4 ms·

So if I close the browser then open a private browsing window to the same site, the destination can't use that open connection to determine positively that the

So if I close the browser then open a private browsing window to the same site, the destination can't use that open connection to determine positively that the non-private window and the private window to the same IP are definitively the same machine?

roca 6y ago
Sites might use IP address information to guess that the sessions are correlated. But they can do that whether or not the connection remains open.
- eternalban 6y ago
  Sure, but this removes any guess work on their end. It's the same connection.
  - dagenix 6y ago
    Do you have evidence that connections opened in non-private mode are re-used in private mode?
    - eternalban 6y ago
      >> Sites might use IP address information to guess that the sessions are correlated. But they can do that whether or not the connection remains open. [emphasis added] Responding to OP's "whether or not the connection remains open". IFF it remains open, then it's no longer a matter of correlating.
      - dagenix 6y ago
        There is nothing to correlate unless the connection is actually re-used in private mode. Merely leaving an unused connection open doesn't change much of anything.
        eternalban 6y ago
        Why are you belaboring the obvious? Are you simply after arguments? Of course, the concern is switching to private mode and visiting the same site. What else?
        dagenix 6y ago
        Neither you or anyone else that I've seen have provided any evidence that the same connection is re-used. Imagine this scenario: 1. User visits a site in normal mode. Browser opens connection A. Browser uses connection A to fetch the site. Browser leaves connection A open. 2. User opens private mode. User visits the same site. Browser opens connection B to fetch the site. How does it matter that connection A was left open if some other connection was used to fetch the site in private mode? If that's not the case, then its a big deal - but that requires some sort of evidence and not just wild hand waving that it could be the case.
        eternalban 6y ago
        Am I to understand you do not know what “IFF” means? https://en.wikipedia.org/wiki/If_and_only_if https://en.wikipedia.org/wiki/If_and_only_if
        dagenix 6y ago
        Iff it remains open is irrelevant. It's only relevant iff it is reused - and I'm still waiting for evidence of that.
rgbrenner 6y ago
No, because the connection pool for private and non-private windows are not shared. So when you open the site in a private window, a new connection is created. There are other ways of correlating those connections (like browser fingerprinting), but the connection pool isn't a problem.
GauntletWizard 6y ago
I can't speak for certain, but I believe that's correct, the socket pools are separate for private browsing vs non-private for that reason.
qbasic_forever 6y ago
The server sees your IP regardless of your browser being in private mode or not. And yes if they have the IP in the logs and have them accessible to query, they could easily correlate all requests from the same IP and determine what they were accessing inside private windows or not.
- rgbrenner 6y ago
  CGNAT is more common than you'd think. The IP address alone is not a definitive indicator it's the same user.
  - qbasic_forever 6y ago
    Sure, but why risk it. If you're really paranoid about browsing anonymously then use Tor.
    - heavyset_go 6y ago
      There's a gulf between the "I don't want companies tracking me" use case of the OP and the "If I get caught spying I'll be executed" use case that Tor addresses.
      - ipaddr 6y ago
        But each request is logged if an ip is reused any website will be able to link your requests.
      - samatman 6y ago
        Naturally there is. That gulf is readily filled with a garden-variety VPN, which works if you're doing the kind of thing where you don't want the web site keeping tabs on you but figure the VPN's reputation is enough to keep them logging your connection and doing something nefarious with that information.
      - judge2020 6y ago
        For the uninitiated, don’t use tor to solve the second goal here without doing proper research. Just using tor is not effective against nation state actors: https://www.theguardian.com/world/2013/oct/04/tor-attacks-nsa-users-online-anonymity https://www.theguardian.com/world/2013/oct/04/tor-attacks-ns...
cortesoft 6y ago
None of the major browsers reuse connections between private and non-private tabs
weird-eye-issue 6y ago
That isn't definitive at all. My phone and desktop have the same IP due to a dedicated VPN.
deleted 6y ago
[deleted]
cookiengineer 6y ago
They just know that anyways in case you didn't rotate IPs via TOR or I2P. Additionally, lots of analytics services do TCP fingerprinting. So they likely know it was you, if you didn't change TCP window sizes, TTLs and options (which I assume due to web browsers reusing the native OS's tcp stack). Also if you didn't use ublock0, they will get an even better footprint via fingerprintjs (most common) that's probably as unique as it gets across your commune without having to know your exact IP.

roca 6y ago

Sites might use IP address information to guess that the sessions are correlated. But they can do that whether or not the connection remains open.

eternalban 6y ago
Sure, but this removes any guess work on their end. It's the same connection.
- dagenix 6y ago
  Do you have evidence that connections opened in non-private mode are re-used in private mode?
  - eternalban 6y ago
    >> Sites might use IP address information to guess that the sessions are correlated. But they can do that whether or not the connection remains open. [emphasis added] Responding to OP's "whether or not the connection remains open". IFF it remains open, then it's no longer a matter of correlating.
    - dagenix 6y ago
      There is nothing to correlate unless the connection is actually re-used in private mode. Merely leaving an unused connection open doesn't change much of anything.
      - eternalban 6y ago
        Why are you belaboring the obvious? Are you simply after arguments? Of course, the concern is switching to private mode and visiting the same site. What else?
        dagenix 6y ago
        Neither you or anyone else that I've seen have provided any evidence that the same connection is re-used. Imagine this scenario: 1. User visits a site in normal mode. Browser opens connection A. Browser uses connection A to fetch the site. Browser leaves connection A open. 2. User opens private mode. User visits the same site. Browser opens connection B to fetch the site. How does it matter that connection A was left open if some other connection was used to fetch the site in private mode? If that's not the case, then its a big deal - but that requires some sort of evidence and not just wild hand waving that it could be the case.
        eternalban 6y ago
        Am I to understand you do not know what “IFF” means? https://en.wikipedia.org/wiki/If_and_only_if https://en.wikipedia.org/wiki/If_and_only_if
        dagenix 6y ago
        Iff it remains open is irrelevant. It's only relevant iff it is reused - and I'm still waiting for evidence of that.

rgbrenner 6y ago

No, because the connection pool for private and non-private windows are not shared. So when you open the site in a private window, a new connection is created. There are other ways of correlating those connections (like browser fingerprinting), but the connection pool isn't a problem.

GauntletWizard 6y ago

I can't speak for certain, but I believe that's correct, the socket pools are separate for private browsing vs non-private for that reason.

qbasic_forever 6y ago

The server sees your IP regardless of your browser being in private mode or not. And yes if they have the IP in the logs and have them accessible to query, they could easily correlate all requests from the same IP and determine what they were accessing inside private windows or not.

rgbrenner 6y ago
CGNAT is more common than you'd think. The IP address alone is not a definitive indicator it's the same user.
- qbasic_forever 6y ago
  Sure, but why risk it. If you're really paranoid about browsing anonymously then use Tor.
  - heavyset_go 6y ago
    There's a gulf between the "I don't want companies tracking me" use case of the OP and the "If I get caught spying I'll be executed" use case that Tor addresses.
    - ipaddr 6y ago
      But each request is logged if an ip is reused any website will be able to link your requests.
    - samatman 6y ago
      Naturally there is. That gulf is readily filled with a garden-variety VPN, which works if you're doing the kind of thing where you don't want the web site keeping tabs on you but figure the VPN's reputation is enough to keep them logging your connection and doing something nefarious with that information.
    - judge2020 6y ago
      For the uninitiated, don’t use tor to solve the second goal here without doing proper research. Just using tor is not effective against nation state actors: https://www.theguardian.com/world/2013/oct/04/tor-attacks-nsa-users-online-anonymity https://www.theguardian.com/world/2013/oct/04/tor-attacks-ns...

cortesoft 6y ago

None of the major browsers reuse connections between private and non-private tabs

weird-eye-issue 6y ago

That isn't definitive at all. My phone and desktop have the same IP due to a dedicated VPN.

deleted 6y ago

[deleted]

cookiengineer 6y ago

They just know that anyways in case you didn't rotate IPs via TOR or I2P. Additionally, lots of analytics services do TCP fingerprinting. So they likely know it was you, if you didn't change TCP window sizes, TTLs and options (which I assume due to web browsers reusing the native OS's tcp stack). Also if you didn't use ublock0, they will get an even better footprint via fingerprintjs (most common) that's probably as unique as it gets across your commune without having to know your exact IP.