6 ms·

It works even if you use incognito mode in Chrome. So incognito is not as incognito as we thought. Edit: not really, the article explains it but I hadn't finis

by sker 13y ago

It works even if you use incognito mode in Chrome. So incognito is not as incognito as we thought. Edit: not really, the article explains it but I hadn't finish reading it.

lucb1e 13y ago
The incognito mode is designed to be incognito from the moment you open the window. When you close it and re-open the window, the cache will be thrown away (along with any cookies, localstorage, etc.). During your incognito session, cache and cookies and everything is stored. If they didn't do this, websites would not function properly. I believe the incognito mode has more potential than it's currently being used as. For example multiple parallel sessions would be not only nice and handy, if people learned to use it, the isolation would also enhance browser security. As I mentioned on the page, it single-handedly eliminates a number of https attacks and tracking methods. Edit: Oh you mean that bug in this demonstration? Yes that's a local issue here. In practice the two sessions could not be linked, as you can see when you press f5 in the incognito window. Sorry about that, it's mostly meant as a tech demo where people can understand and learn from the code, not a finished product!
- sker 13y ago
  The two sessions could not be linked, but after I close incognito, the counter and the stored text in normal Chrome are reset. Why does that happen?
  - lucb1e 13y ago
    This is because I use a static etag instead of generating a new one for each session. From the page: > When you visit a page where you don't have an ETag (like incognito mode), your session will be emptied. This unfortunately also throws away your other browser session at the same time. In practice a website would probably issue a new etag for the incognito session, and your existing browser session will simply continue.
    - sker 13y ago
      I see, the normal Chrome session is not reset, but rather linked to the new ETag in incognito mode, at least in this example. You could probably have submitted a bug to the Chrome team and get a bounty for this thing. It kind of allows to track the incognito session linking it to a normal session.
- shawnz 13y ago
  > I believe the incognito mode has more potential than it's currently being used as. For example multiple parallel sessions[...]. Chrome actually got this feature recently. Check Settings > Users.
- tripzilch 13y ago
  alright but can you explain how that works? I didn't quite understand from your article. what I'm doing is this: 1) in plain non-incognito window, enter text, hit "Store" 2) open incognito window, go to same URL, the text is there! that means the sessions can be linked now. where does this info come from? does Chrome (and Opera, which I also tested) share ETags between non-incognito and incognito windows?
dalek_cannes 13y ago
I'm behind a VPN. Is that why it doesn't work in my case? I'm using Chrome (not even incognito).
- Groxx 13y ago
  Shouldn't make a difference, unless your VPN does its own caching or strips ETags.
- lucb1e 13y ago
  That's interesting, it should work! What browser are you using?
  - dalek_cannes 13y ago
    Chrome Version 28.0.1500.95 m
- andrewcooke 13y ago
  what vpn? (thanks)
k3n 13y ago
I don't think incognito modes were ever designed for that kind of privacy.

by sker 13y ago

It works even if you use incognito mode in Chrome. So incognito is not as incognito as we thought. Edit: not really, the article explains it but I hadn't finish reading it.

lucb1e 13y ago

The incognito mode is designed to be incognito from the moment you open the window. When you close it and re-open the window, the cache will be thrown away (along with any cookies, localstorage, etc.). During your incognito session, cache and cookies and everything is stored. If they didn't do this, websites would not function properly. I believe the incognito mode has more potential than it's currently being used as. For example multiple parallel sessions would be not only nice and handy, if people learned to use it, the isolation would also enhance browser security. As I mentioned on the page, it single-handedly eliminates a number of https attacks and tracking methods. Edit: Oh you mean that bug in this demonstration? Yes that's a local issue here. In practice the two sessions could not be linked, as you can see when you press f5 in the incognito window. Sorry about that, it's mostly meant as a tech demo where people can understand and learn from the code, not a finished product!

sker 13y ago
The two sessions could not be linked, but after I close incognito, the counter and the stored text in normal Chrome are reset. Why does that happen?
- lucb1e 13y ago
  This is because I use a static etag instead of generating a new one for each session. From the page: > When you visit a page where you don't have an ETag (like incognito mode), your session will be emptied. This unfortunately also throws away your other browser session at the same time. In practice a website would probably issue a new etag for the incognito session, and your existing browser session will simply continue.
  - sker 13y ago
    I see, the normal Chrome session is not reset, but rather linked to the new ETag in incognito mode, at least in this example. You could probably have submitted a bug to the Chrome team and get a bounty for this thing. It kind of allows to track the incognito session linking it to a normal session.
shawnz 13y ago
> I believe the incognito mode has more potential than it's currently being used as. For example multiple parallel sessions[...]. Chrome actually got this feature recently. Check Settings > Users.
tripzilch 13y ago
alright but can you explain how that works? I didn't quite understand from your article. what I'm doing is this: 1) in plain non-incognito window, enter text, hit "Store" 2) open incognito window, go to same URL, the text is there! that means the sessions can be linked now. where does this info come from? does Chrome (and Opera, which I also tested) share ETags between non-incognito and incognito windows?

dalek_cannes 13y ago

I'm behind a VPN. Is that why it doesn't work in my case? I'm using Chrome (not even incognito).

Groxx 13y ago
Shouldn't make a difference, unless your VPN does its own caching or strips ETags.
lucb1e 13y ago
That's interesting, it should work! What browser are you using?
- dalek_cannes 13y ago
  Chrome Version 28.0.1500.95 m
andrewcooke 13y ago
what vpn? (thanks)

k3n 13y ago

I don't think incognito modes were ever designed for that kind of privacy.