Slashdot Mirror
Chrome Private Mode Not Quite Private
wiplash writes "Google Chrome appears to store at least some information related to, and including, the sites that you have visited when browsing in Incognito mode. Lewis Thompson outlines a set of steps you can follow to confirm whether you are affected. He has apparently reported this to Google, but no response has yet been received."
Google is addicted to your information, and will do whatever they can to get more.
They cannot help themselves.
Resist.
If only we could observe something, without effecting it. Oh well.....
Waiting for the other shoe to...
My girlfriend is using Facebook in Incognito mode...
:: There is no light at the end of a tunnel. There is a tunnel after a tunnel : Thom Y.
You mean someone knows when I put my browser in Porn Mode?
Right, honey?
using 4.1.249.1064 on Win7.
Try running a strings against places.sqlite in Firefox as well after all the personal history has been cleared - I sometimes see URLs left in there.
all incognito windows share the same session
So, since the example in TFA didn't restart Chrome between incognito windows, I decided to see what happened when I followed the steps with "4.5 Exit chrome completely, then restart", and can confirm that even when Chrome fully exits and is restarted, it remembers the zoom level used in a URL only ever visited in an incognito window.
"The urge to save humanity is almost always a false front for the urge to rule." --H.L. Mencken
Just the other day I was ridiculed here by a few for suggesting that I don't trust Google Chrome with my privacy.
I'll stick with Firefox.
This is some guys blog and even the comments point out that he is wrong and it isn't reproducible.
But- I suppose nonsense posts still get the Google haters and Google apologists such as myself to view the ads.
Well done Slashdot!
And like many of the comments in TFA, it didn't work for me (using 4.1.249.1064) once I completely closed out chrome.
It seems that the issue only affects certain versions of Chrome... I'm guessing this is an honest bug, but since it's google, everyone freaks the hell out.
A Google App that collects information, even if you ask it not to? Say it isn't so!
"No one is more miserable than the person who wills everything and can do nothing." -Emperor Claudius 10 BC - AD 54
Exactly as reported.
I'm using 5.0.375.29 beta on an Air running 10.6.3 over wifi.
Went to cheese.com (the #1 resource for cheese!) and the zoom held.
Additionally, when I opened a new tab in non-incognito mode, the zoom STILL held, so there is definitely some communication between regular and incognito windows.
I'm devastated that my secret cheese browsing is now public.
"The pie shall be cut in half and each man shall receive.....death. I'll eat the pie."
This isn't even an issue of trust. It's not a question of whether Google is stealing information about you, or even privacy. It's an error or a possible bug wherein the mode where the browser is in essentially *no history* mode isn't working 100% w/o history.
If this is true, then it raises issues of quality control, not trust
...I'm sure enough people already know exactly what information of your doings the browser sends back to Google.
Talking to a pet rock. Neither one can hear you.
Here's the bug in question, filed about 2 weeks ago:
http://code.google.com/p/chromium/issues/detail?id=43107
Seems like someone looked at it, prioritized and classified it (eg pri-2, internals-cookies).
What's the big deal? It's just a bug that needs to get fixed, not a huge conspiracy by Google.
The remember zoom was added to the 5.x Beta / Dev channels some time ago, and isn't a part of the current Chrome stable build. [ Google Blog Link : http://googlesystem.blogspot.com/2010/05/10-things-to-try-in-google-chrome-5.html ] Nevertheless, I doubt this is sending any information to Google. You forget Chromium is open source.
There are many ways to finger print something that are not reversible. For instance, this is just page viewing preference data about a site you visited. What if it takes a hash of the url and uses that to store settings like current zoom and scroll location. There is almost no way this violates the idea of 'incognito' mode.
How is this addiction any different from, let's say, the phone company?
There's no -1 for "I don't get it."
TFA only mentions zoom levels as being stored -- not any other info from users' porn-mode browsing session, just zoom levels. Chrome recently began saving users' zoom levels (if I'm not mistaken) so that pretty much explains that (while conveniently also accounting for why users of earlier versions may not experiencing this phenomenon as well.) We're all waiting for google to slip up monumentally (or "pull a facebook," if you will,) but unfortunately we'll have to wait another day.
Google is a marketing/sales/advertising company. They can only be trusted to a certain point. Their motives are not those of a generous and altruistic organization. Their motives are consistent with those of the type of business they are. It is as simple as that.
i am using chromium 5.0.342.9 (43360) Ubuntu
when i try this a setting gets stored in ~/.config/chromium/Default/Preferences
"profile": {
"exited_cleanly": true,
"per_host_zoom_levels": {
"www.privatewebsite.com": -4
}
i have a feeling this is just a bug and not some google trying to steal our data.
There are a couple of sites I only visit in Chrome's private mode.
They do not appear on my history but they do auto-complete on the browser bar (I press 'x' and it automatically types 'xxxnnn.com'). At first I thought I had made a mistake at some point and used the regular browser, but there were no occurrences of theese websites in my history and I'm sure I was careful enough.
Anyone else having the same problem? I also don't know how to fix it, it keeps popping in the browser bar. I'm on debian btw
Be aware of the version you're using. Chrome v4 *may* not save the zoom level, so it wouldn't show it anyway. I'm on the dev channel, and thus am using the newly-released v6, and it's definitely reproducible.
Submitted by rcamans on Friday October 23 2009, @01:21PM
rcamans writes "Visit a bunch of sites in Chrome incognito, and then look at your history in IE 7. Oh My God! A few of the sites you did not want in history are in IE history? How did they get there? A nasty in Windows XP OS. Oh, man...
These sites do not show in Opera history, Safari history, Chrome history, or FIrefox history. So maybe it has to do with IE integration into the Windows OS. Do not trust Chrome incognito until this bug is fixed. If it can be fixed.
Also, IE7 search history shows Chrome incognito search items. Oops
wake up and hold your nose
$ rm -rf ~/.config/google-chrome /opt/google/chrome/google-chrome --incognito
$
$ find ~/.config/google-chrome -type f -exec grep -i elephants '{}' \;
"www.elephants.com": 2
I have the Chrome 5.0.375.38 beta from Ubuntu 10.04. Browsing Incognito appears to still change a number of files on disk, though I haven't investigated what is changed or stored. Finding the zoom problem is straightforward, though:
Per-site zoom levels are stored in a Preferences file (.config/google-chrome/Default/Preferences for me) in a "per_host_zoom_levels" section. It appears that the key is the domain name and the value is the zoom level. These seem to be saved when Chrome exits and, at least in my version, are set and accessed from both regular and Incognito mode.
So, anyone who can read this file knows on what domains you have set non-default zoom levels, regardless of whether you accessed the site in Incognito mode.
In linux, the zoom preferences are stored in the file ~/.config/chromium/Default/Preferences . Making the default directory non-writable by the user will prevent the zoom level (and whatever else) from being stored.
Chrome is very likely to hold the DOM of visited pages in the cache so that f.e. hitting the back button will quickly render the previous page. That does not necessarily mean that the information gets persisted on the hard drive or is available to other pages. On the other hand it's not unlikely that the information sometimes gets paged out to the hard drive and persists until it gets overwritten.
$ rm -rf ~/.config/google-chrome /opt/google/chrome/google-chrome --incognito
$
(output from chrome while I visit www.elephants.com, change the zoom level and exit chrome deleted)
$ find ~/.config/google-chrome -type f -exec grep -i elephants '{}' \;
"www.elephants.com": 2
Did you even look in options? Turn off "search suggestions". That's the feature that relies on this information being sent to Google.
Please, please stop spreading Microsoft's FUD.
Don't thank God, thank a doctor!
I've noticed that previously visited sites still flash up as suggestions immediately after purging the history. These seems to go away after a page refresh. There's probably some caching going on that isn't deleted correctly.
Fleur de Sel
Come on, people -- we even take a sane position towards Microsoft these days.
Chromium is an open-source project. Write a patch and see what happens.
And if you really insist it must be deliberate, please explain how spying on your fucking zoom level, and storing it in a local file which is never sent over any network, is so dangerous.
Don't thank God, thank a doctor!
Use truecrypt instead - create a firefox or chrome profile inside an encrypted volume. That way you can keep all the bookmarks, cookies, whatever. Add a shortcut that mounts the volume and starts the browser with that profile, then unmounts at the end.
Same on my Windows machine. Looks like an oversight in a new feature. That's the risk of using the beta channel, I guess.
Run Firefox or Google Chrome for a few days, click "Clear Recent History", select "Forever", exit them.
Now go to a directory where they store profile data and discover SQLite files containing information from all the web sites you've visited (`man strings`).
Both browsers 'forget' to run VACUUM on SQLite databases they are using. However it would be even better to zero fill all the files containing your traces, then delete 'em, then recreate them.
In the Linux version, it's held in ~/.config/Chrome/Default/Preferences. Here's an extract from mine:
"per_host_zoom_levels": {
"devtools": 1,
"linux.slashdot.org": 1,
"slashdot.org": 1,
"ubuntuforums.org": 1,
"www.chromium.org": 1,
"www.elephants.com": 2,
"www.groklaw.net": 1,
"www.newscientist.com": 1,
"www.phoronix.com": 1
}
and I've only ever visited elephants in incognito mode.
This is just an oversight in the coding of incognito mode, IMHO.
Not a conspiracy, just a whoopsie.
You spelled "teh" wrong.
Two words - flash cookies...
http://www.wired.com/epicenter/2009/08/you-deleted-your-cookies-think-again/
I think you're missing the GPs point. Although many around here might well hold the beliefs you allude to (I don't think its a significant population on Slashdot, as victimized as you might feel by them), the GPs point is that the cost of betrayal by the Government far exceeds the cost of betrayal by a Corporation. In fact, the worst a Corporation can do do you is really limited by what the Government will allow it to do - if you are really so afraid of what a Corporation can do to you, you are implicitly afraid of what the Government will let it do.
...when I completely exit chrome and re-visit the same site.
Just tested and magnification settings are not persistent.
Like an addict, Google is also conniving, hoping to keep one step ahead of users and the law--even in some cases flagrantly violating the law just because it is so big.
To thwart its act-now-excuse-later behavior, Google needs to be severely punished for its infractions and lawmakers need to continue enacting further constraints on what kinds of data can be legally collected and what those data can be legally used for. I'd say the most important issue is to regulate the data collection, since it's all too easy for data, once collected, to "leak" or be used improperly.
Using Windows 7 32bits, Chrome version 6.0.401.1
"A sysadmin is a cross between a detective, a police officer, a gardener, a doctor and a fireman"
Google is in the business of using your data to sell to ad companies and a more personalized advertising experience. This was their business model from day one and it's why they give everything away for free. Now that they are a company that has stockholders, it's going to get a lot worse. They can't ever be trusted because their roots drink deep from the wells of privacy. From your email content in Gmail creating ads, to who knows what the future holds for your data and Google products... You'd have to be either uninformed or not care to use any Google products and expect total privacy.
Let me get one thing straight. I am no Google hater. Their SOC program helps out open source software tremendously. That being said, I was somewhat given the creaps when I learned that my Gmail account would stay automatically logged in and record whatever I search for on Google, even after closing and re-opening the browser.
Given this, and the fact that most of their services are based on advertising, I would be careful what information I give them. This is also the reason I have not used their browser.
Also notice that incognito mode leaves a trail of other content on the system and does not delete it after you close the browser session. For instance say you are looking for videos on "how to prepare meat" and find this fine cooking site. You decide to watch the sample video and it is the perfect meal choice for your surprise for that "significant other". Later on "significant other" happens to look in the /tmp directory. There are video files there and when played reveal the secret meal you are going to prepare. In fact all of the temporary content from your incognito session is neatly stored in one place.
Iron 5.0.377 for Linux: http://www.srware.net/forum/viewtopic.php?f=18&t=1502
I think what you need to do is this to take advantage of the incognito feature:
1. Start Chrome
2. Open Incognito Window
3. Close Standard Window
4. Browse
5. Close Incognito Window
6. Re-Start Chrome
Just reproduced it with Chrome 6.0.401.1 dev on windows. It remembers your zoom level even if you close chrome completely, making sure there are no chrome.exe processes running, then start chrome back up. Just because it doesn't affect some older versions does not mean this story is false.
sig? uhh, umm, ok
Oh dear, come on. It's fixed already.
half of the people posting here probably didn't read the article and are going off about google when all that is stored is the zoom level. how can anyone genuinely be concerned about this?
http://code.google.com/p/chromium/issues/detail?id=43107
Everyone mentioning SRWare Iron should know about this little tidbit: The story of Iron. The article and the linked IRC log tell a very interesting story about a guy less concerned with having a good reason to fork and more concerned with making money off of adsense and publicity for creating a "privacy-respecting" Chrome which is basically a perpetually outdated Chromium with a few checkboxes in "Under the Hood" defaulting to off.
The guy who runs that blog does not try to hide the fact that he's a Chrome developer, and he admits that there is the highly unlikely possibility that the person who was asking these questions was not the person who went on to release Iron. I was skeptical as well until I checked out the log file itself and quite honestly it would have to be an incredible coincidence for this guy to be asking such questions and providing the information that he does in his attempts to glean information on the right way to advertise his product as well as how to go about renaming the executable. There's more that makes it very reasonable to believe this is the guy who went on to release Iron, so please don't dismiss it until you've checked out the log file in detail. If this was a supremely unnecessary and elaborate hoax it sure is pulled off convincingly.
Using Iron after reading this information made me feel like I was supporting the wrong guy here and I couldn't do it anymore, it was just too uncomfortable seeing that this guy was looking for adsense revenue and to make a name for himself. The attitude of this developer is not one I would encourage at all.
"We invented personal computing." - Bill Gates
IE 8 leaves URLs in a file on your hard disk, and FF uses special Google URLs that I bet are trackable. Enable HTTPFox in your Firefox to see for yourself. If you want a private browser, write it yourself.