19 ms·

Judge in Google case disturbed that 'incognito' users are tracked

927 points by johncena33 6y ago

sanxiyn 6y ago
I agree it is indeed disturbing, but it is probably not illegal.
kop316 6y ago
Unless I am reading this incorrectly, I think this paragraph better summerizes the article versus the headline: "In this case, Google is accused of relying on pieces of its code within websites that use its analytics and advertising services to scrape users’ supposedly private browsing history and send copies of it to Google’s servers. Google makes it seem like private browsing mode gives users more control of their data, Amanda Bonn, a lawyer representing users, told Koh. In reality, “Google is saying there’s basically very little you can do to prevent us from collecting your data, and that’s what you should assume we’re doing,” Bonn said." It doesn't seem like the complaint is that Chrome collects data on you in "Incognito" mode, rather that websites (e.g. Google Analytics) still collect on you in "Incognito" mode.
- Blikkentrekker 6y ago
  Going incognito on Chromium still gives a warning that it does little for website tracking and purely does not save browsing history. So one can browse the finest pornography[1] without one's cohabitants finding out. [1] https://nhentai.net/g/335688/3/ https://nhentai.net/g/335688/3/
- robteix 6y ago
  > It doesn't seem like the complaint is that Chrome collects data on you in "Incognito" mode, rather that websites (e.g. Google Analytics) still collect on you in "Incognito" mode. Isn't that a distinction without a difference though? It's not Chrome, it's Google Analytics. It's all Google in the end, isn't it?
  - solidsnack9000 6y ago
    It's all stuff from Google but in the hands of different people. Google Analytics is installed by the owner of the website; it makes a promise to them: it collects everything it can. If Google Analytics actually ignored data from Chrome in Incognito mode, it raises some questions: * How does it detect that, exactly? * Is there an unfair competition aspect to it? What about other browsers, not from Google?
    - vinger 6y ago
      What other browser hold 70/80% of the market?
    - fiddlerwoaroof 6y ago
      Yeah, making incognito mode detectable would be a huge privacy issue: it would enable blocking users based on incognito and all sorts of other bad issues. If incognito mode is undetectable, there’s no way for Google Analytics to distinguish between “cross-device” traffic from an incognito window vs. from a phone and a laptop. Whether or not cross-decide tracking is good or bad, it’s irrelevant to this question.
      - postalrat 6y ago
        How is blocking incognito a bad thing? Right there it should tell the user they need to avoid that site at any price. I'm pretty sure incognito is detectable right now. I'm always going to assume it is.
    - bee_rider 6y ago
      That second point is really interesting. It seems sketchy on both ends, really. Either they are intentionally circumventing their own privacy feature, or they are giving their own browser an unfair competitive advantage. Huh, maybe the level of integration here is just inherently problematic and companies shouldn't try to fulfill every role in the market.
    - unilynx 6y ago
      > If Google Analytics actually ignored data from Chrome in Incognito mode, it raises some questions: How does it detect that, exactly? The most honest implementation would be to set the DNT header in incognito mode (as Firefox apparently does) and to have Analytics honor it. Does not require anything shady/anticompetitive
- nsgi 6y ago
  How can there be a reasonable expectation that websites won't track users in incognito mode when browsers don't give websites that information (unless the website works it out in a backwards way)?
  - jschwartzi 6y ago
    Firefox sets the Do-Not-Track flag when you're browsing in Incognito mode. I think it's only Chrome that doesn't provide that information. So it's entirely possible for your analytics trackers to not forward those analytics on for users who are in Incognito mode if those users are using a browser like Firefox.
    - deckard1 6y ago
      Do-Not-Track failed. According to Wikipedia, Apple dropped support and not many people adopted it anyway. It was always doomed to fail. You're asking the wolves not to eat you by setting an HTTP header. If these companies were the kind to care about the honor system, they wouldn't be tracking you in the first place.
      - wtetzner 6y ago
        I think the point jschwartzi was trying to make is that Do Not Track paired with legislation requiring companies to honor it could be a reasonable solution.
        d1zzy 6y ago
        I'd still end up having to disable it because there are plenty of trackers that are not bound by US laws (or any laws) and providing DNT is a stronger identification signal than not giving it.
      - feoren 6y ago
        Regulation around Do-Not-Track failed, as it often does when captured by industry. The Do Not Call list started in 2003, but it seems it's starting to be taken a lot more seriously lately. Everyone should keep using Do-Not-Track and somehow logging/reporting/publishing violations of it (although I don't even know to whom -- maybe the best we can do is a version of plaintextoffenders for now). It can eventually end up as ammunition for a future bill to actually start regulating this effectively. Calling it a failure and abandoning it is not going to help.
- eschulz 6y ago
  Upon opening an Incognito tab, Chrome warns you that your activity might be visible to websites that you visit. I'm sure Google's attorneys are aware of this.
  - alasdair_ 6y ago
    >Upon opening an Incognito tab, Chrome warns you that your activity might be visible to websites that you visit. I'm sure Google's attorneys are aware of this. To a layperson, there is a marked difference between activity and identity - there is nothing on the tab that states that the identity of the user is still discoverable.
    - eschulz 6y ago
      You make a good point. There are trusting people, and then there are software devs and lawyers.
  - pessimizer 6y ago
    Chrome warns you that websites that you visit may still track you. It doesn't warn you that Google, who owns Chrome, will still track you, which would put the lie to "incognito" anyway. It's as silly as if I ran an "anonymous" clinic where you didn't have to give your name, but my employees were instructed to figure out who you were by running in-house facial recognition software and to place the results in your file. That's materially different than warning people that "although our clinic is anonymous, you may be recognized in the waiting room by other patients" which is the way people understand Chrome's warning.
    - bqmjjx0kac 6y ago
      There are many sites on the internet, and other clinics to visit in your metaphor.
- ehnto 6y ago
  I would agree. It's an interesting position to be put in. I think most of us in tech can see the technical separation between the two bits of software, and likely feel like Google Chrome is not responsible for Google Analytic's actions, but I wonder if the court will see it that way. I think it's not an unreasonable take that if a user has let Google know it doesn't want to be tracked, that Google shouldn't track them with any of the technology they have.
  - akersten 6y ago
    > I think it's not an unreasonable take that if a user has let Google know it doesn't want to be tracked, that Google shouldn't track them with any of the technology they have. So the same people saying Google is a monopoly would say they must then further abuse their monopoly position to stop Google Analytics from tracking specifically Google Chrome users in incognito mode? The only correct outcome of this case is for those involved to realize that a browsers' "private browsing" mode is referring to a completely different type of privacy. It has nothing to do with whether Google Analytics is present in a website. Unless they want to rule that websites can't track users at-all (and what does that even mean?) when they're browsing in private mode (and how would they know?), but that would be omnibus legislating from the bench.
    - ehnto 6y ago
      I don't think that's abusing their monopoly, it's acknowledging that they are a monopoly and so they should be held accountable as a wholistic entity. I don't have a legislative outcome in mind, but I would like to point out that "Do Not Track" program was an attempt to do exactly what your second paragraph suggests, it just had no teeth and was entirely voluntary. I really don't think it's too big of an ask to not track someone flagging they don't want to be tracked, and if it takes regulation to do that then so be it. Ad-tech needs a wake up call to start behaving more ethically.
      - akersten 6y ago
        > I don't think that's abusing their monopoly, it's acknowledging that they are a monopoly and so they should be held accountable as a wholistic entity. The reason it would be abusing their monopoly is that Firefox and Edge private mode browsers would not get the same treatment. Google Analytics would still be active for them in private mode. The only ways out for parties here are: * Accept the way technology works, that browsers are separate from code that runs on websites, and acknowledge that users can be tracked regardless of what their browser chooses to do * Mandate that Google devise a way to stop tracking for all browsers in private mode (not a technically possible solution; judicial overreach), or just for Google Chrome (possible; but amplifies their monopoly because it would be a privacy incentive for users to switch to Chrome, a Google product; is also judicial overreach) * Mandate that browsers have a standard way to indicate to websites that they do not want to "be tracked" and websites must respect that (and I don't have to tell you that this one is judicial overreach :) ) So, that's why I say the only way forward that makes sense for this case is for the plaintiffs to drop it. There's no acceptable judicial recourse for them here. They can lobby the legislature if they want to make it mandatory that ad networks respect the abandoned Do-Not-Track header.
- GeneralMayhem 6y ago
  Right. Open up an incognito window right now, and you'll see, in plain English, front and center: >Your activity might still be visible to websites you visit. The error here is in treating all of Google and all of data as monoliths. The first paragraph of the article makes this... let's be generous and call it an honest mistake: > The Alphabet Inc. unit says activating the stealth mode in Chrome, or “private browsing” in other browsers, means the company won’t “remember your activity.” Yeah, I doubt anyone from Google says that, which is why they had to use phrases instead of sentences in quotes. Chrome won't remember your activity. That doesn't mean Google won't if they know who you are for some other reason.
  - sammorrowdrums 6y ago
    And outside of Tor, your public IP says a lot... never mind profiling. It would be very hard to prevent, especially for the least legitimate tracking, and then if incognito makes itself too obvious, that info is also interesting for tracking... Privacy is hard
    - gruez 6y ago
      >and then if incognito makes itself too obvious, that info is also interesting for tracking... AFAIK that's already trivially detectable on most (all?) browsers.
      - sammorrowdrums 6y ago
        Yeah, and there are some excellent fingerprinting testing sites that show it that even from a single website visit you can be narrowed down substantially, and from there a few more visits to sites working together and they could easily pin you down to an exact person. The discussion about malicious actors is insane, even legitimate ones can do it easily.
    - swiley 6y ago
      Eventually everyone will be forced to use TOR because of stuff like this.
    - 6y ago
- andjd 6y ago
  I mean, it's all Google, right? If Google analytics is de-anonymizing you in incognito mode, does it matter if Google build a back door into Chrome, or whether they just didn't develop patches in Chrome to plug whatever workaround it's own tool was using? Furthermore, wouldn't a reasonable person expect when a company offers a product with a privacy feature, that at the very least it would provide privacy from trackers that the very same company controls?
- macksd 6y ago
  Yeah Google warns you when you enable Incognito mode that it's about Chrome won't store, and specifically says website's can still track you. I think the complaint is that in this case, Google wrote the code that is commonly used to do both. I think the lawyer is arguing that since Google gives the option in one product, they should honor it in the other. Honestly, I'm not sure how I feel about that argument, but it reminds me of the character Ned from 17 Again: "I wrote the software the prevents people from stealing music. Of course, I also wrote the software that helps people steal music..." Selling weapons to both sides and all that.
  - munk-a 6y ago
    I think there are some strong reasons to want marketers to generally be less able to track our online activity and for fingerprinting of the style of Google Analytics or Facebook to not exist but Google is just one participant in this activity, it's particularly ironic that Google Analytics is working to actively counter the work of the Chrome team's incognito mode but I would only really be concerned if those two teams colluded to give Google Analytics a competitive advantage. I do generally think it's quite fair to view Alphabet as an unreasonably large company that needs to be subjected to anti-trust laws - there are many companies with far too broad a breadth of market control in the modern world. So maybe that's the better tactic, actually dust off our anti-trust laws and break up some of these tech giants.
  - numpad0 6y ago
    Is act of selling weapons to both side, ethical? Is it automatically unethical, that it is considered a monopoly, that needs to be regulated, universally across industries and contexts? Or is it not?
  - eternalban 6y ago
    > Selling weapons to both sides and all that. I wrote software that will track you on the net, not matter where or when. I also wrote the software the gives you the impression that you can do something about tracking.
  - ehsankia 6y ago
    > since Google gives the option in one product, they should honor it in the other But it can't, because websites, in theory, aren't and shouldn't be able to detect if someone is in incognito mode. There's sometimes hacky ways, but so far Chrome has patched those as they've come up.
- woah 6y ago
  That's a pretty vague and ultimately meaningless distinction. You use a Google product that says it's not going to track you, and then it tracks you and sends your data to Google's servers. The fact that the link to Google's servers is on "other websites" doesn't really change the basic reality of what is happening.
  - joshuamorton 6y ago
    But in context chrome doesn't track you. The website you visit tracks you.
    - ClumsyPilot 6y ago
      But in context falling out of a plane doesn't kill you. The land you hit kills you.
      - joshuamorton 6y ago
        To use your metaphor, if you jump out of a Boeing plane and land on a Boeing factory, it's not Boeing's fault that your parachute failed.
        ClumsyPilot 6y ago
        well it is if they sold you the Boeing parachute that says "makes your fall safe" And then people go "but it was the landing, not the fall that killed you! The contract didn't say anything about that! "
        joshuamorton 6y ago
        But they don't. They manufactured the plane, and even had a warning on the door that jumping out is dangerous since parachutes can fail! I guess I should modify my comment above. You can't sue them for the plane being broken, which is what this suit is.
- PastaMonster 6y ago
  The problem is that google refuse to fix bugs that allow fingerprinting. Those bugs can be years old!! This is why we need laws that force devs to fix privacy and security bugs or pay HUGE!!! fines. Hit them where it hurts. If each unfixed bug costs them 25% of the company's total worth per MONTH while it remains unfixed I bet they will fix them very fast. The dev tools window is still detectable by malicious javascript on sites. That stops and hides when the dev tools window is detected. I am certain google use that detection for their malicious behavior too. Why else drag their feet? They are hypocritical. First they are anal-retentive about security and on the other hand they ignore bugs for years. Not to mention the double standard google have. Long ago they fixed chrome to detect auto-installed extensions when you installed other software and yet google is doing the same bloody thing themselves. Try it yourself on a fresh new profile and check the extension page and the extension folder. Extensions are auto installed without permission. Manually removing them doesn't work either. They will be reinstalled. Edit: Speaking the truth will get you down voted. It's hilarious people down vote instead of coming with a counter argument. Perhaps they are so annoyed because they can't make a legitimate excuse for that nasty malicious behavior.
- onlyrealcuzzo 6y ago
  Wasn't Incognito pretty much built so you could go to PornHub without every time you type P in your address bar it shows everyone looking at your screen what kind of porn you're into? Did Incognito give anyone any indication that it was somehow making you untrackable? It just meant that the browser itself wasn't storing what you were doing.
  - vngzs 6y ago
    Incognito mode includes the following text on the new tab screen: > Now you can browse privately, and other people who use this device won't see your activity. However, downloads and bookmarks will be saved. > Chrome won't save the following information: Your browsing history, Cookies and site data, Information entered in forms > Your activity might still be visible to: Websites you visit, Your employer or school, Your internet service provider. I'm normally a pretty pro-digital privacy person, because I believe the odds are stacked against average consumers to an unimaginable degree. That said, I don't believe incognito mode is misleading about what it achieves. I think it's pretty upfront about what it does and what it doesn't do.
    - Nemo_bis 6y ago
      It would be interesting to see counterproofs to the claim that "other people who use this device won't see your activity". They might not see it in Chrome, but what if I search pregnancy tests and then another user of the same device sees Google Ads for pregnancy tests, or for baby products? They'll reasonably infer someone was looking for them and this might put lives in danger. The example is not theoretical: https://www.ftc.gov/news-events/blogs/business-blog/2021/01/health-app-broke-its-privacy-promises-disclosing-intimate https://www.ftc.gov/news-events/blogs/business-blog/2021/01/...
- buttersbrian 6y ago
  I get the complaint, when the browser and analytics stack are both Google. But what if the browser is Incognito Chrome, and the analytics is another company, say Adobe? Does the browser industry need a universal way to signal browsing is in "incognito" and then all analytics and tracking software MUST adhere to that, or what?
  - lolinder 6y ago
    There's already the Do Not Track header, which is supposed to serve exactly this purpose. Its problem is it has no teeth. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DNT https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DN...
    - buttersbrian 6y ago
      Yes! You are right that it lacks teeth, but also maybe doesn't go far enough. I think that's where some hoped the GPC would come in. Also, does it mean that Amazon shouldn't log general traffic, that they later decide the analyze? Even Anonymized, that data holds value to the target site, even if it were never traded/sold/etc. Lot of room for improvement beyond DNT, GPC, etc.
- zelon88 6y ago
  The problem is that Google stands on both sides of this relationship. With Firefox there are borders around where your browser ends and the sites you visit begin. Google has been blurring that line between browser and content ever since single sign on in Chrome 69. I think it's a fair exercise to explore the relationship between Chrome and Google services just because they put themselves in this position for a reason. We deserve to know what that reason is. I don't trust Google at their word. With Firefox there's no question because Mozilla lacks the ability to leverage anything they might incidentally collect in private browsing. Google does have that ability and we should know if they are abusing it. If you asked Google employees and Google fans if they thought Google was reading their Gmail for advertising they'd probably roll their eyes at you. And alas they turned out to be mistaken.
  - magicalist 6y ago
    > If you asked Google employees and Google fans if they thought Google was reading their Gmail for advertising they'd probably roll their eyes at you. And alas they turned out to be mistaken. Maybe you weren't around at the time or don't remember, but that was part of the launch announcement and never hidden and was mildly controversial at the time, for instance: https://www.nbcnews.com/id/wbna4732385 https://www.nbcnews.com/id/wbna4732385
- cptskippy 6y ago
  I think the question then becomes, is Google able to tie your Incongnito activity back to your regular activity?
  - Nemo_bis 6y ago
    Obviously yes. The activity comes from the same IP address, user-agent and everything.
- darth_avocado 6y ago
  Why is this a surprising thing? The only thing incognito mode does is that your browser doesn't remember what you surfed on the internet, pretty much everything else is fair game. Your ISPs know what you're upto, adtech is so advanced that they can still track you purely based on your IP, all the websites pretty much know who you are (if you've visited them before) even if you don't log in, why is it so surprising?
yawaworht1978 6y ago
Indeed it would be good to know what incognito sees and what it does not. If I look for a google query in incognito more, I get prompted with a consent pop up. Look like it does not see you oauth accounts, search queries are not saved, there is no history logged but you can go back in browser history. I have simply started using opera with the integrated vpn. It is good enough for my browsing. Also sites like airbnb and skyscanner kinda force you to accept cookies. Tested results back and forth.they They def know who you are. Only solution so far is vpn.
- samstave 6y ago
  Can you point me to opera with VPN tut?
  - ev1 6y ago
    It's a HTTP proxy built into Opera, not a real VPN
  - yawaworht1978 6y ago
    This is a rudimentary browser tut https://www.greengeeks.com/tutorials/article/activate-the-built-in-vpn-in-the-opera-browser/ https://www.greengeeks.com/tutorials/article/activate-the-bu... And to activate it on mobile, open the browser and click on the opera logo(bottom right). There you can toggle the vpn on. And an add blocker as well. Sure it is just a browser http proxy, sure owned by a Chinese company, but you can be sure google Chrome nor their wage slave Firefox gets to see your data. I expected the worst but was pleasantly surprised, it is pretty fast, the ux on mobile is beautiful.
- boringg 6y ago
  Maybe but afaik Opera is owned in China.
twodave 6y ago
I hate tracking as much as the next person, but a simple reading of the "You've gone incognito" screen ought to make obvious that its primary purpose is to hide your activity from others who use the same device. It's literally written on the first line: "Now you can browse privately, and other people who use this device won't see your activity." It goes on to list other technical specifics about what is not saved, but those are pretty much just sub-points. I'm not sure it's fair to expect Incognito to do something it's not meant to do.
- evmar 6y ago
  (I worked on Chrome.) I remember struggling over how to word this page. At a technical level Chrome the program can only control what it itself does, which is also what the page promises. Unfortunately despite that the result is still confusing to users (and judges, it appears).
  - Null-Set 6y ago
    chrome the program could not make network requests to known tracking domains
    - viklove 6y ago
      Google's whole business model is user tracking though. If they can't spy on you they go belly up, so chances are they won't stop spying on you. Related: I don't understand why people choose to work for Google
    - mikelward 6y ago
      Then websites would be able to tell if you were browsing with incognito on. Isn't that itself a privacy issue?
      - ehsankia 6y ago
        This is the irony here, to achieve what these people ask, Incognito mode itself would have to become inherently less private, for the sole purpose of stopping Google Analytics, but every other tracking service would probably become even more powerful.
gerash 6y ago
Next: Judge disturbed by the fact that Verizon still sees what number you called when you use a throw away phone. I don't get why on HN such clickbait articles get upvoted to the front page.
- pb7 6y ago
  Heavy bias against Google, Facebook, Amazon, and Apple.
- CameronNemo 6y ago
  It could be an important case, and it demonstrates how technically illiterate judges are.
- jeroenhd 6y ago
  I think it's quite valuable to know how technically illiterate the judge is in a case that could have very real effects on the employment of people visiting these websites. Tracking, trading of personal information and profiling are very important topics in computer ethics but when these topics hit the courts, the judge can get hung up by just the wording of the incognito mode, which, as we all know, opens with a page that explicitly states, in non-technical terms so as many people as possible can understand, that this information will still be collected. All of the well thought-out narratives on these topics can be worthless when a judge bans a practice because they didn't read the instructions when they opened incognito mode.
  - sjy 6y ago
    It’s strange that people are dismissing this judge as technically illiterate. > Koh, 45, has become the de facto face of law in Silicon Valley. "She has an almost peerless reputation for fairness and efficiency in judging the issues of the 21st century," said Tracy Beth Mitrano, director of the Internet Culture, Policy and Law Program at Cornell University. "She gets the Internet in a way that other judges just don't," she said. "Our laws are so out of sync with current social norms and technology. What Koh represents is the hope that somebody gets it." https://www.sfgate.com/bayarea/article/In-Silicon-Valley-Lucy-Koh-is-the-law-5679303.php https://www.sfgate.com/bayarea/article/In-Silicon-Valley-Luc...
whoopdedo 6y ago
Private-mode browsing has to just go away. It has always been misrepresented about what it does. Even the one, narrow use case it was originally intended for -- hiding browsing history from other users of the computer -- it never did a very good job at. Its continued presence confuses and misleads people, as this article demonstrates. I imagine the only reason it sticks around is so developers don't have to face the "bad optics" of removing a so-called privacy feature.
- recursive 6y ago
  I use it regularly. I find it extremely useful to repeat a request without any initial cookies. Without permanently removing the cookies I had Some people probably don't have a use for it, but I'd be amazed if I'm the only one who does.
mosfets 6y ago
Is this FB trying to divert people from the Apple fight?
MattGaiser 6y ago
It literally says when you open Incognito: Chrome won't save the following information: - Your browsing history - Cookies and site data - Information entered in forms Your activity might still be visible to: - Websites you visit - Your employer or school - Your internet service provider
racecondition 6y ago
odd since you know it says that as a warning on every icognito page what the purpose of it is, it is so disassociate history being logged locally so other people looking at your browser history cant see what you did. noone said its not being tracked. icognito from the perspective or your locally preserved state in the browser, not anyone elses...
marricks 6y ago
People often defend companies with explanations of how the world is, when common folk often expect (or just want) the world to behave differently. Is it unreasonable to want, or even expect, an incognito window to disable all forms of tracking? Wouldn't the world be far better if a phone alerted me to an app scanning my local area network or contacts? Or if I got warnings when it took such actions? I think us tech folks need to, collectively, stop defending companies reasoning and explanations for the world they created, and start standing with and for a world which matches common folks expectations. It really seems like a better world. --- EDIT: Ask what the layperson would think tracking is! Imagining the answer is pretty simple "a website [or the web at large] learning or remembering anything about me." If we start from there, rather than the mumbo-jumbo thrown at us, we can make progress.
- jeffbee 6y ago
  The problem is that "tracking" has no meaning, unless you are trying to align the wheels on a car. It has no definition in the language, no definition as industry jargon, and definitely no definition in the law.
- PragmaticPulp 6y ago
  > Is it unreasonable to want, or even expect, an incognito window to disable all forms of tracking? "Tracking" is a nebulous term. If a company records your visit in their logs, is that tracking? If they increment a counter every time someone visits a page, is that tracking? If a user logs in under Incognito Mode and the site records their new last login IP and timestamp, is that tracking? These questions would have sounded facetious years ago, but now nearly every form of user tracking has come under scrutiny. The common confusion is that Incognito mode isn't equivalent to using Tor or a VPN. For 99% of cases, that doesn't really matter. Explaining the distinction to the average user is a challenge, though. > Wouldn't the world be far better if a phone alerted me to an app scanning my local area network or contacts? Or if I got warnings when it took such actions? Modern phone OSes will ask for permission if an app wants to access your local network, your contacts, or your photos. That's not the concern here, though.
  - 6y ago
boredumb 6y ago
Incognito is simply a poor name for this as it infers the identity is being concealed. Should be something more along the lines of 'unaccounted' or 'unrecorded' even 'off-the-record'. If I go incognito I expect my identity to be concealed, if I am unrecorded I expect my identity to be obvious but for a trail of my actions to be off-the-record.
- jeffbee 6y ago
  Er, you are saying that it should do something other than what it does, and then also be called something else. Incognito perfectly describes what it actually does today.
  - wtetzner 6y ago
    No, it doesn't. In what way does incognito mode hide the user's identity? The article is about the fact that it doesn't.
    - jeffbee 6y ago
      You open a link in a new incognito window. In what way have you been identified to the peer host?
      - kube-system 6y ago
        For starters, the header of the IPv4/v6 packet you sent the request in has GDPR regulated PII -- your IP address.
        jeffbee 6y ago
        Did you expect it to just sit there and not establish connections? Try to participate in the debate in a way that isn't idiotic.
        kube-system 6y ago
jacquesm 6y ago
As he should be. It's not about what Google is able to do, it is all about what they should be allowed to do and clearly they are disrespecting users wishes in spite of pretty explicit signals.
- jessaustin 6y ago
  Judge Lucy Koh prefers the pronoun "she".
  - jacquesm 6y ago
    I'm sure she does.
carols10cents 6y ago
From the article: > In this case, Google is accused of relying on pieces of its code within websites that use its analytics and advertising services to scrape users’ supposedly private browsing history and send copies of it to Google’s servers. From the Chrome Incognito window: > Chrome won't save the following information: > - Your browsing history > - [etc] > Your activity might still be visible to: > - Websites you visit > - [etc] I could see an argument being made from a user's point of view that if Chrome says it's not saving your browsing history, but it turns out within one incognito session it is saving your browser history and providing it to sites that use Google Analytics, that this would be misleading. Of course, if the back button didn't work in incognito mode, that would also be a problem from a usability standpoint.
ficklepickle 6y ago
What a poorly edited article. Two typos in one sentence. No space after the previous sentence and a missing "of". "Google has become a target antitrust complaints in the last year..." I realize I may sound like an ass, but I find that very distracting. My eyes are drawn to typos and it takes me out of the flow.
PastaMonster 6y ago
Google shot themselves in the foot by being corrupt. Claiming incognito protects you while the google analytics and google's other services can run around collecting your info without any issues. You don't give users a false sense of security. That's how your buildings catch fire, literally. Some do fantasize about doing it. Read enough forums to see that pattern emerging. I'd think that would be a humbling experience if a justified attack was executed on google buildings and server farms all around the planet. I would laugh my ass off from the karma google is getting alone from that. If coordinated correctly no lives will be lost either. Not promoting it, pointing out it's possible. Companies like Google, Apple, Microsoft and facebook needs to be forced to split up. Section 230 is also overdue for a rewrite. The recent example is facebook just blocked news in Australia. Just like that.
- anchpop 6y ago
  I don't think very many people care about online privacy or tracking. People in the HN bubble really overestimate the amount that most people care that some company is giving them targeted ads. We're not anywhere close to the level required for privacy-focused terrorist cells to start forming
coef2 6y ago
I will use tor browser and duckduckgo for the rest of my life
estebarb 6y ago
I'm concerned that judges make statements about topics they are clearly not prepared to do so. In how many areas they intervene without proper knowledge? Incognito was always a way to avoid storing visits and sessions locally (mostly for... Prevent family to see your Christmas gifts).
- gowld 6y ago
  The judge didn't "make statements about topics they are clearly not prepared to do so". The judge asked the party on court to explain the topic.
jessaustin 6y ago
I, for one, would not mind receiving whatever percentage of $5000 is left over after the lawyers take their cut. Google definitely owes me at least that!
croes 6y ago
Wait until she realizes what Facebook tracks.
ggggtez 6y ago
Kids today are too young to know that Incognito/Private browsing was invented as a solution to clearing your history/cookies every time you looked at an Adult website so your parents wouldn't find out. This feature is literally just a way of preventing porn from showing up in your URL autofill when your mom comes to look something up on the computer when you're not around.
- jessaustin 6y ago
  You may have a different impression of "kids today" than I have...
staticassertion 6y ago
I honestly think that the term "tracking" is too benign. If I followed someone around, taking notes on them as I went, so that I could try to sell them something, I would be called a stalker. But do it online and it's just "tracking".
- cirenehc 6y ago
  Because in one case the target is the individual. The other case your data gets aggregated and sold as bulk in the form of ad impressions (tracking). A better comparison would be, the gov uses your census data to mail you flyers.
  - loveistheanswer 6y ago
    No, there is plenty of stalking/tracking which targets individuals. It's called microtargeting.
  - staticassertion 6y ago
    YEah I stalk a TON of people so it's fine, it's just aggregate stalking.
- yesenadam 6y ago
  > If I followed someone around, taking notes on them as I went, so that I could try to sell them something Well, stalking sounds like you're driven by some strong emotion or crazy plan. This sounds more like a private detective/investigator doing surveillance, or a "social engineer" – itself an even more over-benign term – exploiting people to get what they want.
5tefan 6y ago
Tracking should be illegal. I see it that simple.
- smartician 6y ago
  Can you define "tracking"?
  - 5tefan 6y ago
    Everything in excess of processing my shopping cart.
prtkgpt 6y ago
When "Don't be evil" doesn't live up to the standards.
ocdtrekkie 6y ago
> Broome’s attempt to downplay the privacy concerns by pointing out that the federal court system’s own website uses Google services ended up backfiring. I'm amazed Google's lawyer was amateur hour enough to go with an "everyone does it" approach here. He proved Google is a monopoly and that the court using their services poses a risk to the public.
- jessaustin 6y ago
  Not only that, but he identified "website owners" (more properly this would have been "some website administrators") as the parties aware of the situation. This is a completely different group from website visitors, whose interests are often completely opposed. By framing it this way he was admitting a problem no matter what the court's site does.
ldbooth 6y ago
To non technicals the 'cool one word' branding seems to be misleading at times. The crazies pushing the limits of Tesla's autopilot & such. It's mostly autopilot from what I hear, then again I've never heard of airplanes landing on actual autopilot or avoiding birds - the assumptions seem to be built in with catchy names unfortunately. Is it a branding or human problem....
cmiles74 6y ago
My understanding was that the "incognito" mode in Google Chrome (or "private browsing" in Firefox) would prevent data like cookies or saved passwords from remaining on the physical computer when the window was closed. I had always thought that the primary use-case was to prevent data from being stored on a shared computer, for instance in a computer lab or a library. In my opinion, it sounds like the judge is thinking of something else entirely.
ldbooth 6y ago
when this tool is compromised, as most are with time, they've got my calendar, 20 years of e-mail history, cellphone location history, website history, youtube video history. It's true they probably know more about me and my future trajectory than I do. No wonder I can't get a callback! But on the real... time to rethink le free web model if it isn't too late.
rdiddly 6y ago
My own comment deeper in the tree made me realize something, so I'm restating it at the top level. Basically the central misconception here, that Google is more than happy to leave unclear, is that Incognito Mode has ever been incognito. The only party not gathering data about your "incognito" browsing is you, i.e. the only party to whom that browsing is incognito (unknown), is you. (Oh and anyone who were to use your computer and your login to view your browsing history; that's the flimsy pretext that prevents it from being a complete lie.) In my other comment I joked that since you're basically wandering around forgetting where you've been, it should be called Forgetful Mode, and the icon should be, instead of a spy, an old man hunched over with a cane and little dots and curliques surrounding his head indicating a diffuse cognitive state. He doesn't remember where he's been! But don't worry, his caretakers will remember.
- Nemo_bis 6y ago
  Excellent point. Maybe "Goldfish mode" might work too.
tiborsaas 6y ago
I learned it the hard way that Chrome adds DNT headers in incognito mode. I naively tried to debug a Mixpanel issue in incognito mode since I use a few privacy extensions in normal mode. I got a little mad that my code was still not working then I realized that everything is fine, tracking is blocked thanks to DNT this time :)
- wildrhythms 6y ago
  Chrome does not add DNT in incognito or otherwise unless you enable the switch explicitly in chrome://settings and acknowledge the warning. You can check this yourself, open any incognito window and check the request header source in dev tools.
  - tiborsaas 6y ago
    I did that and DNT is there. I also don't remember enabling it intentionally.
jb775 6y ago
> Andrew Schapiro, a lawyer for Google, argued the company’s privacy policy “expressly discloses” its practices At what point does society strip blanket privacy policies of any actual standing
mastrsushi 6y ago
Yes, even in Porn Mode, Chrome tracks users.
hikerclimber 6y ago
Hopefully stocks all over the world go to 0
PaulWaldman 6y ago
If he is disturbed by this, image what he'd think of Tesla branding their level 2 autonomous driving system Autopilot.
clempat 6y ago
I think incognito mode is more to not let trace on your laptop than on the websites you are visiting.
clempat 6y ago
I think the incognito mode is more about not letting any trace on your laptop than on the websites you are visiting.
voceboy521 6y ago
judge doesn't know how computers work. ok boomer
ksm1717 6y ago
Read too quickly and thought I may be getting $5000
- jaza 6y ago
  $5000 * ~7 billion == ~35 trillion. New class action payout world record!
ape4 6y ago
"Incognito" just means "in disguise". But think about a halo-ween party. If you see a guy wearing a horse's head in the kitchen then later in the living room you'd guess he's the same guy.
cromwellian 6y ago
Two biggest understood uses of Incognito mode: 1) When you don't want your browser history to embarrassingly be discovered by others who share your computer or screen 2) read news articles when your free-reading quota (e.g. 5 articles per month) expires
smartician 6y ago
I read through the original complaint[1] and had a few observations that made me scratch my head. 1. All other browsers' private/incognito modes behave the same. Then why do they expect Chrome to behave differently? Is the complaint about Google Analytics collecting data, or about Chrome making false promises? 2. It never explains how the information sent to Google Analytics can be tied to your person. A public IP address is generally not good enough. Forensically maybe, when combined with ISP logs, but not routinely at scale. 3. It asserts that Google is using this information "nefariously", without going into detail: "This does not mean that Google does not utilize and/or monetize this data in any way. Google does. It merely changes the form of storage after the data has served Google’s nefarious uses." 4. It points out that this kind of information is so valuable to Google that they run a program where they pay people to observe their behavior. But, the whole complaint is about how Google collects that information already. Why have a separate program where they pay users? 5. Classifying visiting a website in incognito mode as "confidential communication" is a bit of a stretch, but that's the centerpiece of their complaint. [1] https://www.classaction.org/media/brown-et-al-v-google-llc-et-al.pdf https://www.classaction.org/media/brown-et-al-v-google-llc-e... Disclosure: I work for Google, but not in Chrome or GA. The opinions expressed in this post are mine.
purpmint008 6y ago
What a dumb thing to be disturbed about. Incognito/private mode doesn't stop a website from trying to track you. It will help you refresh your cookies and start fresh.
rbobby 6y ago
> Broome’s attempt to downplay the privacy concerns by pointing out that the federal court system’s own website uses Google services ended up backfiring. > The judge demanded an explanation “about what exactly Google does,” while voicing concern that visitors to the court’s website are unwittingly disclosing information to the company. “I want a declaration from Google on what information they’re collecting on users to the court’s website, and what that’s used for,” Koh told the company’s lawyers. Someone had a bad day at court :)
freyir 6y ago
Dumb question: Do browsers actually notify websites when the user is in incognito mode? Or is it just presenting the user as a blank state with no cookies or other local season data? I’ve always assumed the latter. So I’ve never assumed any implicit agreement that websites would turn off logging when I showed up in incognito mode.
- gundmc 6y ago
  Websites aren't supposed to be able to tell when a user is in incognito. That hasn't stopped them in the past though. Ever notice some news sites with N free articles per month would refuse to load if you were in Incognito? It has been a cat and mouse back and forth between these site operators finding ways to detect incognito sessions and browser developers fixing them. They've had some creative methods in the past like inspecting the size and availability of the local storage.
methodsignature 6y ago
Google Chrome UI: "We aren't tracking you". Google Terms: "We are absolutely tracking you". Google: Fingers were crossed; doesn't count.
user101hk 6y ago
They are feeding the court website visitor data to advertisers isn't it?
de6u99er 6y ago
Tor browser works really well if you want to avoid tracking.
02020202 6y ago
hello, i am from the government and i am here to help.
luxuryballs 6y ago
I always thought incognito mode was just to prevent records from being maintained on my local machine, not a reference to what Google is collecting.

927 points by johncena33 6y ago

I agree it is indeed disturbing, but it is probably not illegal.

Unless I am reading this incorrectly, I think this paragraph better summerizes the article versus the headline: "In this case, Google is accused of relying on pieces of its code within websites that use its analytics and advertising services to scrape users’ supposedly private browsing history and send copies of it to Google’s servers. Google makes it seem like private browsing mode gives users more control of their data, Amanda Bonn, a lawyer representing users, told Koh. In reality, “Google is saying there’s basically very little you can do to prevent us from collecting your data, and that’s what you should assume we’re doing,” Bonn said." It doesn't seem like the complaint is that Chrome collects data on you in "Incognito" mode, rather that websites (e.g. Google Analytics) still collect on you in "Incognito" mode.

Blikkentrekker 6y ago
Going incognito on Chromium still gives a warning that it does little for website tracking and purely does not save browsing history. So one can browse the finest pornography[1] without one's cohabitants finding out. [1] https://nhentai.net/g/335688/3/ https://nhentai.net/g/335688/3/
robteix 6y ago
> It doesn't seem like the complaint is that Chrome collects data on you in "Incognito" mode, rather that websites (e.g. Google Analytics) still collect on you in "Incognito" mode. Isn't that a distinction without a difference though? It's not Chrome, it's Google Analytics. It's all Google in the end, isn't it?
- solidsnack9000 6y ago
  It's all stuff from Google but in the hands of different people. Google Analytics is installed by the owner of the website; it makes a promise to them: it collects everything it can. If Google Analytics actually ignored data from Chrome in Incognito mode, it raises some questions: * How does it detect that, exactly? * Is there an unfair competition aspect to it? What about other browsers, not from Google?
  - vinger 6y ago
    What other browser hold 70/80% of the market?
  - fiddlerwoaroof 6y ago
    Yeah, making incognito mode detectable would be a huge privacy issue: it would enable blocking users based on incognito and all sorts of other bad issues. If incognito mode is undetectable, there’s no way for Google Analytics to distinguish between “cross-device” traffic from an incognito window vs. from a phone and a laptop. Whether or not cross-decide tracking is good or bad, it’s irrelevant to this question.
    - postalrat 6y ago
      How is blocking incognito a bad thing? Right there it should tell the user they need to avoid that site at any price. I'm pretty sure incognito is detectable right now. I'm always going to assume it is.
  - bee_rider 6y ago
    That second point is really interesting. It seems sketchy on both ends, really. Either they are intentionally circumventing their own privacy feature, or they are giving their own browser an unfair competitive advantage. Huh, maybe the level of integration here is just inherently problematic and companies shouldn't try to fulfill every role in the market.
  - unilynx 6y ago
    > If Google Analytics actually ignored data from Chrome in Incognito mode, it raises some questions: How does it detect that, exactly? The most honest implementation would be to set the DNT header in incognito mode (as Firefox apparently does) and to have Analytics honor it. Does not require anything shady/anticompetitive
nsgi 6y ago
How can there be a reasonable expectation that websites won't track users in incognito mode when browsers don't give websites that information (unless the website works it out in a backwards way)?
- jschwartzi 6y ago
  Firefox sets the Do-Not-Track flag when you're browsing in Incognito mode. I think it's only Chrome that doesn't provide that information. So it's entirely possible for your analytics trackers to not forward those analytics on for users who are in Incognito mode if those users are using a browser like Firefox.
  - deckard1 6y ago
    Do-Not-Track failed. According to Wikipedia, Apple dropped support and not many people adopted it anyway. It was always doomed to fail. You're asking the wolves not to eat you by setting an HTTP header. If these companies were the kind to care about the honor system, they wouldn't be tracking you in the first place.
    - wtetzner 6y ago
      I think the point jschwartzi was trying to make is that Do Not Track paired with legislation requiring companies to honor it could be a reasonable solution.
      - d1zzy 6y ago
        I'd still end up having to disable it because there are plenty of trackers that are not bound by US laws (or any laws) and providing DNT is a stronger identification signal than not giving it.
    - feoren 6y ago
      Regulation around Do-Not-Track failed, as it often does when captured by industry. The Do Not Call list started in 2003, but it seems it's starting to be taken a lot more seriously lately. Everyone should keep using Do-Not-Track and somehow logging/reporting/publishing violations of it (although I don't even know to whom -- maybe the best we can do is a version of plaintextoffenders for now). It can eventually end up as ammunition for a future bill to actually start regulating this effectively. Calling it a failure and abandoning it is not going to help.
eschulz 6y ago
Upon opening an Incognito tab, Chrome warns you that your activity might be visible to websites that you visit. I'm sure Google's attorneys are aware of this.
- alasdair_ 6y ago
  >Upon opening an Incognito tab, Chrome warns you that your activity might be visible to websites that you visit. I'm sure Google's attorneys are aware of this. To a layperson, there is a marked difference between activity and identity - there is nothing on the tab that states that the identity of the user is still discoverable.
  - eschulz 6y ago
    You make a good point. There are trusting people, and then there are software devs and lawyers.
- pessimizer 6y ago
  Chrome warns you that websites that you visit may still track you. It doesn't warn you that Google, who owns Chrome, will still track you, which would put the lie to "incognito" anyway. It's as silly as if I ran an "anonymous" clinic where you didn't have to give your name, but my employees were instructed to figure out who you were by running in-house facial recognition software and to place the results in your file. That's materially different than warning people that "although our clinic is anonymous, you may be recognized in the waiting room by other patients" which is the way people understand Chrome's warning.
  - bqmjjx0kac 6y ago
    There are many sites on the internet, and other clinics to visit in your metaphor.
ehnto 6y ago
I would agree. It's an interesting position to be put in. I think most of us in tech can see the technical separation between the two bits of software, and likely feel like Google Chrome is not responsible for Google Analytic's actions, but I wonder if the court will see it that way. I think it's not an unreasonable take that if a user has let Google know it doesn't want to be tracked, that Google shouldn't track them with any of the technology they have.
- akersten 6y ago
  > I think it's not an unreasonable take that if a user has let Google know it doesn't want to be tracked, that Google shouldn't track them with any of the technology they have. So the same people saying Google is a monopoly would say they must then further abuse their monopoly position to stop Google Analytics from tracking specifically Google Chrome users in incognito mode? The only correct outcome of this case is for those involved to realize that a browsers' "private browsing" mode is referring to a completely different type of privacy. It has nothing to do with whether Google Analytics is present in a website. Unless they want to rule that websites can't track users at-all (and what does that even mean?) when they're browsing in private mode (and how would they know?), but that would be omnibus legislating from the bench.
  - ehnto 6y ago
    I don't think that's abusing their monopoly, it's acknowledging that they are a monopoly and so they should be held accountable as a wholistic entity. I don't have a legislative outcome in mind, but I would like to point out that "Do Not Track" program was an attempt to do exactly what your second paragraph suggests, it just had no teeth and was entirely voluntary. I really don't think it's too big of an ask to not track someone flagging they don't want to be tracked, and if it takes regulation to do that then so be it. Ad-tech needs a wake up call to start behaving more ethically.
    - akersten 6y ago
      > I don't think that's abusing their monopoly, it's acknowledging that they are a monopoly and so they should be held accountable as a wholistic entity. The reason it would be abusing their monopoly is that Firefox and Edge private mode browsers would not get the same treatment. Google Analytics would still be active for them in private mode. The only ways out for parties here are: * Accept the way technology works, that browsers are separate from code that runs on websites, and acknowledge that users can be tracked regardless of what their browser chooses to do * Mandate that Google devise a way to stop tracking for all browsers in private mode (not a technically possible solution; judicial overreach), or just for Google Chrome (possible; but amplifies their monopoly because it would be a privacy incentive for users to switch to Chrome, a Google product; is also judicial overreach) * Mandate that browsers have a standard way to indicate to websites that they do not want to "be tracked" and websites must respect that (and I don't have to tell you that this one is judicial overreach :) ) So, that's why I say the only way forward that makes sense for this case is for the plaintiffs to drop it. There's no acceptable judicial recourse for them here. They can lobby the legislature if they want to make it mandatory that ad networks respect the abandoned Do-Not-Track header.
GeneralMayhem 6y ago
Right. Open up an incognito window right now, and you'll see, in plain English, front and center: >Your activity might still be visible to websites you visit. The error here is in treating all of Google and all of data as monoliths. The first paragraph of the article makes this... let's be generous and call it an honest mistake: > The Alphabet Inc. unit says activating the stealth mode in Chrome, or “private browsing” in other browsers, means the company won’t “remember your activity.” Yeah, I doubt anyone from Google says that, which is why they had to use phrases instead of sentences in quotes. Chrome won't remember your activity. That doesn't mean Google won't if they know who you are for some other reason.
- sammorrowdrums 6y ago
  And outside of Tor, your public IP says a lot... never mind profiling. It would be very hard to prevent, especially for the least legitimate tracking, and then if incognito makes itself too obvious, that info is also interesting for tracking... Privacy is hard
  - gruez 6y ago
    >and then if incognito makes itself too obvious, that info is also interesting for tracking... AFAIK that's already trivially detectable on most (all?) browsers.
    - sammorrowdrums 6y ago
      Yeah, and there are some excellent fingerprinting testing sites that show it that even from a single website visit you can be narrowed down substantially, and from there a few more visits to sites working together and they could easily pin you down to an exact person. The discussion about malicious actors is insane, even legitimate ones can do it easily.
  - swiley 6y ago
    Eventually everyone will be forced to use TOR because of stuff like this.
  - 6y ago
andjd 6y ago
I mean, it's all Google, right? If Google analytics is de-anonymizing you in incognito mode, does it matter if Google build a back door into Chrome, or whether they just didn't develop patches in Chrome to plug whatever workaround it's own tool was using? Furthermore, wouldn't a reasonable person expect when a company offers a product with a privacy feature, that at the very least it would provide privacy from trackers that the very same company controls?
macksd 6y ago
Yeah Google warns you when you enable Incognito mode that it's about Chrome won't store, and specifically says website's can still track you. I think the complaint is that in this case, Google wrote the code that is commonly used to do both. I think the lawyer is arguing that since Google gives the option in one product, they should honor it in the other. Honestly, I'm not sure how I feel about that argument, but it reminds me of the character Ned from 17 Again: "I wrote the software the prevents people from stealing music. Of course, I also wrote the software that helps people steal music..." Selling weapons to both sides and all that.
- munk-a 6y ago
  I think there are some strong reasons to want marketers to generally be less able to track our online activity and for fingerprinting of the style of Google Analytics or Facebook to not exist but Google is just one participant in this activity, it's particularly ironic that Google Analytics is working to actively counter the work of the Chrome team's incognito mode but I would only really be concerned if those two teams colluded to give Google Analytics a competitive advantage. I do generally think it's quite fair to view Alphabet as an unreasonably large company that needs to be subjected to anti-trust laws - there are many companies with far too broad a breadth of market control in the modern world. So maybe that's the better tactic, actually dust off our anti-trust laws and break up some of these tech giants.
- numpad0 6y ago
  Is act of selling weapons to both side, ethical? Is it automatically unethical, that it is considered a monopoly, that needs to be regulated, universally across industries and contexts? Or is it not?
- eternalban 6y ago
  > Selling weapons to both sides and all that. I wrote software that will track you on the net, not matter where or when. I also wrote the software the gives you the impression that you can do something about tracking.
- ehsankia 6y ago
  > since Google gives the option in one product, they should honor it in the other But it can't, because websites, in theory, aren't and shouldn't be able to detect if someone is in incognito mode. There's sometimes hacky ways, but so far Chrome has patched those as they've come up.
woah 6y ago
That's a pretty vague and ultimately meaningless distinction. You use a Google product that says it's not going to track you, and then it tracks you and sends your data to Google's servers. The fact that the link to Google's servers is on "other websites" doesn't really change the basic reality of what is happening.
- joshuamorton 6y ago
  But in context chrome doesn't track you. The website you visit tracks you.
  - ClumsyPilot 6y ago
    But in context falling out of a plane doesn't kill you. The land you hit kills you.
    - joshuamorton 6y ago
      To use your metaphor, if you jump out of a Boeing plane and land on a Boeing factory, it's not Boeing's fault that your parachute failed.
      - ClumsyPilot 6y ago
        well it is if they sold you the Boeing parachute that says "makes your fall safe" And then people go "but it was the landing, not the fall that killed you! The contract didn't say anything about that! "
        joshuamorton 6y ago
        But they don't. They manufactured the plane, and even had a warning on the door that jumping out is dangerous since parachutes can fail! I guess I should modify my comment above. You can't sue them for the plane being broken, which is what this suit is.
PastaMonster 6y ago
The problem is that google refuse to fix bugs that allow fingerprinting. Those bugs can be years old!! This is why we need laws that force devs to fix privacy and security bugs or pay HUGE!!! fines. Hit them where it hurts. If each unfixed bug costs them 25% of the company's total worth per MONTH while it remains unfixed I bet they will fix them very fast. The dev tools window is still detectable by malicious javascript on sites. That stops and hides when the dev tools window is detected. I am certain google use that detection for their malicious behavior too. Why else drag their feet? They are hypocritical. First they are anal-retentive about security and on the other hand they ignore bugs for years. Not to mention the double standard google have. Long ago they fixed chrome to detect auto-installed extensions when you installed other software and yet google is doing the same bloody thing themselves. Try it yourself on a fresh new profile and check the extension page and the extension folder. Extensions are auto installed without permission. Manually removing them doesn't work either. They will be reinstalled. Edit: Speaking the truth will get you down voted. It's hilarious people down vote instead of coming with a counter argument. Perhaps they are so annoyed because they can't make a legitimate excuse for that nasty malicious behavior.
onlyrealcuzzo 6y ago
Wasn't Incognito pretty much built so you could go to PornHub without every time you type P in your address bar it shows everyone looking at your screen what kind of porn you're into? Did Incognito give anyone any indication that it was somehow making you untrackable? It just meant that the browser itself wasn't storing what you were doing.
- vngzs 6y ago
  Incognito mode includes the following text on the new tab screen: > Now you can browse privately, and other people who use this device won't see your activity. However, downloads and bookmarks will be saved. > Chrome won't save the following information: Your browsing history, Cookies and site data, Information entered in forms > Your activity might still be visible to: Websites you visit, Your employer or school, Your internet service provider. I'm normally a pretty pro-digital privacy person, because I believe the odds are stacked against average consumers to an unimaginable degree. That said, I don't believe incognito mode is misleading about what it achieves. I think it's pretty upfront about what it does and what it doesn't do.
  - Nemo_bis 6y ago
    It would be interesting to see counterproofs to the claim that "other people who use this device won't see your activity". They might not see it in Chrome, but what if I search pregnancy tests and then another user of the same device sees Google Ads for pregnancy tests, or for baby products? They'll reasonably infer someone was looking for them and this might put lives in danger. The example is not theoretical: https://www.ftc.gov/news-events/blogs/business-blog/2021/01/health-app-broke-its-privacy-promises-disclosing-intimate https://www.ftc.gov/news-events/blogs/business-blog/2021/01/...
buttersbrian 6y ago
I get the complaint, when the browser and analytics stack are both Google. But what if the browser is Incognito Chrome, and the analytics is another company, say Adobe? Does the browser industry need a universal way to signal browsing is in "incognito" and then all analytics and tracking software MUST adhere to that, or what?
- lolinder 6y ago
  There's already the Do Not Track header, which is supposed to serve exactly this purpose. Its problem is it has no teeth. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DNT https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/DN...
  - buttersbrian 6y ago
    Yes! You are right that it lacks teeth, but also maybe doesn't go far enough. I think that's where some hoped the GPC would come in. Also, does it mean that Amazon shouldn't log general traffic, that they later decide the analyze? Even Anonymized, that data holds value to the target site, even if it were never traded/sold/etc. Lot of room for improvement beyond DNT, GPC, etc.
zelon88 6y ago
The problem is that Google stands on both sides of this relationship. With Firefox there are borders around where your browser ends and the sites you visit begin. Google has been blurring that line between browser and content ever since single sign on in Chrome 69. I think it's a fair exercise to explore the relationship between Chrome and Google services just because they put themselves in this position for a reason. We deserve to know what that reason is. I don't trust Google at their word. With Firefox there's no question because Mozilla lacks the ability to leverage anything they might incidentally collect in private browsing. Google does have that ability and we should know if they are abusing it. If you asked Google employees and Google fans if they thought Google was reading their Gmail for advertising they'd probably roll their eyes at you. And alas they turned out to be mistaken.
- magicalist 6y ago
  > If you asked Google employees and Google fans if they thought Google was reading their Gmail for advertising they'd probably roll their eyes at you. And alas they turned out to be mistaken. Maybe you weren't around at the time or don't remember, but that was part of the launch announcement and never hidden and was mildly controversial at the time, for instance: https://www.nbcnews.com/id/wbna4732385 https://www.nbcnews.com/id/wbna4732385
cptskippy 6y ago
I think the question then becomes, is Google able to tie your Incongnito activity back to your regular activity?
- Nemo_bis 6y ago
  Obviously yes. The activity comes from the same IP address, user-agent and everything.
darth_avocado 6y ago
Why is this a surprising thing? The only thing incognito mode does is that your browser doesn't remember what you surfed on the internet, pretty much everything else is fair game. Your ISPs know what you're upto, adtech is so advanced that they can still track you purely based on your IP, all the websites pretty much know who you are (if you've visited them before) even if you don't log in, why is it so surprising?

yawaworht1978 6y ago

Indeed it would be good to know what incognito sees and what it does not. If I look for a google query in incognito more, I get prompted with a consent pop up. Look like it does not see you oauth accounts, search queries are not saved, there is no history logged but you can go back in browser history. I have simply started using opera with the integrated vpn. It is good enough for my browsing. Also sites like airbnb and skyscanner kinda force you to accept cookies. Tested results back and forth.they They def know who you are. Only solution so far is vpn.

samstave 6y ago
Can you point me to opera with VPN tut?
- ev1 6y ago
  It's a HTTP proxy built into Opera, not a real VPN
- yawaworht1978 6y ago
  This is a rudimentary browser tut https://www.greengeeks.com/tutorials/article/activate-the-built-in-vpn-in-the-opera-browser/ https://www.greengeeks.com/tutorials/article/activate-the-bu... And to activate it on mobile, open the browser and click on the opera logo(bottom right). There you can toggle the vpn on. And an add blocker as well. Sure it is just a browser http proxy, sure owned by a Chinese company, but you can be sure google Chrome nor their wage slave Firefox gets to see your data. I expected the worst but was pleasantly surprised, it is pretty fast, the ux on mobile is beautiful.
boringg 6y ago
Maybe but afaik Opera is owned in China.

twodave 6y ago

I hate tracking as much as the next person, but a simple reading of the "You've gone incognito" screen ought to make obvious that its primary purpose is to hide your activity from others who use the same device. It's literally written on the first line: "Now you can browse privately, and other people who use this device won't see your activity." It goes on to list other technical specifics about what is not saved, but those are pretty much just sub-points. I'm not sure it's fair to expect Incognito to do something it's not meant to do.

evmar 6y ago
(I worked on Chrome.) I remember struggling over how to word this page. At a technical level Chrome the program can only control what it itself does, which is also what the page promises. Unfortunately despite that the result is still confusing to users (and judges, it appears).
- Null-Set 6y ago
  chrome the program could not make network requests to known tracking domains
  - viklove 6y ago
    Google's whole business model is user tracking though. If they can't spy on you they go belly up, so chances are they won't stop spying on you. Related: I don't understand why people choose to work for Google
  - mikelward 6y ago
    Then websites would be able to tell if you were browsing with incognito on. Isn't that itself a privacy issue?
    - ehsankia 6y ago
      This is the irony here, to achieve what these people ask, Incognito mode itself would have to become inherently less private, for the sole purpose of stopping Google Analytics, but every other tracking service would probably become even more powerful.

gerash 6y ago

Next: Judge disturbed by the fact that Verizon still sees what number you called when you use a throw away phone. I don't get why on HN such clickbait articles get upvoted to the front page.

pb7 6y ago
Heavy bias against Google, Facebook, Amazon, and Apple.
CameronNemo 6y ago
It could be an important case, and it demonstrates how technically illiterate judges are.
jeroenhd 6y ago
I think it's quite valuable to know how technically illiterate the judge is in a case that could have very real effects on the employment of people visiting these websites. Tracking, trading of personal information and profiling are very important topics in computer ethics but when these topics hit the courts, the judge can get hung up by just the wording of the incognito mode, which, as we all know, opens with a page that explicitly states, in non-technical terms so as many people as possible can understand, that this information will still be collected. All of the well thought-out narratives on these topics can be worthless when a judge bans a practice because they didn't read the instructions when they opened incognito mode.
- sjy 6y ago
  It’s strange that people are dismissing this judge as technically illiterate. > Koh, 45, has become the de facto face of law in Silicon Valley. "She has an almost peerless reputation for fairness and efficiency in judging the issues of the 21st century," said Tracy Beth Mitrano, director of the Internet Culture, Policy and Law Program at Cornell University. "She gets the Internet in a way that other judges just don't," she said. "Our laws are so out of sync with current social norms and technology. What Koh represents is the hope that somebody gets it." https://www.sfgate.com/bayarea/article/In-Silicon-Valley-Lucy-Koh-is-the-law-5679303.php https://www.sfgate.com/bayarea/article/In-Silicon-Valley-Luc...

whoopdedo 6y ago

Private-mode browsing has to just go away. It has always been misrepresented about what it does. Even the one, narrow use case it was originally intended for -- hiding browsing history from other users of the computer -- it never did a very good job at. Its continued presence confuses and misleads people, as this article demonstrates. I imagine the only reason it sticks around is so developers don't have to face the "bad optics" of removing a so-called privacy feature.

recursive 6y ago
I use it regularly. I find it extremely useful to repeat a request without any initial cookies. Without permanently removing the cookies I had Some people probably don't have a use for it, but I'd be amazed if I'm the only one who does.

mosfets 6y ago

Is this FB trying to divert people from the Apple fight?

MattGaiser 6y ago

It literally says when you open Incognito: Chrome won't save the following information: - Your browsing history - Cookies and site data - Information entered in forms Your activity might still be visible to: - Websites you visit - Your employer or school - Your internet service provider

racecondition 6y ago

odd since you know it says that as a warning on every icognito page what the purpose of it is, it is so disassociate history being logged locally so other people looking at your browser history cant see what you did. noone said its not being tracked. icognito from the perspective or your locally preserved state in the browser, not anyone elses...

marricks 6y ago

People often defend companies with explanations of how the world is, when common folk often expect (or just want) the world to behave differently. Is it unreasonable to want, or even expect, an incognito window to disable all forms of tracking? Wouldn't the world be far better if a phone alerted me to an app scanning my local area network or contacts? Or if I got warnings when it took such actions? I think us tech folks need to, collectively, stop defending companies reasoning and explanations for the world they created, and start standing with and for a world which matches common folks expectations. It really seems like a better world. --- EDIT: Ask what the layperson would think tracking is! Imagining the answer is pretty simple "a website [or the web at large] learning or remembering anything about me." If we start from there, rather than the mumbo-jumbo thrown at us, we can make progress.

jeffbee 6y ago
The problem is that "tracking" has no meaning, unless you are trying to align the wheels on a car. It has no definition in the language, no definition as industry jargon, and definitely no definition in the law.
PragmaticPulp 6y ago
> Is it unreasonable to want, or even expect, an incognito window to disable all forms of tracking? "Tracking" is a nebulous term. If a company records your visit in their logs, is that tracking? If they increment a counter every time someone visits a page, is that tracking? If a user logs in under Incognito Mode and the site records their new last login IP and timestamp, is that tracking? These questions would have sounded facetious years ago, but now nearly every form of user tracking has come under scrutiny. The common confusion is that Incognito mode isn't equivalent to using Tor or a VPN. For 99% of cases, that doesn't really matter. Explaining the distinction to the average user is a challenge, though. > Wouldn't the world be far better if a phone alerted me to an app scanning my local area network or contacts? Or if I got warnings when it took such actions? Modern phone OSes will ask for permission if an app wants to access your local network, your contacts, or your photos. That's not the concern here, though.
- 6y ago

boredumb 6y ago

Incognito is simply a poor name for this as it infers the identity is being concealed. Should be something more along the lines of 'unaccounted' or 'unrecorded' even 'off-the-record'. If I go incognito I expect my identity to be concealed, if I am unrecorded I expect my identity to be obvious but for a trail of my actions to be off-the-record.

jeffbee 6y ago
Er, you are saying that it should do something other than what it does, and then also be called something else. Incognito perfectly describes what it actually does today.
- wtetzner 6y ago
  No, it doesn't. In what way does incognito mode hide the user's identity? The article is about the fact that it doesn't.
  - jeffbee 6y ago
    You open a link in a new incognito window. In what way have you been identified to the peer host?
    - kube-system 6y ago
      For starters, the header of the IPv4/v6 packet you sent the request in has GDPR regulated PII -- your IP address.
      - jeffbee 6y ago
        Did you expect it to just sit there and not establish connections? Try to participate in the debate in a way that isn't idiotic.
        kube-system 6y ago

jacquesm 6y ago

As he should be. It's not about what Google is able to do, it is all about what they should be allowed to do and clearly they are disrespecting users wishes in spite of pretty explicit signals.

jessaustin 6y ago
Judge Lucy Koh prefers the pronoun "she".
- jacquesm 6y ago
  I'm sure she does.

carols10cents 6y ago

From the article: > In this case, Google is accused of relying on pieces of its code within websites that use its analytics and advertising services to scrape users’ supposedly private browsing history and send copies of it to Google’s servers. From the Chrome Incognito window: > Chrome won't save the following information: > - Your browsing history > - [etc] > Your activity might still be visible to: > - Websites you visit > - [etc] I could see an argument being made from a user's point of view that if Chrome says it's not saving your browsing history, but it turns out within one incognito session it is saving your browser history and providing it to sites that use Google Analytics, that this would be misleading. Of course, if the back button didn't work in incognito mode, that would also be a problem from a usability standpoint.

ficklepickle 6y ago

What a poorly edited article. Two typos in one sentence. No space after the previous sentence and a missing "of". "Google has become a target antitrust complaints in the last year..." I realize I may sound like an ass, but I find that very distracting. My eyes are drawn to typos and it takes me out of the flow.

PastaMonster 6y ago

Google shot themselves in the foot by being corrupt. Claiming incognito protects you while the google analytics and google's other services can run around collecting your info without any issues. You don't give users a false sense of security. That's how your buildings catch fire, literally. Some do fantasize about doing it. Read enough forums to see that pattern emerging. I'd think that would be a humbling experience if a justified attack was executed on google buildings and server farms all around the planet. I would laugh my ass off from the karma google is getting alone from that. If coordinated correctly no lives will be lost either. Not promoting it, pointing out it's possible. Companies like Google, Apple, Microsoft and facebook needs to be forced to split up. Section 230 is also overdue for a rewrite. The recent example is facebook just blocked news in Australia. Just like that.

anchpop 6y ago
I don't think very many people care about online privacy or tracking. People in the HN bubble really overestimate the amount that most people care that some company is giving them targeted ads. We're not anywhere close to the level required for privacy-focused terrorist cells to start forming

coef2 6y ago

I will use tor browser and duckduckgo for the rest of my life

estebarb 6y ago

I'm concerned that judges make statements about topics they are clearly not prepared to do so. In how many areas they intervene without proper knowledge? Incognito was always a way to avoid storing visits and sessions locally (mostly for... Prevent family to see your Christmas gifts).

gowld 6y ago
The judge didn't "make statements about topics they are clearly not prepared to do so". The judge asked the party on court to explain the topic.

jessaustin 6y ago

I, for one, would not mind receiving whatever percentage of $5000 is left over after the lawyers take their cut. Google definitely owes me at least that!

croes 6y ago

Wait until she realizes what Facebook tracks.

ggggtez 6y ago

Kids today are too young to know that Incognito/Private browsing was invented as a solution to clearing your history/cookies every time you looked at an Adult website so your parents wouldn't find out. This feature is literally just a way of preventing porn from showing up in your URL autofill when your mom comes to look something up on the computer when you're not around.

jessaustin 6y ago
You may have a different impression of "kids today" than I have...

staticassertion 6y ago

I honestly think that the term "tracking" is too benign. If I followed someone around, taking notes on them as I went, so that I could try to sell them something, I would be called a stalker. But do it online and it's just "tracking".

cirenehc 6y ago
Because in one case the target is the individual. The other case your data gets aggregated and sold as bulk in the form of ad impressions (tracking). A better comparison would be, the gov uses your census data to mail you flyers.
- loveistheanswer 6y ago
  No, there is plenty of stalking/tracking which targets individuals. It's called microtargeting.
- staticassertion 6y ago
  YEah I stalk a TON of people so it's fine, it's just aggregate stalking.
yesenadam 6y ago
> If I followed someone around, taking notes on them as I went, so that I could try to sell them something Well, stalking sounds like you're driven by some strong emotion or crazy plan. This sounds more like a private detective/investigator doing surveillance, or a "social engineer" – itself an even more over-benign term – exploiting people to get what they want.

5tefan 6y ago

Tracking should be illegal. I see it that simple.

smartician 6y ago
Can you define "tracking"?
- 5tefan 6y ago
  Everything in excess of processing my shopping cart.

prtkgpt 6y ago

When "Don't be evil" doesn't live up to the standards.

ocdtrekkie 6y ago

> Broome’s attempt to downplay the privacy concerns by pointing out that the federal court system’s own website uses Google services ended up backfiring. I'm amazed Google's lawyer was amateur hour enough to go with an "everyone does it" approach here. He proved Google is a monopoly and that the court using their services poses a risk to the public.

jessaustin 6y ago
Not only that, but he identified "website owners" (more properly this would have been "some website administrators") as the parties aware of the situation. This is a completely different group from website visitors, whose interests are often completely opposed. By framing it this way he was admitting a problem no matter what the court's site does.

ldbooth 6y ago

To non technicals the 'cool one word' branding seems to be misleading at times. The crazies pushing the limits of Tesla's autopilot & such. It's mostly autopilot from what I hear, then again I've never heard of airplanes landing on actual autopilot or avoiding birds - the assumptions seem to be built in with catchy names unfortunately. Is it a branding or human problem....

cmiles74 6y ago

My understanding was that the "incognito" mode in Google Chrome (or "private browsing" in Firefox) would prevent data like cookies or saved passwords from remaining on the physical computer when the window was closed. I had always thought that the primary use-case was to prevent data from being stored on a shared computer, for instance in a computer lab or a library. In my opinion, it sounds like the judge is thinking of something else entirely.

ldbooth 6y ago

when this tool is compromised, as most are with time, they've got my calendar, 20 years of e-mail history, cellphone location history, website history, youtube video history. It's true they probably know more about me and my future trajectory than I do. No wonder I can't get a callback! But on the real... time to rethink le free web model if it isn't too late.

rdiddly 6y ago

My own comment deeper in the tree made me realize something, so I'm restating it at the top level. Basically the central misconception here, that Google is more than happy to leave unclear, is that Incognito Mode has ever been incognito. The only party not gathering data about your "incognito" browsing is you, i.e. the only party to whom that browsing is incognito (unknown), is you. (Oh and anyone who were to use your computer and your login to view your browsing history; that's the flimsy pretext that prevents it from being a complete lie.) In my other comment I joked that since you're basically wandering around forgetting where you've been, it should be called Forgetful Mode, and the icon should be, instead of a spy, an old man hunched over with a cane and little dots and curliques surrounding his head indicating a diffuse cognitive state. He doesn't remember where he's been! But don't worry, his caretakers will remember.

Nemo_bis 6y ago
Excellent point. Maybe "Goldfish mode" might work too.

tiborsaas 6y ago

I learned it the hard way that Chrome adds DNT headers in incognito mode. I naively tried to debug a Mixpanel issue in incognito mode since I use a few privacy extensions in normal mode. I got a little mad that my code was still not working then I realized that everything is fine, tracking is blocked thanks to DNT this time :)

wildrhythms 6y ago
Chrome does not add DNT in incognito or otherwise unless you enable the switch explicitly in chrome://settings and acknowledge the warning. You can check this yourself, open any incognito window and check the request header source in dev tools.
- tiborsaas 6y ago
  I did that and DNT is there. I also don't remember enabling it intentionally.

jb775 6y ago

> Andrew Schapiro, a lawyer for Google, argued the company’s privacy policy “expressly discloses” its practices At what point does society strip blanket privacy policies of any actual standing

mastrsushi 6y ago

Yes, even in Porn Mode, Chrome tracks users.

hikerclimber 6y ago

Hopefully stocks all over the world go to 0

PaulWaldman 6y ago

If he is disturbed by this, image what he'd think of Tesla branding their level 2 autonomous driving system Autopilot.

clempat 6y ago

I think incognito mode is more to not let trace on your laptop than on the websites you are visiting.

clempat 6y ago

I think the incognito mode is more about not letting any trace on your laptop than on the websites you are visiting.

voceboy521 6y ago

judge doesn't know how computers work. ok boomer

ksm1717 6y ago

Read too quickly and thought I may be getting $5000

jaza 6y ago
$5000 * ~7 billion == ~35 trillion. New class action payout world record!

ape4 6y ago

"Incognito" just means "in disguise". But think about a halo-ween party. If you see a guy wearing a horse's head in the kitchen then later in the living room you'd guess he's the same guy.

cromwellian 6y ago

Two biggest understood uses of Incognito mode: 1) When you don't want your browser history to embarrassingly be discovered by others who share your computer or screen 2) read news articles when your free-reading quota (e.g. 5 articles per month) expires

smartician 6y ago

I read through the original complaint[1] and had a few observations that made me scratch my head. 1. All other browsers' private/incognito modes behave the same. Then why do they expect Chrome to behave differently? Is the complaint about Google Analytics collecting data, or about Chrome making false promises? 2. It never explains how the information sent to Google Analytics can be tied to your person. A public IP address is generally not good enough. Forensically maybe, when combined with ISP logs, but not routinely at scale. 3. It asserts that Google is using this information "nefariously", without going into detail: "This does not mean that Google does not utilize and/or monetize this data in any way. Google does. It merely changes the form of storage after the data has served Google’s nefarious uses." 4. It points out that this kind of information is so valuable to Google that they run a program where they pay people to observe their behavior. But, the whole complaint is about how Google collects that information already. Why have a separate program where they pay users? 5. Classifying visiting a website in incognito mode as "confidential communication" is a bit of a stretch, but that's the centerpiece of their complaint. [1] https://www.classaction.org/media/brown-et-al-v-google-llc-et-al.pdf https://www.classaction.org/media/brown-et-al-v-google-llc-e... Disclosure: I work for Google, but not in Chrome or GA. The opinions expressed in this post are mine.

purpmint008 6y ago

What a dumb thing to be disturbed about. Incognito/private mode doesn't stop a website from trying to track you. It will help you refresh your cookies and start fresh.

rbobby 6y ago

> Broome’s attempt to downplay the privacy concerns by pointing out that the federal court system’s own website uses Google services ended up backfiring. > The judge demanded an explanation “about what exactly Google does,” while voicing concern that visitors to the court’s website are unwittingly disclosing information to the company. “I want a declaration from Google on what information they’re collecting on users to the court’s website, and what that’s used for,” Koh told the company’s lawyers. Someone had a bad day at court :)

freyir 6y ago

Dumb question: Do browsers actually notify websites when the user is in incognito mode? Or is it just presenting the user as a blank state with no cookies or other local season data? I’ve always assumed the latter. So I’ve never assumed any implicit agreement that websites would turn off logging when I showed up in incognito mode.

gundmc 6y ago
Websites aren't supposed to be able to tell when a user is in incognito. That hasn't stopped them in the past though. Ever notice some news sites with N free articles per month would refuse to load if you were in Incognito? It has been a cat and mouse back and forth between these site operators finding ways to detect incognito sessions and browser developers fixing them. They've had some creative methods in the past like inspecting the size and availability of the local storage.

methodsignature 6y ago

Google Chrome UI: "We aren't tracking you". Google Terms: "We are absolutely tracking you". Google: Fingers were crossed; doesn't count.

user101hk 6y ago

They are feeding the court website visitor data to advertisers isn't it?

de6u99er 6y ago

Tor browser works really well if you want to avoid tracking.

02020202 6y ago

hello, i am from the government and i am here to help.

luxuryballs 6y ago

I always thought incognito mode was just to prevent records from being maintained on my local machine, not a reference to what Google is collecting.