Slashdot Mirror

← Back to Stories (view on slashdot.org)

Browser Private Modes Not So Private After All

Posted by CmdrTaco on from the don't-look-at-my-prvates dept.

CWmike writes "Browsing in 'private mode" isn't as private as users think, reports Gregg Keizer. 'There are some traces left behind [by all browsers] that could reveal some of the sites that you've been to,' said researcher Collin Jackson. He, along with three colleagues, will present their findings on Tuesday at the Usenix Security Symposium in DC. IE, Firefox and Safari, for instance, leave traces of SSL encryption keys even when run in private mode, while IE and Safari on Windows preserve self-signed SSL certificates in a 'vault' file that could be read by others to track the browser's path. Firefox also retains evidence of some certificates. Private mode has also been billed as a way for users to hide themselves from the prying eyes of sites that try to track habits and histories. Jackson said most users see that as the biggest attraction to private mode. 'Some browsers do a better job of protecting you from other types of scenarios, such as Web site tracking,' Jackson said. 'Safari is very much more willing to reveal you to Web sites than the others.'"

7 of 198 comments (clear)

  1. Re:Clean on close by mlts · · Score: 1, Informative

    Flash shared objects is the main thing. Easy fix -- download and use the BetterPrivacy extension.

    Of course, the absolute sure way to ensure browser privacy is to have a virtual machine dedicated to browsing, and have it roll back to the last snapshot once done. This is easy to do in Windows 7 and XP Mode. This way, some cookies left behind by some third party add-on (Java, Flash, or W/E) are eradicated completely.

  2. Re:Flash cookies remain too by Anonymous Coward · · Score: 4, Informative

    Firefox in Privacy mode with Better Privacy extension. Pretty good setup.

  3. Re:Don't forget about flash by drafalski · · Score: 2, Informative

    The flashblock and betterprivacy add-ons for Firefox will help with flash.

  4. Re:You need all of your files on a ramdisk by Psx29 · · Score: 3, Informative

    Another alternative is to boot off a live cd

  5. Re:Don't forget about flash by ytpete · · Score: 5, Informative

    Just fyi, the current version of Flash does respect "Private Browsing" settings in all major browsers.

  6. Re:Biggest Attraction by ytpete · · Score: 2, Informative

    There's no reason to turn off Flash or Javascript unless they ignore the privacy mode and cache content on disk anyway. The current version of Flash respects this setting, and presumably all browsers with a "private browsing" mode restrict their Javascript engines in the same way...

  7. Re:Flash cookies remain too by Idbar · · Score: 2, Informative

    then burn down the building.

    I think that's the building he was talking about... his ISP. It's kind of annoying to burn down your own house every time.