I was surprised to see that this tracking works across both regular and private browsing in Firefox (67.0.4 on macOS). I can see the number of visits increment and whatever message I've saved on either side is displayed to both.
$etag = substr(sha1($secret . sha1($_SERVER["REMOTE_ADDR"]) . sha1($_SERVER["HTTP_USER_AGENT"])), 0, 18);> This tracking method works without needing to use: [...] Your IP address or user agent string
The author even notes in the source, "Normally you would derive this from randomness." I wonder what the reasoning was for this strategy?
That definition has expanded a bit (very) recently, but preventing website tracking is usually a separate feature (adblockers, noscript, automatic cookie deletion tools, firefox's recent "tracking blocker").
---
You’ve gone incognito,
Now you can browse privately, and other people who use this device won’t see your activity.
Your activity might still be visible to:
* Websites you visit
* Your employer or school
* Your internet service provider
[1] https://andydavies.me/blog/2018/09/06/safari-caching-and-3rd...
Edit: Submitted a bug