Hacker News Reader

Comment by pacala | Hacker News Reader

Does Google Chrome set DoNotTrack by default in incognito mode? If not, why not?

I am not a Google employee but Chrome does not send the dnt header in incognito mode. It only sends it when you have it turned on, in which case it will send it in both regular and incognito mode.

I don't think it does. One possible explanation is that they don't want the "Edge Effect". If the header is set by everyone than people will just ignore it. Since Edge started setting it for everyone the header is basically useless already.

It would also provide an interesting way to identify incognito users which chrome has been trying to prevent websites from doing it. Of course it won't be perfect, but probably more than 99% of DNT headers would be incognito if they did this because I would bet that very few people enable it manually.

If everyone has a lock on their door, then people will just ignore it and break into the house anyways.

> If everyone has a "Under video surveillance" sticker on their door...

Ftfy.

It takes active effort to break into a house. It takes zero effort to ignore a header. It's more akin to everyone having a sign on their yard that says "Please don't break into this house."

Great point. There are 'No Soliciting' signs and laws.

https://banneradviser.com/no-soliciting-signs

> In a nutshell, no, door to door solicitation isn’t illegal. But if you have a no soliciting sign posted on your property, and the salesperson is refusing to vacate the property, they can be assessed trespassing fines and possible legal charges.

> But if you have a no soliciting sign posted on your property, and the salesperson is refusing to vacate the property, they can be assessed trespassing fines and possible legal charges.

How is this different from when you don't have the sign? Do they get to refuse vacating the property without trespassing in that case?

It's not a black/white situation. It's a 'argue in front of a judge' situation.

With sign: Unassailable evidence that tresspassers are informed they are not welcome.

Without sign. Owner word vs tresspasser word.

The latter is a weaker stance.

I'm not sure if they do, but one potential reason not to do it is that setting DNT literally gives the server 1 additional bit of information about your configuration. This could be used to track you more effectively.

1 extra bit is the last of my concerns, there's plenty of bits to uniquely fingerprint a browser anyways. I'd gladly trade one inconsequential bit, which requires malicious intent to misuse, to keep my privacy safe when dealing with honorable entities like, I presume, Google.

https://blog.mozilla.org/internetcitizen/2018/07/26/this-is-...

What goes into one's fingerprint:

1. navigator.userAgent, 2. navigator.language, 3. navigator.doNotTrack, 4. screen.width, 5. screen.height, 6. screen.colorDepth, 7. Intl.DateTimeFormat().resolvedOptions().timeZone, 8. navigator.platform, 9. navigator.hardwareConcurrency, 10. GPU vendor and renderer, 11. isTouch, 12. storage types, 13. font-list, 14. canvas-hash

Oh, there is so much more that can go into a browser fingerprint. There is no one, single "browser fingerprint." Basically any API your browser exposes can leak information that can be used for fingerprinting. See: https://panopticlick.eff.org/

I don't understand. There are dozens, if not hundreds, or even thousands of bits to use to identify any given browser, but providing one extra such bit that politely asks 'Do Not Track' is now a problem because it makes tracking slightly easier?

Because it would be a trivial indicator that you're in incognito mode.

DNT is broken for the exact reason stated earlier, it adds one more signal to use to track users.

The lawsuit is ridiculous. Incognito mode is extremely clear about what it does and does not protect against.

The irony brought up is that for Google to respect incognito they would have to then break it even more.

Reply on news.ycombinator.com