Google Chrome Incognito Mode Can Still Be Detected by These Methods:
With the release of Chrome 76, Google fixed a loophole that allowed web sites to detect if a visitor was using Incognito mode. Unfortunately, their fix led to two other methods that can still be used to detect when a visitor is browsing privately.
Some web sites were using Incognito mode detection in order to prevent users from bypassing paywalls or to give private browsing users a different browsing experience.
This was being done by checking for the availability of Chrome's FileSystem API, which was disabled in Incognito mode. If a site could access the FileSystem API then the visitor was in a normal browsing session and if it could not access the API the user was in Incognito mode.
As Google wanted users to be able to browse the web privately and for their browsing mode choices to be private as well, they have closed a loophole by making the API available in both browsing modes. As part of this fix, instead of using disk storage for the FileSystem API, when in Incognito mode they are using a transient memory filesystem that gets cleared when a session is closed.
The use of a memory filesystem, though, create two new loopholes that could be used to detect Incognito mode
[...] In research presented by security research Vikas Mishra, he found that when Chrome allocates storage for the temporary memory filesystem used by Incognito mode, it will have a maximum quota of 120MB.
"Based on the above observations, key differences in TEMPORARY storage quota between incognito and non-incognito mode are that in case of incognito mode, there's a hard limit of 120MB while this is not the case for non-incognito window. And from the above table it's clear that for the temporary storage quota to be less than 120MB in case of non-incognito mode the device storage has to be less than 2.4GB. However for all practical purposes it is safe to assume that the majority of the devices currently in use have more than 2.4GB of storage."
The other method relies on the fact that it takes much longer to access data in storage than in memory. As of this writing no PoC (Proof of Concept) has been released for the latter method, but a PoC has been released for the filesystem size method.
Microsoft Edge developer Eric Lawrence, the New York Times, is testing this method to detect when a visitor in in private mode.
My first thought was to put a cache ahead of all filesystem writes to obviate the write-timing hack (albeit at the risk of a system crash losing cached but as yet unwritten data). For the latter method, allocate the temporary file storage quota to be some significant fraction of free storage, but when a program tries to write more than, say, 120MB (or 256MB, or whatever) then put up a dialog box noting same and asking the user if they want to continue. That was off the top of my head; what did I miss? How would you solve this problem?
(Score: 1, Insightful) by Anonymous Coward on Tuesday August 13 2019, @01:19AM (1 child)
Indeed it most certainly is now up to us to decide for them what methods they are allowed to utilize. We allowed them to play the "here, have it free, in exchange for some ads". They have gone too far. As a result, they must now be shoved, kicking and screaming, into a simple binary deal. They either offer the content for free, to everyone, with no ads and no tracking, or they lock it up behind an iron clad pay wall. They no longer are allowed the freedom to pick and choose on a continuum between those two extremes, because they were offered that freedom and they abused it. So now, we, the internet, fight back and put them into their proper place in the world.
If they can't make money from free, and they can't make money from a paywall, well then, they just go out of business and disappear, and the world becomes a better place.
(Score: 2) by c0lo on Tuesday August 13 2019, @03:09AM
The fair solution is to refuse to use whatever they proposed if it doesn't serve your interest. That's what I'm doing.
Anything else is imposition, and I'm not sure I agree with it when other solutions exists.
https://www.youtube.com/watch?v=aoFiw2jMy-0 https://soylentnews.org/~MichaelDavidCrawford