Hacker News Reader

Comment by dwaltrip | Hacker News Reader

Does anyone know how effective incognito mode is at preventing data and privacy abuses like this? I've been using it more and more, but I imagine there may some clever ways of tracking even across incognito sessions (or between incognito and regular).

View on HN

If google is the issue maybe - but I seriously doubt they are the issue: they sell their ability to target you, and selling your data to third parties would essentially be against their interest. This kind of FUD has been repeated ad nauseam here and everywhere in tech sites (against Facebook too usually), but that's not the way their business model works.

If it's your doctor or your pharmacist, or the shop you bought online (or offline) something once, incognito will not help at all. They have your personal information already, the only thing that can stop them is law. The cause of the robocalls may also have been his medical insurance, if you want to go full paranoia. :)

Note those shops, the sites you created an account on, the companies those shops sold your personal data to, all of them can target you with ads on both facebook and google by using your PI (essentially donating your data to facebook and google in the process).

I'm assuming it's not the doctor or pharmacist, as that would be a severe breach of HIPAA, I believe. But maybe that is happening...

When I said triggered by my google searches, I mean the sites I clicked on were able to correlate to my personal details that got collected somewhere else, not that google sold my details. The thing that makes me suspect the doctor or pharmacy, though, is that I've done that sort of search in the past, but I didn't start getting the pill mill calls until I got that prescription.

Read the documents doctors have you sign very carefully.

They often include a waiver that allows them to share your PHI with whomever they want.

You're under no obligation to allow them to do so.

The source of the information could also be a rogue employee at any of those places, especially for something shady, like robocalls.

In most places, it is not difficult for an employee, especially someone like a sysadmin or a DBA, to simply siphon the data into a CSV. Chances are that no one will ever figure it out.

I think that once law enforcement catches up, slow as they always are, they will start creating honeypot identities and then tracing the information leaks to their source. For now, there is little to be afraid of for the leakers.

The FANG company I work for has stringent controls in place as a check against employees attempting to do this. These controls are more comprehensive than those I've seen at other companies.

Sometimes it's mere proximity. If your family or friends find you have condition X or treatment Y then they may look it up to find more.

If you share the same public IP, as most homes do then that adds to it.

I started getting invitations to add a Google review to a restaurant I've never been too. But some of my family had.

I can figure out other stuff too - music tastes, social media trends, etc. Just by seeing ads and stories I'm offered on Google News and other places.

There's that famous story about a guy who discovered his daughter pregnant (or feared she was pregnant) a few years back because he started getting ads for baby clothes.

Incognito mode still exposes your IP. My approach is to use a VPN, NoScript to block tracking / ad domains, Disconnect.me to block social domains, uBlock Origin for ads, disable location services, and use incognito mode. Even that's not perfect given browser fingerprinting technology.

You still need self destructing cookies and randomized user agent to cover all bases.

Not effective. Use Tor Browser instead.

https://panopticlick.eff.org/

I always use Tor Browser + ddg for searching symptoms or embarrassing questions. But I am still worried someone can link those searches by deanonymizing Tor or some security flaw

Your IP makes incognito relatively pointless, and that's before you get into various clever forms of browser finger printing. If you want privacy you need to use TOR. Incognito should be treated as a convenient way to run without cookies / to log out of sites temporarily. It's also nice for sites such as YouTube as they'll pretend to not know who you are so you can get recommendations related to what you're currently watching instead of just constantly recommending everything you've recently (or not so recently...) watched instead.

> Does anyone know how effective incognito mode is at preventing data and privacy abuses like this?

Incognito mode really doesn't do much. It only prevents storing browsing data locally on your computer. Your ISP, your search engine and the websites you visit can store your info on their servers.

> but I imagine there may some clever ways of tracking even across incognito sessions (or between incognito and regular).

Browser fingerprints, IP address, etc are used to track you. Your ISP doesn't even need to be clever since you are dependent on them for your internet connection. There are ways to "hide" yourself from websites, search engines, etc but it's nary impossible to completely "hide" from your ISP.

Reply on news.ycombinator.com