Incognito Mode Loophole Closed - Threatwire Crosspost (Patreon)

by Shannon Morse

ThreatWire is only possible because of our Patreon patrons! patreon.com/threatwire 

Google updated Chrome to version 76, and with that they’ve also closed a loophole that many online publishers were using to detect if people were using incognito mode. Incognito mode lets you browse the web without sites appearing in your search history, and it keeps websites from leaving traces like cookies on your device. Some sites, like publishers who have paywalls after you’ve clicked on a certain number of articles or pages, have used the loophole to deter metered paywall circumvention - by blocking access if you’re browsing in incognito mode. These sites usually offer or allow you to read a set amount of articles before being blocked from accessing them. This is inherently bad design as they rely on cookies or trackers, which can be deleted from a users computer or circumvented with a private browser.

The loophole was in Chrome’s FileSystem API, which is disabled in Incognito mode. This ensures that activity traces aren’t left on the device but sites could still check the availability of the FileSystem API from a visitor. If the API wasn’t there, that was possible proof that a user was using incognito mode. Chrome 76 modifies the way FileSystem API is used, so after it’s release on July 30, sites won’t be able to detect if it’s missing. 

Google recommends in its post that publishers try to find ways to build trust with potential subscribers that don’t circumvent the core principles of private browsing because Google intends and pledges to close any other loopholes found that allow for detection of incognito mode. 

Incognito mode isn’t perfect, either. While it does not save your browsing history, cookies or site data like info entered into forms, activity can still be seen by your employer, ISP, or a website that you visit. Incognito mode used with other services like a VPN can help tighten security measures.

Incognito Mode:

https://www.blog.google/outreach-initiatives/google-news-initiative/protecting-private-browsing-chrome/

https://arstechnica.com/information-technology/2019/07/chrome-76-prevents-nyt-and-other-news-sites-from-detecting-incognito-mode/

https://www.zdnet.com/article/google-to-clamp-down-on-incognito-mode-detection/