Hacker News Reader

Hacker News

Comment by makepanic | Hacker News Reader

Full thread

makepanic

First time seeing a website checking for private mode:

> Hello,

> We noticed you're browsing in private or incognito mode.

> To continue reading this article, please exit incognito mode or log in.

> Why we made this change

> Visitors are allowed 3 free articles per month (without a subscription), and private browsing prevents us from counting how many stories you've read.

> We hope you understand, and consider subscribing for unlimited online access."

In case others don't want to leave private mode: http://archive.is/DjsiK

View on HN

That's so stupid. There's nothing stopping anyone from browsing 3 articles and then clear the cookies...

What's even more stupid is that it's even possible to detect you're browsing incognito.

The server should never be able to know.

Probably a bunch of front-end checks to see if cookies are enabled, etc., etc., roughly giving them a clue that it is in incognito.

Or you can disable it with a query param: https://www.technologyreview.com/s/610743/mit-severs-ties-to...

Interesting that this works with any query parameter: https://www.technologyreview.com/s/610743/mit-severs-ties-to...

They're probably only using query params at that endpoint for referral links. There are a couple high profile subscription news sites that let you in as much as you want as long as your referer header says "facebook.com".

I use http://outline.com to read and share content from sites like this.

How does it do that? Do browsers set a flag? That seems like a privacy hole.

There are certain browser APIs disabled in the browser in incognito mode that can be detected. How else would you implement incognito mode?

That's interesting. Why are the storage APIs disabled, instead of just using ephemeral storage that goes away when the window is cleared?

It's less work to disable them. There's likely already an API access control system in place, for internal-only APIs, testing, etc.

It also means sites can avoid promising to do things that aren't actually possible, like saving information for access next time.

By sandboxing, e.g. localStorage fully functional but deleted at the end of the session...

Mozilla recently released containerized tabs[0], I imagine the next logic step is building containerized Private Browsing Mode

[0]: https://addons.mozilla.org/en-US/firefox/addon/multi-account...

My understanding is that things actually went the other way. Private browsing came first, then the same approach was used to create more labels than just "private" and not "private". I think more features may be turned off in private browsing mode though.

I use multiple computers daily and not having those synced with my Firefox account is a pain in the ass.

My guess is that they feature detect, using disabled stuff (eg localStorage error 22 on safari private mode) to find out if your browser looks like one in private mode.

Peeking into the source:

  /**
   * Detects incognito/private mode in various browsers.
   *
   * Adapted from:
   *   https://gist.github.com/cou929/7973956
   */

Link for the lazy.

https://gist.github.com/cou929/7973956

The detection is JS based after the proper article loads, so you can smash the escape key in a timely way to disable it.

I was able to see the article in private mode on Firefox 59.0.2 with uBlock Origin (enabled and disabled).

I tend to disable Javascript for news/blog websites. In maximum cases, I get a popup-free, ad-free experience, and no private browsing warnings too.

Please don't use spaces to quote blocks of text. It's completely broken for mobile users, forcing them to use horizontal scroll.

Netflix does this too

Reply on news.ycombinator.com