Hacker News Reader

Comment by mbrubeck | Hacker News Reader

In both private and not-private windows, the browser asks the user whether to save each password. Nothing is saved unless you explicitly click the Save button.

View on HN

Ok, but I think the parent is wondering in what situation you'd want to store in the browser details of a site you'd visited, but still use private mode to "hide" that you'd visited?

What data does the password use retain? IIRC password store retains the "time first used, time last used" and displays that visibly.

In short what's the use-case or user story that fits this feature?

I sometimes use private browsing to temporarily access a site with a secondary account, without logging it if my main account.

Multi-Account Containers is good for that.

Containers are overkill when you just want to do this as a one-off.

But, you wouldn't need to save a password if it was a one-off, either?

That's true, although I could picture a scenario where you want to log into a service only occasionally, so you want the password saved but don't necessarily want to keep a container for it. For instance, my wife and I have separate brokerage accounts, and I log into both simultaneously once a month.

That heavily depends on how much of a hassle the container system is, really. If specific sites automatically get opened in a specific container (a la facebook) then I'm certainly going to take advantage of password saving. Anything to have to not type and/or click fewer things to actually do what I want to do, instead of getting to what I wanted to do.

If I have to manually open the correct container first, though, that's a hassle. It's why I use containers sparingly, but hot damn do I have the "facebook container" extension installed (a site I look at maybe once a week) because automatic silos are fantastic.

This extension [0] allows creating on-the-fly new containers, and delete them when you close the tab.

[0] https://addons.mozilla.org/en-US/android/addon/containers-on...

If I want to browse a site without it cluttering up my auto complete history.

Say you want to order an engagement ring for your girlfriend but don't want WEDDING RINGS R US showing up when you type "r" in the address bar

it could still be an issue if your disk get inspected (or worse replicated).

If your girlfriend is replicating your harddrive to determine what ring you're buying, maybe it's better if she finds out and you call off the wedding instead of going through with it.

Some browse in private mode all the time and many times I have wished it asked me to save passwords so I don't have to type them repeatedly. Bookmarks work in private mode, why not passwords?

Not adding every damned site to my hstory is actually a feature.

Chrome's session and tab management on both desktop and mobile are abysmal. Whilst I've nuked it from desktop, I cannot remove it from Android. And, sadly, Firefox performance there still lags badly.

I browse almost exclusively in incognity on Chrome/Android.

If you password-protect your passwords, aren't they unavailable to anyone else? I use a password manager and that is what it does..

I'm assuming the threat is considered to be someone with local physical access to one's computer. Once you've entered your master password then an "attacker" only has to click the burger menu, then "logins" then they can enter a string from a website login URL, maybe "porn" and it would show the website's full domain, the username used, when the site was first and most-recently visited, and how many visits were made over time -- if it keeps bookmarks with all the info -- if you were using privacy mode to hide your tracks then it's not working there.

If you use Private Mode all the time then can't you just set the browser to act as if it were in private mode but with more fine-settings choice, that way you could have had password saving all along.

So, I'm still not really seeing the benefit.

That said, presumably the password db could have salted-hashes in in-place of domains/URLs for "privacy mode passwords" and then they'd be very hard to casually discover; that might be closer to user expectations.

> What data does the password use retain? IIRC password store retains the "time first used, time last used" and displays that visibly.

Lets compare it to downloads. That's another feature that leaves quite a bit of "compromising" info but users might still want to use it. I am thankful that Firefox does still allow downloads in private mode and did not just disable it. Sure, I could copy all the links into a non private session, but that would be annoying.

Similarly, imagining a situation were saving passwords from private windows might come in handy doesn't seem like a hard stretch to me. It also pretty obviously leaves a trace, just like a download, and thus shouldn't create much user confusion.

Reply on news.ycombinator.com