NY Times Blocking Incognito Browsers | Hacker News Reader

NY Times Blocking Incognito Browsers

niemanlab.org

34 pointsjoegahona25 comments

This will probably stop working.

From the bottom of the article:

"There is one way the timing is odd, though. In order to treat incognito browsers differently, a website needs to be able to determine that they’re incognito browsers. Earlier this month, it came out that Google Chrome, the web’s most popular browser, was working to prevent sites from doing just that. Code that blinds servers to private browsing has already been added to the current Canary version of Chrome (a version used for early developer testing). New features in Canary, if all goes well, typically roll out to the standard Google Chrome in three or four months — so this sort of tactic will likely break by summer in the browser that currently has 63 percent market share.

By the way, I tested this out: Running the current Google Chrome Canary (74.0.3718.0) and turning on the internal setting for the change (#enable-filesystem-in-incognito in chrome://flags) meant the Times suddenly lost its ability to detect incognito mode."

This style of article of "Let's post 4-5 random tweets of people mentioning the points!" annoys me...

My main browser is Vivaldi, I now have Firefox set-up to clear cookies, etc, on exit, so if I want to browse WaPo I load up Firefox and the website thinks I'm just a fresh user (although this too has stopped working with WaPo's site...).

Disabling JavaScript should be a suitable work around as it requires JS to run their check for private browsing. Also I have JS disabled by default and I have no issues accessing articles from the NYT, WaPo, etc.

It seems like the best option given the business model.

Essentially, if they want to limit a given person to N articles a month they need to be able to in some way identify them. If a person is using private mode then theoretically there isn’t a way to track them, so your option is to either not allow them to read articles at all, or actively search for, and exploit, some break in privacy. I like to imagine that many companies think that is not the right thing to do.

Browser extensions that automatically delete site cookies when you close all the tabs for a given site (unless you manually add the site to your whitelist) still work and involve the least amount of ongoing user hassle.

Cookie Autodelete on Firefox, for example.

https://addons.mozilla.org/en-US/firefox/addon/cookie-autode...

Can someone explain how they can detect if you are in incognito mode? I didn't understand the article's explanation. From what I understand, it checks if you can store cookies. But doesn't incognito store cookies until you close the window? When I just opened YouTube in incognito, I get generic recommendations. But after watching several videos, I get recommendations based on what I watched, which I presume, are stored as cookies.

Some web APIs are disabled in incognito mode, yet are almost universally present on modern browsers. By attempting to use these APIs, a web page can detect if you are in Incognito. If the API is blocked, they can reasonably assume you are.

Thanks. What were some examples of those APIs?

I believe FileSystem API is one of them.

The localStorage API on Safari too, I believe.

Sounds like the reasonable thing to do would be to shim those APIs to make them look like they're functional (in fact, it sounds like Chrome Canary is doing exactly that with the filesystem API).

I wonder how far you'd need to shim before you can stamp out detection. I.e. does it really matter if you shim the Filesystem API? A program can just write some data and try to read it back. If the shims just no-oped those API calls, it'd be pretty easy to detect, no?

Chrome Canary's workaround is to store blobs in memory, which one can argue is akin to actually implementing the API and not disabling it.

I mean, if the point of the API is to access the filesystem, and you instead redirect those calls to a different in-memory scratch filesystem local to that incognito session and/or tab, then I'd call that shimming to at least some extent; it'd just be an especially thick shim.

In that case it might still be detectable by measuring timing of storage and retrieval?

Maybe. Adding a delay could further mask that.

I wonder when a newspaper will try pay-as-you-go. $10 gets you 20 additional article credits in your allowance. Or maybe a cheaper lite subscription with a higher article limit or just A-section or something.

You mean something like Blendle? https://launch.blendle.com/

Basically top up your credit and pay per article from a range of news sources. Although it's not (yet?) as integrated, featured and wide spread as it needs to be to be really useful.

I've been wondering about this and was about to make an HN thread asking about it as I couldn't find anything online.

I'm no longer able to bypass the paywall via Incognito Mode. It appears to be IP-based and perhaps even guessing based on geolocation? I sometimes can't even get around it by using a VPN in a different country.

And now, I've seen it block Incognito browers (I have to login to be able to read in Incognito). But oddly, I left the browser open on that page and about ten minutes later the paywall disappeared and I could see the full article.

NYT should just go full paywall like FT. No way around it. if you are paying for a subscription you should feel confident knowing there's no way to bypass and get the content free.

the dumbest paywall is the Australian Financial Review's. you can just hit Escape and stop the page before the paywall loads. or use Outline.com or Textise as the content is all there, it's just behind a css element. and they charge subscribers like $1,000 per year.

I could have sworn you can get to FT articles by googling for the headline and using outline

Instead of incognito, what if you just march through a bunch of different browsers in their non-incognito modes?

Disable JavaScript. Bonus: the site loads much faster.

I was not able to replicate (the article suggests it might be a test).

I can. It doesn't always happen, but I have seen it.

I cringe the day where my connection gets temp-banned because my browser rendered the site too quickly because I disabled all the junk a page loads.

the NYT has really done downhill over the years, so I'm exactly bristling at the thought of losing access to it.

Reply on news.ycombinator.com