Google updates Chrome's Incognito Mode disclaimer to admit it is tracking users (www.ghacks.net)
from throws_lemy@lemmy.nz to technology@lemmy.world on 17 Jan 2024 00:44
https://lemmy.nz/post/5630940

#technology

threaded - newest

tsonfeir@lemm.ee on 17 Jan 2024 03:09 next collapse

Okay Chrome lovers, talk yourself out of this one…

Toes@ani.social on 17 Jan 2024 03:53 next collapse

Well you see, it’s used by virtually everything. So get used to it. is all I imagine people saying, not my opinion.

tsonfeir@lemm.ee on 17 Jan 2024 03:56 collapse

Ahh yes, the good ole, “you don’t have a choice” nonsense. 😉

Rediphile@lemmy.ca on 17 Jan 2024 20:31 next collapse

I can bitch about chrome all day long… but none of that bitching will be about incognito mode as that was and continues to be an useful feature that did exactly what I expected it to do. Everything it said it did, it did.

Just because people made up their own imaginary ideas about what they think it does isn’t really Google’s fault. If people think snorkels allow them to scuba dive and then drown, I’m not about to blame the snorkel maker that wrote ‘diving googles and snorkel’ on the packaging.

lolcatnip@reddthat.com on 18 Jan 2024 00:11 next collapse

Incognito mode didn’t do what it was never advertised to do, and in fact does precisely what it always claimed. The horror!

I swear people like you act like every day Google simply exists is a fresh outrage.

Zagorath@aussie.zone on 17 Jan 2024 03:52 collapse

I switched away from chrome a while ago, but this is just stupid. Incognito has always said that it can’t stop sties from tracking you. It’s always been about stopping stuff from being stored locally. Here’s the message:

<img alt="" src="https://academy.avast.com/hs-fs/hubfs/New_Avast_Academy/How%20to%20go%20incognito%20in%20Chrome/img_03.png?width=900&name=img_03.png">

If you read that and thought it did more than it said, that’s on you.

Lojcs@lemm.ee on 17 Jan 2024 03:19 next collapse

I find this very silly. Incognito always had disclaimers about how it doesn’t protect you from tracking. Do people not know Google is just a website that does taking (or did anyway) like any other? And how tf did Google lose that lawsuit when eulas have “this software isn’t fit for any purpose” clauses and incognito was never advertised for privacy to begin with and straight up tells you it doesnt give you privacy when you open it.

Crashumbc@lemmy.world on 17 Jan 2024 03:53 next collapse

If I had to guess, is because the mode’s very name strongly tells you so?

Definition– adjective (of a person) having one’s true identity concealed. “in order to observe you have to be incognito”

adverb in a way that conceals one’s true identity. “he is now operating incognito”

noun an assumed or false identity. “she is locked in her incognito”

Lojcs@lemm.ee on 17 Jan 2024 11:01 collapse

having one’s true identity concealed

Which is exactly what the incognito mode does. Being incognito doesn’t mean you can’t be tracked in your fake identity

_number8_@lemmy.world on 17 Jan 2024 06:09 next collapse

not protecting users from tracking is very different than wantonly tracking users yourself when they literally hit the privacy button

Lojcs@lemm.ee on 17 Jan 2024 10:59 collapse

I would think such a thing would be a bigger liability. Because even if Google stops tracking you other trackers wouldn’t. If people didn’t read and understand “this does not protect against trackers” they definitely aren’t going to do that with “this will stop Google’s trackers but not 3rd party ones”.

scrappydoo@lemmy.world on 17 Jan 2024 14:59 collapse

“If you’re concerned, for whatever reason, you do not wish to be tracked by federal and state authorities, my strong recommendation is to use [Google Chrome’s] incognito mode.”

  • Eric Schmidt, 2014

Source: forbes.com/…/super-cookies-can-track-you-over-goo…

Lojcs@lemm.ee on 17 Jan 2024 18:04 collapse

I stand corrected

pineapplelover@lemm.ee on 17 Jan 2024 03:23 next collapse

Firefox’s private browsing description is pretty solid if anybody managed to read it

sum_yung_gai@lemm.ee on 17 Jan 2024 06:14 collapse
[deleted] on 17 Jan 2024 03:52 next collapse

.

SpicyLizards@reddthat.com on 17 Jan 2024 04:32 next collapse

Good to see Google finally fixing issues

heyoni@lemm.ee on 17 Jan 2024 04:50 next collapse

I don’t use chrome but this is a whole lot of nothing. It’s basically saying if you save a file or an article to your reading list it’ll still be there…and that remote websites will still stuff your face with cookies and try to track you…but it’s not like they’re giving you a special chrome cookie to link your private and non private browsing. Server side tracking never goes away, not even with Firefox.

Anyways, who cares. Delete chrome and start using Firefox. But again, make sure you delete the files you download in incognito or they’ll still be there. And your ISP can still see which domains you’re going to if you use them as your DNS.

cttttt@lemmy.world on 17 Jan 2024 12:56 collapse

And your ISP can still see which domains you’re going to if you use them as your DNS.

Just so you know, because TLS SNI is not encrypted and not yet universally obfuscated (adoption of this is pretty slow and one of the largest CDN providers had to pause their rollout last I checked), not-even-barely-deep packet inspection can be used to track the sites you visit regardless of your DNS provider or wherever resolution is encrypted. Just do a packet dump and see.

Also, if a website isn’t fronted by one of the most popular CDN providers in existence, it can be possible to infer the sites you’re visiting based on their server IP addresses.

Although this just shifts where tracking can occur, a VPN is the only reliable way to maybe prevent your ISP from tracking the sites you visit, if this is your desire.

heyoni@lemm.ee on 17 Jan 2024 13:54 collapse

Yep, I’m aware. It’s how that one guy hacked his airplanes wireless, by setting up a certificate with his domain and the airlines and then using that domain + port 443 as an ssh or vpn tunnel.

So TLS rollout is slow because the websites can still be seen with packet inspection? We’re talking about TLS 1.4 right?

cttttt@lemmy.world on 17 Jan 2024 14:32 collapse

I’m not sure if it’s part of a TLS standard yet but I was talking about encrypted SNI (ECH, formerly called ESNI).

Today, early on in a TLS connection, the client actually tells the server, in plain text, the domain name it’s intending to communicate with. The server then presents a response that only the owner of that domain can produce, then keys are exchanged and the connection progresses, encrypted. This was required to allow a single server to serve traffic on multiple domains. Before this, a server on an IP:Port combo could only serve traffic on a single domain.

But because of this, a man in the middle can just read the ClientHello and learn the domain you’re intending to connect to. They can’t intercept any encapsulated data (e.g. at the HTTP level, in the case of web traffic) but they can learn the domains you’re accessing.

ECH promises to make the real ClientHello encrypted by proceeding it with a fake ClientHello. The response will contain enough information to fetch a key that can be used to encrypt the real ClientHello. Only the server will be able to decrypt this.

RememberTheApollo@lemmy.world on 17 Jan 2024 12:50 next collapse

I can’t remember the last time I used Google Chrome.

Nothing but Firefox and a Linux chromium browser.

MeanEYE@lemmy.world on 17 Jan 2024 15:56 next collapse

Unfortunately I have it installed to double-check things and occasional compatibility purpose. Believe it or not, sites have started to appear who work in Chrome but not Firefox. Solution is most likely perfectly simple but developers just don’t want to deal with it so I’ve been told “just use Chrome” few times in past few years.

RememberTheApollo@lemmy.world on 17 Jan 2024 21:09 collapse

Yep. There’s the occasional rare site that demands chrome. That’s when chromium comes in handy. I can’t think of a single site I use that I’m willing to install chrome for. Your needs are different, though.

MeanEYE@lemmy.world on 18 Jan 2024 02:28 collapse

I have no need for those sites either. It was one off thing. I remember it was a COVID pass thing I had to do prior to traveling, AliExpress asked for it couple of times but I only used it sporadically for family members. Stuff like that. But it is a trend am not liking as I did web development during IE6 and Microsoft dominance era and it took us decade+ to get rid of that grip. Am afraid Google’s is even stronger.

lolcatnip@reddthat.com on 18 Jan 2024 00:09 collapse

Firefox’s InPrivate mode is the exact same feature.

Spotlight7573@lemmy.world on 18 Jan 2024 22:04 collapse

Not quite, in 2018 they did add tracking protection to their list of goals for their Private browsing mode and have implemented features to reduce tracking/fingerprinting/etc while in it. The main focuses though were still the same at the start though: protecting against local data being saved.

wiki.mozilla.org/Private_Browsing

We target Private Browsing to 3 privacy goals; in a Private Browsing session, Firefox:

  • Doesn’t save the browsing history or display it in the Firefox UI
  • Prevents the session’s data from writing to persistent storage
  • Protects the session’s data from online tracking
PoopMonster@lemmy.world on 17 Jan 2024 13:43 next collapse

I’m curious as to what led people to believe otherwise before this update. I don’t use chrome but I recall it always being reffered to as porn mode. Meaning it just doesn’t save browsing history, no more no less.

Did Google have misleading wording implying it was doing anything else?

tastysnacks@programming.dev on 17 Jan 2024 14:54 next collapse

I remember interviews with the development team about it. As far as I know they were always clear what was happening on the back end.

anlumo@lemmy.world on 17 Jan 2024 14:59 next collapse

It also doesn’t preserve cookies after closing the window. I’m also curious what people expect that mode to do.

kratoz29@lemm.ee on 17 Jan 2024 18:26 collapse

Well, full incognito I guess, no trace for you, you can surf even the deep web… That for the less technical folks ofc.

Rediphile@lemmy.ca on 17 Jan 2024 20:19 collapse

It seems the whole last decade has been focused on dumbing the Internet down for the dumbest 10% of the population. The Internet was better when it was less inclusive.

anlumo@lemmy.world on 17 Jan 2024 21:39 next collapse

There’s money to be made with more people on the Internet, and especially dumb people. So that’s where it’s going.

kratoz29@lemm.ee on 17 Jan 2024 21:52 collapse

Have you seen when people cry when Netflix removes beloved content for them?

Pathetic.

Rediphile@lemmy.ca on 17 Jan 2024 23:16 collapse

I don’t understand paying for streaming media at all… but I’m from the before times.

kratoz29@lemm.ee on 18 Jan 2024 02:14 collapse

Convenience mate, but they are making it less convenient each day so…

Just to say this more clearly, I’d rather watch something on Stremio with Torrentio and Real Debrid than Netflix, even if it is the same movie or tv show or anime.

Rediphile@lemmy.ca on 18 Jan 2024 04:37 collapse

Yep, I never switched from torrents as I never found anything more convenient.

anarchy79@lemmy.world on 17 Jan 2024 19:41 collapse

Did Google have misleading wording implying it was doing anything else?

Do they literally have anything else?

lolcatnip@reddthat.com on 18 Jan 2024 00:05 collapse

Every time I’ve read the disclaimer it has been very clear and accurate, but don’t let me cloud the issue with facts.

Spotlight7573@lemmy.world on 18 Jan 2024 21:57 collapse

And it’s been that way since the beginning basically and is a lot more upfront about what it does and doesn’t protect against than other browsers like Safari.

The new language just makes it even clearer it applies to Google’s online services and I don’t see that as a bad change though.

kittenzrulz123@lemmy.world on 17 Jan 2024 14:15 next collapse

If you don’t want to be tracked just use LibreWolf or Tor

k_rol@lemmy.ca on 17 Jan 2024 14:42 next collapse

I’d say give a try to Firefox

jinwk00@lemm.ee on 17 Jan 2024 15:12 next collapse

Isn’t Librewolf fork of Firefox with hardened features pre-enabled?

TheGrandNagus@lemmy.world on 17 Jan 2024 16:11 collapse

It is.

You could argue that the security patches Mozilla applies takes time to be applied to Librewolf, and also that all you need to do in Firefox is change a couple of options in the settings. People debate over which one matters more, having better privacy defaults or being extremely quick to patch exploits.

In the real world I imagine it hardly matters.

ridethisbike@lemmy.world on 17 Jan 2024 22:50 collapse

Just recently made the switch to Firefox. What settings do I need to change?

TheGrandNagus@lemmy.world on 18 Jan 2024 09:23 collapse

In the settings, I believe in the privacy and security section, turn the tracking protection from ‘standard’ to ‘strict’.

Also uncheck “allow Firefox to send technical and interaction data to Mozilla”

And finally, if you want to, in the security section, enable HTTPS-only mode. Some websites aren’t HTTPS, though, and you’ll get a warning before visiting these.

kittenzrulz123@lemmy.world on 17 Jan 2024 18:08 collapse

LibreWolf is just Firefox but better and Tor is Firefox but maximum privacy

Fades@lemmy.world on 17 Jan 2024 18:37 collapse

WaterFox too

kittenzrulz123@lemmy.world on 17 Jan 2024 19:12 collapse

Never personally used it but seems nice

MeanEYE@lemmy.world on 17 Jan 2024 15:54 next collapse

Talk about easy way out. “There, problem solved. It’s not a violation if we write it somewhere in tiny font.”

Rediphile@lemmy.ca on 17 Jan 2024 20:23 next collapse

The amount of words needed to fully explain this to tech illiterate idiots would be so many that those idiots would just argue they cannot be expected to read all of it. These people already do this with the terms + conditions documents they agree to.

Incognito mode did every single thing it said it did and behaved exactly as I expected from day one. Is there a single user here who actually was surprised by how it worked? Did anyone honestly think it was like Tor or something? Why? Where did anyone ever get that idea at all?

WaxedWookie@lemmy.world on 17 Jan 2024 21:46 collapse

Expected incognito functionality sits in the gaping chasm between actual incognito functionality and TOR. When I’m being told I can go incognito - you know, sneaky, in disguise, I don’t expect to have all of my activity broadcast back to those that say I’m incognito.

Of course, trusting current Google is foolish, but that doesn’t make it less deceptive.

Rediphile@lemmy.ca on 17 Jan 2024 23:15 next collapse

So do you feel the naming was inherently misleading which led you astray? Because incognito mode absolutely kept things ‘sneaky’ in terms of hiding the things I look up from other people who use the same computer. Which is specifically what Google said it would do and showed examples of in TV commercials. And it definitely did (and still does) that.

I’m also struggling to understand what you feel you ‘trusted’ Google on exactly. What did they tell you that you believed but, as it turns out, was not true?

WaxedWookie@lemmy.world on 18 Jan 2024 00:39 collapse

To be clear, I was aware of the risk thanks to previous reports and my work in the cybersecurity space. I’m talking about the average user.

The name is deceptive, and explicitly calling out a list of parties that may see your traffic without naming themselves is deceptive.

It’s akin to a guard saying beware doors 1 and 3 - there are dragons behind them. If you hear this from an authority that would know, you’d probably assume there’s not a dragon behind door 2, or they would have said so.

The perception of “the man on the street” is a common legal standard that I’d argue Google has fallen short of here.

Rediphile@lemmy.ca on 18 Jan 2024 01:25 collapse

Aww man I thought I found one! Guess I’m back down to zero people.

WaxedWookie@lemmy.world on 18 Jan 2024 02:40 collapse

No thoughts on the perception they seem to be crafting very deliberately?

Rediphile@lemmy.ca on 18 Jan 2024 04:41 collapse

I always saw Google as a website too. So if I type ‘giant donkey dicks’ into the url/search bar, then Google is obviously going to know my preference for large donkey dicks. Since I googled it.

Or are these hypothetical common folk typing in full urls themselves or something? If it’s auto-filling in any way, that’s thanks to Google and they can only provide it if aware what has been typed so far.

WaxedWookie@lemmy.world on 18 Jan 2024 07:03 collapse

That lack of delineation is also an issue, but a separate one. That said, I’d think an average user would think doing a Google search from an incog tab would be anonymised and not tied to them because of the privacy incog grants (or more accurately, doesn’t). There’s reasonable arguments to be made on either side of this point, but I think that Google have been intentionally misleading - which is now creating problems for them, motivating this change.

Again, all the information Google present when opening an incog tab would lead someone to the conclusion that Google won’t track them. Unless I’m mistaken, when this came up years back, Google explicitly denied tracking people in incognito mode, and they’re only changing their disclaimers now in response to a multi-billion dollar lawsuit.

Rediphile@lemmy.ca on 18 Jan 2024 20:59 collapse

If Google specifically denied tracking that’s definitely misleading, but I’m unable to find a source for it and don’t recall it myself.

Saying that the sites you visit track you would absolutely lead me to believe that search engines sites are included. Since it would not be possible to provide results for the search without knowing what was searched for by the user. And where would they send those results to without knowing the users IP or other form of network address? It just doesn’t make any sense to think a search engine would not know who searched for what, since it is required for them to function.

WaxedWookie@lemmy.world on 19 Jan 2024 00:14 collapse

You don’t visit the site when you punch a query into your browser search bar.

Ultimately, Google are making the change they are because they know how deceptive they were being. Google knows it, I know it, Google seems concerned the courts know it, I’m not sure why you’d choose to dig in on this one.

lolcatnip@reddthat.com on 18 Jan 2024 00:08 collapse

So you’re saying it’s Google’s fault you relied entirely on false assumptions based only on the single-word feature name and ignored the very short disclaimer that appears every time you use it?

WaxedWookie@lemmy.world on 18 Jan 2024 00:19 collapse

I don’t use Chrome because I don’t trust Google. I assumed they were tracking users based on previous reports.

I’m saying that i think a reasonable person would expect that their incognito browsing traffic wouldn’t be monitored and passed to Google. This reasonable person standard is the legal standard for advertising and marketing claims in my country and many others.

The disclaimer explicitly calls out that your activity might still be visible to sites, you visit, your employer or school, and your ISP - they notably say nothing about Google. That kind of thing is very misleading.

Where in that disclaimer (or otherwise) would I get the impression Google will track me?

[deleted] on 18 Jan 2024 01:39 collapse

.

uuhhhhmmmm@sh.itjust.works on 17 Jan 2024 19:43 next collapse

I was always curious why is it called Incognito or Private mode? Temporary or Guest session would make more sense: “You’ve entered a Temporary session. Your browsing history and cookies will not be saved.”

Rediphile@lemmy.ca on 17 Jan 2024 20:15 next collapse

I don’t believe it was ever called ‘private mode’, or am I wrong on this?

GhostMatter@lemmy.ca on 17 Jan 2024 20:24 next collapse

Private Mode is on Firefox.

FoxBJK@midwest.social on 17 Jan 2024 20:42 collapse

Safari and Brave also both call it a private window

T156@lemmy.world on 18 Jan 2024 05:34 collapse

Internet Explorer also called it “InPrivate”.

Octopus1348@lemy.lol on 19 Jan 2024 02:32 collapse

And Edge still does.

red@sopuli.xyz on 17 Jan 2024 20:46 next collapse

private browsing term appears in desktop and Android. Apple also uses the term.

SomethingBurger@jlai.lu on 17 Jan 2024 23:21 next collapse

Private Browsing, for browsing private parts.

Buck@lemmy.world on 18 Jan 2024 01:23 collapse

Private Browsing, at your service 🫡

youtu.be/G5VEftRH12Y?si=w1iKyRrA1Gu-TZbh

PipedLinkBot@feddit.rocks on 18 Jan 2024 01:24 collapse

Here is an alternative Piped link(s):

https://piped.video/G5VEftRH12Y?si=w1iKyRrA1Gu-TZbh

Piped is a privacy-respecting open-source alternative frontend to YouTube.

I’m open-source; check me out at GitHub.

Octopus1348@lemy.lol on 19 Jan 2024 02:31 collapse

On Firefox it’s called Private mode, on Edge it’s called InPrivate mode.

Spotlight7573@lemmy.world on 18 Jan 2024 21:55 collapse

Guest sessions already exist in the profile menu and is a separate feature. Guest doesn’t save history/cookies/etc locally but also doesn’t use your existing history, extensions, bookmarks, settings, etc. It’s intended more for an actual guest user to sign into temporarily.

TheDarkKnight@lemmy.world on 17 Jan 2024 23:44 next collapse

All google products track you. Don’t use Google products.

Loce@lemmy.world on 18 Jan 2024 22:31 collapse

Every day I’m more glad I’ve got rid of that spyware browser-wannabe called Chrome.