8 ms·

This post is basically ‘I observed some behavior and I don’t understand it, so here’s some speculative fearmongering.’ The browser is not letting trackers “cont

This post is basically ‘I observed some behavior and I don’t understand it, so here’s some speculative fearmongering.’ The browser is not letting trackers “continue to "keep tabs" on us in some way”; about the only info that the site can get is that if the connection drops unexpectedly then maybe the user entered a tunnel. (In fact, closing the connection the instant the user clicks 'X' would actually give the site more information.) The reason that the behavior isn’t communicated to users (and that “Jeff is a nitwit”) is because it’s utterly irrelevant to them, and not really a privacy concern. Just because the connection was used to load an analytics script at some point in the past does not mean that the TCP socket pair somehow becomes an instrument of spying. Incidentally, there actually is some work being done to reduce the need to hold on to these connections. 0-RTT (zero round-trip-time) session resumption with QUIC (HTTP/3) should allow the browser to instantly pick back up a previous communication without needing to hold a socket open in the meantime.

lukeschlather 6y ago
So if I close the browser then open a private browsing window to the same site, the destination can't use that open connection to determine positively that the non-private window and the private window to the same IP are definitively the same machine?
- roca 6y ago
  Sites might use IP address information to guess that the sessions are correlated. But they can do that whether or not the connection remains open.
  - eternalban 6y ago
    Sure, but this removes any guess work on their end. It's the same connection.
    - dagenix 6y ago
      Do you have evidence that connections opened in non-private mode are re-used in private mode?
      - eternalban 6y ago
        >> Sites might use IP address information to guess that the sessions are correlated. But they can do that whether or not the connection remains open. [emphasis added] Responding to OP's "whether or not the connection remains open". IFF it remains open, then it's no longer a matter of correlating.
        dagenix 6y ago
        There is nothing to correlate unless the connection is actually re-used in private mode. Merely leaving an unused connection open doesn't change much of anything.
        eternalban 6y ago
        Why are you belaboring the obvious? Are you simply after arguments? Of course, the concern is switching to private mode and visiting the same site. What else?
        dagenix 6y ago
        Neither you or anyone else that I've seen have provided any evidence that the same connection is re-used. Imagine this scenario: 1. User visits a site in normal mode. Browser opens connection A. Browser uses connection A to fetch the site. Browser leaves connection A open. 2. User opens private mode. User visits the same site. Browser opens connection B to fetch the site. How does it matter that connection A was left open if some other connection was used to fetch the site in private mode? If that's not the case, then its a big deal - but that requires some sort of evidence and not just wild hand waving that it could be the case.
- rgbrenner 6y ago
  No, because the connection pool for private and non-private windows are not shared. So when you open the site in a private window, a new connection is created. There are other ways of correlating those connections (like browser fingerprinting), but the connection pool isn't a problem.
- GauntletWizard 6y ago
  I can't speak for certain, but I believe that's correct, the socket pools are separate for private browsing vs non-private for that reason.
- qbasic_forever 6y ago
  The server sees your IP regardless of your browser being in private mode or not. And yes if they have the IP in the logs and have them accessible to query, they could easily correlate all requests from the same IP and determine what they were accessing inside private windows or not.
  - rgbrenner 6y ago
    CGNAT is more common than you'd think. The IP address alone is not a definitive indicator it's the same user.
    - qbasic_forever 6y ago
      Sure, but why risk it. If you're really paranoid about browsing anonymously then use Tor.
      - heavyset_go 6y ago
        There's a gulf between the "I don't want companies tracking me" use case of the OP and the "If I get caught spying I'll be executed" use case that Tor addresses.
        ipaddr 6y ago
        But each request is logged if an ip is reused any website will be able to link your requests.
        samatman 6y ago
        Naturally there is. That gulf is readily filled with a garden-variety VPN, which works if you're doing the kind of thing where you don't want the web site keeping tabs on you but figure the VPN's reputation is enough to keep them logging your connection and doing something nefarious with that information.
        judge2020 6y ago
        For the uninitiated, don’t use tor to solve the second goal here without doing proper research. Just using tor is not effective against nation state actors: https://www.theguardian.com/world/2013/oct/04/tor-attacks-nsa-users-online-anonymity https://www.theguardian.com/world/2013/oct/04/tor-attacks-ns...
- cortesoft 6y ago
  None of the major browsers reuse connections between private and non-private tabs
- weird-eye-issue 6y ago
  That isn't definitive at all. My phone and desktop have the same IP due to a dedicated VPN.
- deleted 6y ago
  [deleted]
- cookiengineer 6y ago
  They just know that anyways in case you didn't rotate IPs via TOR or I2P. Additionally, lots of analytics services do TCP fingerprinting. So they likely know it was you, if you didn't change TCP window sizes, TTLs and options (which I assume due to web browsers reusing the native OS's tcp stack). Also if you didn't use ublock0, they will get an even better footprint via fingerprintjs (most common) that's probably as unique as it gets across your commune without having to know your exact IP.
hanniabu 6y ago
> In fact, closing the connection the instant the user clicks 'X' would actually give the site more information. How so?
- wolfgang42 6y ago
  You now know exactly the moment that they left your site. (It’s not much more information, granted.)
  - withinboredom 6y ago
    I used to set points every paragraph in my blog, where once it came into the viewport would let me know how far down the page people got. It was very insightful to write better blog posts. Letting people know when someone closed a tab, changed networks, or who knows what with the network isn’t any useful information.
- jrochkind1 6y ago
  Because it would tell them exactly when the user clicked the "x" -- the exact point the connection was closed -- which the current behavior does not do, as it's probably not predictable (sanely or possibly at all) exactly when the 'x' was clicked based on when the connection was closed. Not that that's particularly useful info. But technically it's more info revealed.
  - overscore 6y ago
    I think you can already do this using the unload event in the Page Lifecycle API and the Navigator.sendBeacon() function. It won't be reliable on mobile, though. https://developer.mozilla.org/en-US/docs/Web/API/Navigator/sendBeacon https://developer.mozilla.org/en-US/docs/Web/API/Navigator/s...
- sparky_z 6y ago
  They'll know exactly when we stopped interacting with their website. Imagine a phone system that didn't make an audible noise when the other person on the line hung up. At some point you realize that they've chosen to stop listening and you've been talking into to the void, but you don't know for how long.
Thorrez 6y ago
I agree in most cases it's not too bad. But are there any packets still flowing? What if you close a site, then an attacker starts passively sniffing your traffic. If browsers didn't keep the connection open, the attacker wouldn't be able to know what sites you visited. By keeping the connection open, I think it allows the attacker to know the IPs of the sites you visited (and thus maybe know the sites).
- NobodyNada 6y ago
  > But are there any packets still flowing? No (except TCP keepalives and a FIN when your browser finally decides to close the connection). > What if you close a site, then an attacker starts passively sniffing your traffic. [...] By keeping the connection open, I think it allows the attacker to know the IPs of the sites you visited Huh? Each TCP socket only connects your computer to a single host, and will only be reused if your browser needs to send more traffic to that same host. Your computer isn’t going to randomly send packets to the wrong website, whether or not you have an open connection to that website.
  - Thorrez 6y ago
    >No (except TCP keepalives and a FIN when your browser finally decides to close the connection). These could reveal to future eavesdroppers what sites you visited in the past. >Huh? Each TCP socket only connects your computer to a single host, and will only be reused if your browser needs to send more traffic to that same host. Your computer isn’t going to randomly send packets to the wrong website, whether or not you have an open connection to that website. I'm talking about an attacker that is passively sniffing your traffic. For example someone on the same wifi network as you who is listening to your traffic. Not some random website.
millstone 6y ago
The behavior is disabled in private browsing. That suggests some acknowledgement of a privacy risk. What is creepy here is that a random website which I closed ten minutes ago get to know when I unplug my ethernet cable. I am happy to tell a website when I close it - that is its purview. But when I close a website I want it to be closed. Now I know it lingers.
- NaturalPhallacy 6y ago
  >I am happy to tell a website when I close it - that is its purview. No it isn't. As far as I'm concerned a well behaved website/page isn't even going to have a live connection once everything is loaded. Provided it's not a video stream or something. If data the user requested isn't actively being transferred there shouldn't be a connection.
  - bryanrasmussen 6y ago
    >Provided it's not a video stream or something. there are lots of "or something" out there to require live connections.
    - johannes1234321 6y ago
      Yes, there are. But for a huge number of sites there isn't.
      - foota 6y ago
        Subsequent page loads? SSL initiation is slow because of round trip times.
        tyfon 6y ago
        I'd take the "slow" load any day over live connections to the web page. Not sure if a human could even notice it, when I load HN over SSL it is virtually instant.

lukeschlather 6y ago

So if I close the browser then open a private browsing window to the same site, the destination can't use that open connection to determine positively that the non-private window and the private window to the same IP are definitively the same machine?

roca 6y ago
Sites might use IP address information to guess that the sessions are correlated. But they can do that whether or not the connection remains open.
- eternalban 6y ago
  Sure, but this removes any guess work on their end. It's the same connection.
  - dagenix 6y ago
    Do you have evidence that connections opened in non-private mode are re-used in private mode?
    - eternalban 6y ago
      >> Sites might use IP address information to guess that the sessions are correlated. But they can do that whether or not the connection remains open. [emphasis added] Responding to OP's "whether or not the connection remains open". IFF it remains open, then it's no longer a matter of correlating.
      - dagenix 6y ago
        There is nothing to correlate unless the connection is actually re-used in private mode. Merely leaving an unused connection open doesn't change much of anything.
        eternalban 6y ago
        Why are you belaboring the obvious? Are you simply after arguments? Of course, the concern is switching to private mode and visiting the same site. What else?
        dagenix 6y ago
        Neither you or anyone else that I've seen have provided any evidence that the same connection is re-used. Imagine this scenario: 1. User visits a site in normal mode. Browser opens connection A. Browser uses connection A to fetch the site. Browser leaves connection A open. 2. User opens private mode. User visits the same site. Browser opens connection B to fetch the site. How does it matter that connection A was left open if some other connection was used to fetch the site in private mode? If that's not the case, then its a big deal - but that requires some sort of evidence and not just wild hand waving that it could be the case.
rgbrenner 6y ago
No, because the connection pool for private and non-private windows are not shared. So when you open the site in a private window, a new connection is created. There are other ways of correlating those connections (like browser fingerprinting), but the connection pool isn't a problem.
GauntletWizard 6y ago
I can't speak for certain, but I believe that's correct, the socket pools are separate for private browsing vs non-private for that reason.
qbasic_forever 6y ago
The server sees your IP regardless of your browser being in private mode or not. And yes if they have the IP in the logs and have them accessible to query, they could easily correlate all requests from the same IP and determine what they were accessing inside private windows or not.
- rgbrenner 6y ago
  CGNAT is more common than you'd think. The IP address alone is not a definitive indicator it's the same user.
  - qbasic_forever 6y ago
    Sure, but why risk it. If you're really paranoid about browsing anonymously then use Tor.
    - heavyset_go 6y ago
      There's a gulf between the "I don't want companies tracking me" use case of the OP and the "If I get caught spying I'll be executed" use case that Tor addresses.
      - ipaddr 6y ago
        But each request is logged if an ip is reused any website will be able to link your requests.
      - samatman 6y ago
        Naturally there is. That gulf is readily filled with a garden-variety VPN, which works if you're doing the kind of thing where you don't want the web site keeping tabs on you but figure the VPN's reputation is enough to keep them logging your connection and doing something nefarious with that information.
      - judge2020 6y ago
        For the uninitiated, don’t use tor to solve the second goal here without doing proper research. Just using tor is not effective against nation state actors: https://www.theguardian.com/world/2013/oct/04/tor-attacks-nsa-users-online-anonymity https://www.theguardian.com/world/2013/oct/04/tor-attacks-ns...
cortesoft 6y ago
None of the major browsers reuse connections between private and non-private tabs
weird-eye-issue 6y ago
That isn't definitive at all. My phone and desktop have the same IP due to a dedicated VPN.
deleted 6y ago
[deleted]
cookiengineer 6y ago
They just know that anyways in case you didn't rotate IPs via TOR or I2P. Additionally, lots of analytics services do TCP fingerprinting. So they likely know it was you, if you didn't change TCP window sizes, TTLs and options (which I assume due to web browsers reusing the native OS's tcp stack). Also if you didn't use ublock0, they will get an even better footprint via fingerprintjs (most common) that's probably as unique as it gets across your commune without having to know your exact IP.

hanniabu 6y ago

> In fact, closing the connection the instant the user clicks 'X' would actually give the site more information. How so?

wolfgang42 6y ago
You now know exactly the moment that they left your site. (It’s not much more information, granted.)
- withinboredom 6y ago
  I used to set points every paragraph in my blog, where once it came into the viewport would let me know how far down the page people got. It was very insightful to write better blog posts. Letting people know when someone closed a tab, changed networks, or who knows what with the network isn’t any useful information.
jrochkind1 6y ago
Because it would tell them exactly when the user clicked the "x" -- the exact point the connection was closed -- which the current behavior does not do, as it's probably not predictable (sanely or possibly at all) exactly when the 'x' was clicked based on when the connection was closed. Not that that's particularly useful info. But technically it's more info revealed.
- overscore 6y ago
  I think you can already do this using the unload event in the Page Lifecycle API and the Navigator.sendBeacon() function. It won't be reliable on mobile, though. https://developer.mozilla.org/en-US/docs/Web/API/Navigator/sendBeacon https://developer.mozilla.org/en-US/docs/Web/API/Navigator/s...
sparky_z 6y ago
They'll know exactly when we stopped interacting with their website. Imagine a phone system that didn't make an audible noise when the other person on the line hung up. At some point you realize that they've chosen to stop listening and you've been talking into to the void, but you don't know for how long.

Thorrez 6y ago

I agree in most cases it's not too bad. But are there any packets still flowing? What if you close a site, then an attacker starts passively sniffing your traffic. If browsers didn't keep the connection open, the attacker wouldn't be able to know what sites you visited. By keeping the connection open, I think it allows the attacker to know the IPs of the sites you visited (and thus maybe know the sites).

NobodyNada 6y ago
> But are there any packets still flowing? No (except TCP keepalives and a FIN when your browser finally decides to close the connection). > What if you close a site, then an attacker starts passively sniffing your traffic. [...] By keeping the connection open, I think it allows the attacker to know the IPs of the sites you visited Huh? Each TCP socket only connects your computer to a single host, and will only be reused if your browser needs to send more traffic to that same host. Your computer isn’t going to randomly send packets to the wrong website, whether or not you have an open connection to that website.
- Thorrez 6y ago
  >No (except TCP keepalives and a FIN when your browser finally decides to close the connection). These could reveal to future eavesdroppers what sites you visited in the past. >Huh? Each TCP socket only connects your computer to a single host, and will only be reused if your browser needs to send more traffic to that same host. Your computer isn’t going to randomly send packets to the wrong website, whether or not you have an open connection to that website. I'm talking about an attacker that is passively sniffing your traffic. For example someone on the same wifi network as you who is listening to your traffic. Not some random website.

millstone 6y ago

The behavior is disabled in private browsing. That suggests some acknowledgement of a privacy risk. What is creepy here is that a random website which I closed ten minutes ago get to know when I unplug my ethernet cable. I am happy to tell a website when I close it - that is its purview. But when I close a website I want it to be closed. Now I know it lingers.

NaturalPhallacy 6y ago
>I am happy to tell a website when I close it - that is its purview. No it isn't. As far as I'm concerned a well behaved website/page isn't even going to have a live connection once everything is loaded. Provided it's not a video stream or something. If data the user requested isn't actively being transferred there shouldn't be a connection.
- bryanrasmussen 6y ago
  >Provided it's not a video stream or something. there are lots of "or something" out there to require live connections.
  - johannes1234321 6y ago
    Yes, there are. But for a huge number of sites there isn't.
    - foota 6y ago
      Subsequent page loads? SSL initiation is slow because of round trip times.
      - tyfon 6y ago
        I'd take the "slow" load any day over live connections to the web page. Not sure if a human could even notice it, when I load HN over SSL it is virtually instant.