
    It takes active effort to break into a house. It takes zero effort to ignore a header. It's more akin to everyone having a sign on their yard that says "Please don't break into this house."
    - pacala 6y ago
      Great point. There are 'No Soliciting' signs and laws. https://banneradviser.com/no-soliciting-signs https://banneradviser.com/no-soliciting-signs > In a nutshell, no, door to door solicitation isn’t illegal. But if you have a no soliciting sign posted on your property, and the salesperson is refusing to vacate the property, they can be assessed trespassing fines and possible legal charges.
      - mehrdadn 6y ago
        > But if you have a no soliciting sign posted on your property, and the salesperson is refusing to vacate the property, they can be assessed trespassing fines and possible legal charges. How is this different from when you don't have the sign? Do they get to refuse vacating the property without trespassing in that case?
_-david-_ 6y ago
I am not a Google employee but Chrome does not send the dnt header in incognito mode. It only sends it when you have it turned on, in which case it will send it in both regular and incognito mode.

Does Google Chrome set DoNotTrack by default in incognito mode? If not, why not?

by pacala 6y ago

Does Google Chrome set DoNotTrack by default in incognito mode? If not, why not?

I'm not sure if they do, but one potential reason not to do it is that setting DNT literally gives the server 1 additional bit of information about your configuration. This could be used to track you more effectively.

pacala 6y ago
1 extra bit is the last of my concerns, there's plenty of bits to uniquely fingerprint a browser anyways. I'd gladly trade one inconsequential bit, which requires malicious intent to misuse, to keep my privacy safe when dealing with honorable entities like, I presume, Google. https://blog.mozilla.org/internetcitizen/2018/07/26/this-is-your-digital-fingerprint https://blog.mozilla.org/internetcitizen/2018/07/26/this-is-... What goes into one's fingerprint: 1. navigator.userAgent, 2. navigator.language, 3. navigator.doNotTrack, 4. screen.width, 5. screen.height, 6. screen.colorDepth, 7. Intl.DateTimeFormat().resolvedOptions().timeZone, 8. navigator.platform, 9. navigator.hardwareConcurrency, 10. GPU vendor and renderer, 11. isTouch, 12. storage types, 13. font-list, 14. canvas-hash
- pmiller2 6y ago
  Oh, there is so much more that can go into a browser fingerprint. There is no one, single "browser fingerprint." Basically any API your browser exposes can leak information that can be used for fingerprinting. See: https://panopticlick.eff.org/ https://panopticlick.eff.org/
  - pacala 6y ago
    I don't understand. There are dozens, if not hundreds, or even thousands of bits to use to identify any given browser, but providing one extra such bit that politely asks 'Do Not Track' is now a problem because it makes tracking slightly easier?

staticassertion 6y ago

DNT is broken for the exact reason stated earlier, it adds one more signal to use to track users. The lawsuit is ridiculous. Incognito mode is extremely clear about what it does and does not protect against. The irony brought up is that for Google to respect incognito they would have to then break it even more.

fsaintjacques 6y ago

Because it would be a trivial indicator that you're in incognito mode.

kevincox 6y ago

I don't think it does. One possible explanation is that they don't want the "Edge Effect". If the header is set by everyone than people will just ignore it. Since Edge started setting it for everyone the header is basically useless already. It would also provide an interesting way to identify incognito users which chrome has been trying to prevent websites from doing it. Of course it won't be perfect, but probably more than 99% of DNT headers would be incognito if they did this because I would bet that very few people enable it manually.

pacala 6y ago
If everyone has a lock on their door, then people will just ignore it and break into the house anyways.
- amenod 6y ago
  > If everyone has a "Under video surveillance" sticker on their door... Ftfy.
- gizmo385 6y ago
  It takes active effort to break into a house. It takes zero effort to ignore a header. It's more akin to everyone having a sign on their yard that says "Please don't break into this house."
  - pacala 6y ago
    Great point. There are 'No Soliciting' signs and laws. https://banneradviser.com/no-soliciting-signs https://banneradviser.com/no-soliciting-signs > In a nutshell, no, door to door solicitation isn’t illegal. But if you have a no soliciting sign posted on your property, and the salesperson is refusing to vacate the property, they can be assessed trespassing fines and possible legal charges.
    - mehrdadn 6y ago
      > But if you have a no soliciting sign posted on your property, and the salesperson is refusing to vacate the property, they can be assessed trespassing fines and possible legal charges. How is this different from when you don't have the sign? Do they get to refuse vacating the property without trespassing in that case?

_-david-_ 6y ago

I am not a Google employee but Chrome does not send the dnt header in incognito mode. It only sends it when you have it turned on, in which case it will send it in both regular and incognito mode.