3 ms·

None. The issue is websites still collect data. Like the website knows your ip address, your time zone, and the website can fingerprint to some extent. That in

by gernb 4y ago

None. The issue is websites still collect data. Like the website knows your ip address, your time zone, and the website can fingerprint to some extent. That includes Google.com, not via Chrome when in incognito mode, but via the fact that you access Google's websites. They don't know it's you directly.

zeven7 4y ago
If that's all it is, then in my opinion the article is misleading. That's exactly how I always assumed incognito mode worked. And although I recognize it might not be how an average consumer understands it, it is what I think most people familiar with web tech would understand. The article makes it sound like they're doing more than that.
- Maursault 4y ago
  > That's exactly how I always assumed incognito mode worked. All that incognito mode does is delete those session cookies when you close that tab or window.[1] If you want to avoid being tracked, turn off cookies altogether (or use a plugin that blocks trackers), turn off JavaScript (or use a noscript plugin), and use a VPN. [1] https://en.wikipedia.org/wiki/Private_browsing https://en.wikipedia.org/wiki/Private_browsing
  - insanitybit 4y ago
    Incognito supports blocking 3rd party cookies, you just toggle a switch on the new tab page.
aeternum 4y ago
The problem is that the API layer of the browser is now so complex that even without cookies, just your config yields a completely unique signature whether or not you're in incognito. This site gives you the details: https://amiunique.org/fp https://amiunique.org/fp Basically unless you use a completely different computer for incognito browsing, any site you visit can link your logged-in identity to your browser fingerprint and then track you regardless of mode/cookies.
- Spivak 4y ago
  And this isn’t theoretical, your fingerprint is stable between normal and private browsing mode on the same browser.
  - npteljes 4y ago
    My fingerprint varied from session to session to this website. So it's not easily demonstrable.
    - aeternum 4y ago
      Did you look at the actual fields that diffed compared to what doesn't? It's likely only things like referrer and device groupIDs which are easily excluded if the goal is to track a user across browser modes.
      - npteljes 4y ago
        I didn't, but if it's trivial to ignore those fields, then why isn't the proof of concept doing that? I think because you don't know, in advance, which fields to ignore. Demonstrating tracking like that is the point of the page, and it failed to do so, so my conclusion is that it's not that straightforward after all.
- ryandrake 4y ago
  The fact that a web site can query all those things in that site is utterly ridiculous. Web technology is out of control.
- npteljes 4y ago
  I was "unique" on two different session tabs, and also in a Private window; reloads, however, were stable. That means that the browser is not recognizable, just the session.

by gernb 4y ago

zeven7 4y ago

If that's all it is, then in my opinion the article is misleading. That's exactly how I always assumed incognito mode worked. And although I recognize it might not be how an average consumer understands it, it is what I think most people familiar with web tech would understand. The article makes it sound like they're doing more than that.

Maursault 4y ago
> That's exactly how I always assumed incognito mode worked. All that incognito mode does is delete those session cookies when you close that tab or window.[1] If you want to avoid being tracked, turn off cookies altogether (or use a plugin that blocks trackers), turn off JavaScript (or use a noscript plugin), and use a VPN. [1] https://en.wikipedia.org/wiki/Private_browsing https://en.wikipedia.org/wiki/Private_browsing
- insanitybit 4y ago
  Incognito supports blocking 3rd party cookies, you just toggle a switch on the new tab page.

aeternum 4y ago

The problem is that the API layer of the browser is now so complex that even without cookies, just your config yields a completely unique signature whether or not you're in incognito. This site gives you the details: https://amiunique.org/fp https://amiunique.org/fp Basically unless you use a completely different computer for incognito browsing, any site you visit can link your logged-in identity to your browser fingerprint and then track you regardless of mode/cookies.

Spivak 4y ago
And this isn’t theoretical, your fingerprint is stable between normal and private browsing mode on the same browser.
- npteljes 4y ago
  My fingerprint varied from session to session to this website. So it's not easily demonstrable.
  - aeternum 4y ago
    Did you look at the actual fields that diffed compared to what doesn't? It's likely only things like referrer and device groupIDs which are easily excluded if the goal is to track a user across browser modes.
    - npteljes 4y ago
      I didn't, but if it's trivial to ignore those fields, then why isn't the proof of concept doing that? I think because you don't know, in advance, which fields to ignore. Demonstrating tracking like that is the point of the page, and it failed to do so, so my conclusion is that it's not that straightforward after all.
ryandrake 4y ago
The fact that a web site can query all those things in that site is utterly ridiculous. Web technology is out of control.
npteljes 4y ago
I was "unique" on two different session tabs, and also in a Private window; reloads, however, were stable. That means that the browser is not recognizable, just the session.