Is Private Browsing Really Private?
spreadprivacy.com
spreadprivacy.com
While private browsing is not actually private I feel going so far as to say it does not stop websites from collecting info on you is maybe a bit too far.
The site can still collect information about you, yes. But unless you sign in while in private browsing or the site is using some sort of user-agent / IP trickery it won't be automatically tied to your accounts. None of the cookies or local storage are shared across private/non private browsing.
Personally, I use it mostly to see what websites look like when I'm not logged in or if I want to access something that can only be accessed while logged out without actually logging out which is surprisingly common.
Consider checking this page: http://webkay.robinlinus.com/
Private Browsing simply prevents cookies and nothing else, and for the average person we find that is not what's expected from something defined as "private" browsing.
Not true, at least for Firefox. In Private Browsing mode, Firefox will avoid saving temporary files and other data to disk, keeping everything in RAM instead, which is wiped when Private Browsing mode is exited. This includes history, cookies, and cache data. I believe localStorage behaves differently as well.
Firefox also makes an effort to block tracking scripts/servers in Private Browsing mode, using Disconnect's filter list.
The Private Browsing new tab page explains this all pretty succinctly: https://i.imgur.com/MGp53eP.png
However, users still in general think that private browsing modes do things like prevent their IP address from being seen, or prevent a search engine from recording their searches. So there is still a gap in their expectations.
My recollection is that the browser claims to support localStorage, but attempts to use it fail. I don't know why it couldn't just be backed by non-persistent storage.
The domain belongs to the DuckDuckGo blog.
It's part of our overall mission to raise the standard of trust online. We're nothing if not transparent on this!
For what it's worth I applaud their efforts and their product. I just think this article is biased (and that's OK).
This is not a personal attack. Just have to address this. If you think that you cannot be identified because you use a "private" window in a browser when you were using a logged in browser 30 minutes before from the same IP with the same OS and the same screen size, with the same background apps making the same http requests, you are mistaken. Your entire search history is fingerprinted, associated, shared, and sold. And this is just scratching the surface. As a mild example, Facebook associates IP's with Facebook accounts, then tracks Chromecast requests from those IP addresses to sell that information to media streaming companies. Everything you do, everything you like, everywhere you visit, is one metadata search away. Duck Duck Go cant fix all that, but they can keep no IP correlated search history. And that says alot considering that in todays market that information is worth millions.
> unless you sign in while in private browsing or the site is using some sort of user-agent / IP trickery it won't be automatically tied to your accounts
I am aware fingerprinting exists. I have done fingerprinting.
I am also aware that for advertisers fingerprinted data is not as valuable as login keyed data and a lot of places don't bother to do it. Acting on fingerprinted data often triggers the "creepy factor" and actually turns off the consumer from the product. I know several advertisers that will not allow using it for that reason.
I was not saying it can't be done. I didn't imply it did. In fact I believe a study a few years ago showed that fingerprinting is something like 99% accurate if you can execute javascript code to read things like screen resolution.
I was taking objection to assuming it is absolute that it does not prevent tracking and that it is automatically useless.
Does it stop Google? No way. Facebook, doubtful. But does it stop some sites? Absolutely. On many sites it is very effective.
That's not really possible for a webpage or mobile app to do (at least not on iOS, anything goes on Android I guess).
I've often been curious about this. I've heard this sentiment many times, but I've never heard of where/how anyone could actually buy a search history. Surely there must be some accounts of how the other side of the equation works.
Also, how much does it cost? All the facebook/google help pages I've seen focus on ads, where no personal information is shared.
Further, I'd guess that even if you absolutely trust your SO not to violate your privacy, you might still reasonably distrust the platform they're working on, and you might not want to expose your account credentials on a platform that you don't directly control.
The option I finally chose to go with, is to install firefox on her computer as well. Firefox is for me, Chrome is for her. I'm an FF guy anyway. The main UX problem stands, though, it's too easy to be the wrong person.
Also I get to keep up to date with changes in firefox.
The icons and applications look sufficiently different that there's no confusion about what persona I am in which browser. And I can have all of them up at the same time.
To a tech-savvy audience its more obvious that private browsing modes don't offer that.
This discrepancy is something that people have genuine concerns about and want to see either more features to protect their privacy, or better transparency in naming/explaining/disclaiming these modes.
Did you actually interview her for this paper? Where'd you find her? Can I ask her a few questions when you're done? I have so much I need to know from the average person.
This warning appears on every tab in the incognito mode, so it is pretty visible.
We wanted the whitepaper to be browser agnostic, this isn't about blaming specific browsers or actions. We wanted to highlight the larger issue that there is a gap in privacy education for a mainstream user and that it is something that members of technical communities can all step up and help with.
As for a special note for the warnings, I would say it is akin to the Terms of Service for websites. Perfectly visible, but never really read and understood.
“Pages you view in this tab won’t appear in your browser history
or search history, and they won’t leave other traces, like cookies,
on your device after you close all incognito tabs.
Any files you download or bookmarks you create will be preserved,
however. Going incognito doesn’t affect the behavior of other people,
servers, or software. Be wary of surveillance by secret agents
or people standing behind you.”
Pages you view in incognito tabs won’t stick around in your browser’s
history, cookie store, or search history after you’ve closed all of your
incognito tabs. Any files you download or bookmarks you create will be kept.
Going incognito doesn’t affect the behavior of other people, servers, software,
or people standing behind you.- sites don't get recorded in browser history
- by not exposing your regular browsing cookies, it significantly reduces the likelihood an "embarrassing" site will somehow end up on your Facebook wall
I hope I'm not wrong about the second one.
The new Container Tabs feature works similarly: it splits cookies.
It's not unreasonable for a user to take Google or Mozilla or whoever at their word when they call the feature "incognito mode", or "private browsing" etc. They don't know the first thing about how their privacy is breached in the first place, so why would they know how their browser mitigates potential breaches?
(Yes, yes, it can never be perfect, but I don't believe that invalidates the point)
We had a separate question for users who noted that they used Firefox that spoke to the specific cases for that browser.
The final whitepaper is browser agnostic, and these are the top misconceptions overall, but results were split out in the research phase to account for this.
Disabling JS from iffy marketing companies mostly solves the problem. (From a legal standpoint, not a security standpoint). It's illegal under wiretapping rules to share communication with a third party. (but if the user's browser hits a third-party data collection endpoint, that's somehow okay. See 'in re doubleclick'). Firefox tracking protection uses the disconnect.me list https://disconnect.me/trackerprotection/blocked to get rid of all of these it can.
If the adversary isn't a marketing firm that has to comply with the law, ignore the above. Then you're looking at browser flaws (canvas fingerprinting) and session inference (using client IP, URL, browser-agent, & timestamps to reconstruct identity from behavior).
I do search for some nasty stuff in private mode and it never pops up in ads for my main account.
I do understand there might be conspiracy in Google to gather that data and link it to my account but never use it in the way I notice, but that looks like conspiracy theory to me.
Despite that a search engine is still able to see what you search in private browsing modes as none of it's protection change, hide or obscure your identity.
If you perform a search from your IP address (or any other information that can be fingerprinted from your browser) and then do the same in private browsing mode, Google would know that it is the same user committing both searches.
Of course the search engine knows what you searched for! You sent the search string from your computer to one of their servers.
You'd need a way to prevent the search engine from knowing your IP address, like a proxy or Tor, in order to hide your identity.
"Surveys done on users perceptions of private browsing" or at they titled the paper "A Study on Private Browsing: Consumer Usage, Knowledge, and Thoughts"
Would love to know why you feel our affiliation calls that into question?
In the the whitepaper we disclose the full methodology, and each statistic has a margin of error calculated and added in. Feel free to review it - we're happy to answer questions!
* The results on page 17 jumped out at me the most. There are 4 specific options for negative emotional reactions, and one generic positive option. It's easy to underestimate the powerful effect this has on pushing the responder to a specific answer. Imagine if your answer options were only "content, secure, informed, protected, neutral, misled" and how different your results might be.
* The question for the above, specifically the tone of "[...] does not offer any additional protection [...]" is also a form of leading the responder to an answer. While the statement is mostly true, there's some contention on the point esp. regarding cookies (see the other comments on this thread). Either way, you'd get a more honest answer if you strictly list the things private browsing does, and the things it does not do in a way that's as objective and incontrovertible as possible.
* It would be useful to see the benefits underlying the "correctly identified" category on page 13. I couldn't find those anywhere which was a bit suspicious.
In consulting, I used to survey users on their personal security practices (password strength, adherence to policies, secure disposal, etc.) and gained a huge appreciation for how powerful bias and misinterpretation can be in surveys, and how hard it is to control. But to reiterate, I think this is overall pretty well done and has some really interesting results, esp. the usage data in the first few sections.
Initially we started this survey out of our own interest so a few of those decisions are rooted from there.
1) Agreed, however we've already divided out the people who previously learned about private browsing. This leaves us with a cohort of users who have used private browsing, thought it protected them more and learned that it was wrong. It's very unlikely in any case that there would be positive emotions experienced. In our background research before the final survey we were only focusing on if users had a positive or negative experience. In this final major survey we wanted to get a better understanding of what those negative emotions were and so teased it out more.
I agree that a skewed set of options can bias a question but it is case-by-case. Example if I ask "how do you feel when your ice cream falls on the floor?" and the options are "Happy, Joyful, Amazing, Wonderful, Excited, Sad" you'll still likely pick sad.
2) A good point. This question is one that is linguistically challenging. We want to use phrases like "it only does X" to stress limits, but those can be misinterpreted. I agree you may see some shift if you ask the question as a feature list, but I think in the question we're looking at it would still fall well within the margin of error. I'm curious to run some tests on it either way!
3) We didn't release those in the whitepaper as they were broken down by browser since each browser has different feature sets. We wanted to keep this report agnostic of browser. We're not looking to shame anyone, we're trying to support the conversation around the education gap for the average non-technical internet user. They are telling us they want more privacy, and don't feel that it is being provided or explained well enough.
Overall, I really appreciate the feedback - it is more important than ever to question and discuss the things we see online. Hope this sheds some light on why we made the various decisions we did! :)