Slashdot Mirror
Microsoft Edge's Private Browsing Mode Isn't Actually Private (betanews.com)
JustAnotherOldGuy writes: The forensic examination of most web browsers has proven that they don't have a provision for storing the details of privately browsed web sessions. However, in the case of Microsoft Edge, the private browsing isn't as private as it seems. Previous investigations of the browser have resulted in revealing that websites visited in private mode are also stored in the browser's WebCache file. The Container_n table stores web history, and a field named 'Flag' with a value of '8' shows that website was visited in private mode. An investigator can easily spot the difference and use this evidence against a person. The not-so-private browsing featured by Edge makes its very purpose seem to fail, and you can't help but ask how such a fundamental aspect of private browsing could be so fantastically borked. It beggars belief.
...on a 2-day-old article? Malfunction or sign of new ownership? Or some warm confection of the two..?
So, InPrivate is to Private as InVisible is to Visible.
Thats the best reason I can think of.
seems editors here used all knowing edge, which explains delay in accessing to this old story.
It's worth noting that other browsers' "private browsing" modes only hide the details of the session from the local machine. Using "incognito mode" in Google Chrome is not encryption and does not shield your privacy in any way from others on your network, your ISP, the NSA or Google themselves.
Proof? I think security researchers looking into this would've noticed packets going out encrypted or not during privacy mode.
Custom electronics and digital signage for your business: www.evcircuits.com
It "beggars belief" why this editor still works at /.
By "illegal" I mean a civil violation of warranty- and false-advertising laws that say products are supposed to meet their intended purpose, as a common everyday consumer would understand the term "intended purpose."
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Wrong. I don't know about Google, but I do know about Safari. When it's in private mode, all of the data that is normally saved to disk for any purpose is stored in encrypted memory, so within a private session, you get the benefit of caching, go forward/back, etc. But once you close the private window, all that encrypted memory is erased and released. Apps using the NSURLSession APIs can do exactly the same thing.
I've concluded in the past couple of years that large parts of Microsoft as an organization have stopped being able to coherently sell to the end user market, and whatever people in the management that would have in the past noticed this sort of thing and taken steps to correct it have left or moved on to other roles.
Signs of things slipping I've personally noticed in recent years:
- The faulty Microsoft web-based store (do they expect developers whose first experience with Microsoft is a web site that can't even sell a Windows upgrade are going to turn around and want to build things on ASP.net?)
- Contradictory descriptions of the different Windows SKUs (with respect to use as upgrades, new machine installs, usability by end users vs. system integrators, etc.)
- Software with seriously flakiness in features that worked in previous versions (e.g. Windows 10 Start Menu search and keyboard navigation), with broken help links, without an integrated installer (e.g. Lync, Sharepoint)
New features all the time baby! Just don't try to turn it off.
Microsoft Edge's Private Browsing Mode Isn't Actually Private
I'm shocked! Shocked, I tell you!
On the other hand, it has been obvious to me for a long time that if you want privacy, you don't use Microsoft products.
I'm an American. I love this country and the freedoms that we used to have.
Modern app appers know that only apps can app apps, and privacy is something only LUDDITES use, so apps like Edge app everything you app so every apper can app your apps while apping other apps!
Apps!
not a bug.
This is Microsoft we're talking about. Misrepresentation about their products is what they do.
You're thinking of "implied warranty of fitness for a particular purpose ", as it's called in the Uniform Commercial Code. There's also warranty of merchantability. Let's look at each in turn.
The terms and conditions can explicitly and clearly disclaim the warranty of fitness for a particular purpose, and I'm sure Microsoft's terms do so. They can't disclaim warranty of merchantability so easily. If they do disclaim fitness for a particular purpose, that's the end of that. If they didn't disclaim the warranty, UCC has two conditions. First, the seller must have reason to know what purpose the buyer intends to use it for - browsing porn without having the address bar later autocomplete xvideos.com? National security level espionage? Secondly, the seller must habe reason to know that the buyer is relying on the seller's expertise to recommend an appropriate product.
Microsoft doesn't know whether you intend to use it to avoid having autocomplete accidentally embarrass you or if you're trying to foil expert forensic investigators. Since they don't know which purpose(s) you might use it for, there is no warranty of fitness for a particular purpose.
On to warranty of merchantability. This applies even when the seller does NOT know what purpose you plan to use it for. Because the seller doesn't know, he warrants only that it's useable for SOME purpose. If the mode successfully avoids accidental embarrassment from autocomplete, accidentally hitting the back button down-arrow, etc, then it is useful for SOME purpose and therefore the warranty of merchantability is met.
Suppose some warranty was NOT met (and not successfully disclaimed). Then you could sue Microsoft for actual damages. If you prove that an accidental autocomplete during a business presentation got you fired, they would need to compensate you for the lost pay.
Lastly, you mentioned false advertising. What exactly do Microsoft's ads say about the feature? I suspect they do not say "prevents forensic examiners from determining anything about your browsing history".
Locard's exchange principle (https://en.wikipedia.org/wiki/Locard%27s_exchange_principle) says that the perpetrator of a crime will always bring something into the crime scene, and leave something behind. This is one of the foundational principles of forensics.
Although private browsing doesn't equate to criminal activity, the principle applies. Electronically, you will always bring something with you, and leave something behind. There is not, and never will be, a truly "private" browsing experience, regardless of browser. There will always be trace evidence that can lead to discovery of what you were browsing, and what you did while there.
More broadly, this principle is true in all of life.
you're telling me that a corporation that is notorious for their flawed software has made a flawed browser?! impossibru!
Anons need not reply. Questions end with a question mark.
Yes.
Microsoft has gone full-blown Big Brother/1984; is anyone at all surprised that their newest browser is also spying on you?
Go right ahead and mod me down to negative one troll, Microsoft shills, I expect it of you; wouldn't want your corporate masters to be angry with you, now would you? By the way I'm going to just keep on lambasting Microsoft ad infinitum, and anyone that doesn't like it can, quite frankly, suck my dick.
Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
It isn't a surprise.
But in MS's credit Google and Apple both do the same thing too
How does other people doing "the same thing too" work to Microsoft's credit or speak in any way to merits of underlying issues?
This line of argument is nothing more than bandwagon fallacy. It's completely worthless.
Chrome Incognito mode is the same. One of the drawbacks being that if you accidentally close a tab, you can't undo it. That tab is gone for good. I don't think it's encrypted in memory though, so if Windows pushes it to the pagefile it could (temporarily) be written to disk.
Sounds like, from the description, that it is working as designed.
No sig. Move along - nothing to see here.
Can't say I'm surprised that IE (or whatever MS is calling it now) is not half the browser that other companies provide. Almost seems like this article warrants an "I told ya so." from the net nerds.
"One of the drawbacks being that if you accidentally close a tab, you can't undo it."
Excelent, an extra reason to browse only in private mode. This undo nonsense it taking up way too much memory.
One man's cache is another man's treasure.
It's not a logical argument. It's a PR argument. It's something like the dead cat strategy that the various conservative groupings have deployed with great success worldwide. Because we're all talking about how this is illogical we aren't talking about the fact that anyone who uses Microsoft solutions should have expected something like this simply because Microsoft's interests (to monetize their operating system through advertising) are not aligned with your interests (to browse privately).
How am I meant to browse for gifts and flowers for my wife (WHICH IS ALL ANYONE EVER DOES WITH PRIVATE BROWSING) if its not actually private? Oh and in case the wife does find traces of activity, yes cumgarglingsluts.com is a site that sells flowers and gifts. Way to ruin the surprise Edge.
Edge lacks in so many areas, but it appears from stats its pretty much being avoided anyway.
Like "income" is a negation of "come", right.
I get it now. Thanks!
Your post just made me income.
https://www.youtube.com/watch?...
Not just Win10. I am always reviewing the logs of my Router (a home brewed Ubuntu server box), and I was surprised when Android also connects to Redmond HQ of Microsoft. Here's the IP being contacted by Android but there are a bunch of other MSFT IPs.
some MS IP being contacted by by Android device:
40.113.87.220
111.221.77.144
23.102.224.202
204.79.197.200
WHOIS Source: ARIN
IP Address : 40.113.87.220
Country : USA - Washington
Network Name: MSFT
Owner Name : Microsoft Corporation
From IP : 40.74.0.0
To IP : 40.125.127.255
Allocated : Yes
Contact Name: Microsoft Corporation
Address : One Microsoft Way, Redmond
Email : IOC@microsoft.com
Abuse Email : abuse@microsoft.com
Phone : +1-425-882-8080
Makes one wonder why Microsoft keeps on connecting to Android devices 24/7 even at 2 am when everybody is asleep.
Is why anyone believes things like MS's browser not being "private" is a mistake, or Apples "goto" fail was a bug (some of many fails for both corps) or that there isn't an obvious collusion between the gov and the tech sector, and all the spying and dirty tricks you see are not "bugs" or "mistakes" they were planned all along.
Eisenhower warned us, we didn't listen, it came to be, now we are "proper fucked".
"If any question why we died, Tell them because our fathers lied."
So, Microsoft came out with brand new technology ... tells us how awesome, secure, and private it is.
And, shockingly, it isn't.
Why anybody is surprised that Microsoft hasn't really got a mature enough product to know how secure it is makes no sense.
Why anybody would believe that after all these years Microsoft suddenly wrote a secure browser is beyond belief.
Did anybody believe Edge was magically safe and secure just because Microsoft said so?
Lost at C:>. Found at C.
Call me a conspiracy nut, I don't care, but *somebody* has got to step up to the plate to fill that giant NSA datacenter in Utah.. I suspect MS has partnered with the NSA to do that very thing, and the way MS is trying to shove Windows 10 down the throats of all of the poor schlubs who still use Windows makes this "conspiracy theory" damn near a sure thing. Given that and the way they're force-feeding the telemetry crap on Windows 7/8/8.1.... Sooooooooooooooo glad I quit sucking on the MS teat...
THANK YOU, Edward Snowden!! Americans owe you a debt of gratitude (whether they know it or not..)
MS should just come out and say that Windows 10 is ad-supported. Not ads in the traditional sense, but the "Get Office" advertising app that gets reinstalled with each Windows update, along with Candy Crush Saga and Skype, all of which have some sort of revenue motive. Half of the "live tiles" on the Start menu even look like ads (Xboxxy, Microsoft Solitaire Collection).
I'm not sure if it's Android in general or Samsung specifically but I've noticed that my Galaxy S6 Edge uses word-completion suggestions culled from browser usage in incognito mode.
Founder, Americans Allied Against Alliteration
strings ~/.local/share/gvfs-metadata/*
As a matter of fact, isn't the browsing history the basis for the (in)famous crashsafari dot com?
My eyes reflect the stars and a smile lights up my face.
There are a lot of posts talking about what an incognito mode should do. Normally we refer to it as 'porn mode' here on /. which does seem to be the intended use case. There's a lot of reverse-engineered information out there about what these modes actually do. In reality, it's insane to trust any closed-source browser with this type of task. If you really care about this feature, you'll want to use an open-source browser where the source code can be audited to determine exactly what it was *intended* to do. (New security issues pop up all the time WRT things not behaving as intended, but that's a separate issue). And the behavior should be documented so you can decide if it meets your need.
The best "privacy mode" seems to be Torbrowser,https://www.torproject.org/projects/torbrowser.html.en. Note that it runs fine under Windows (probably be more secure under Linux).
its microsoft, enough said, TOTAL FAIL
Is why are you relying on your web browser to provide you with the security to break laws, that's not what private/incognito are for.
It's to prevent other users on the machine from seeing your browser history...
So the bet's on when the first class action lawsuit against Microsoft regarding Windows 10 and it's shenanigans is. Between the hoovering up of data, regardless of your choice, the unauthorized changing of windows update settings on 7, 8 and 10, and now blatantly lying about privacy settings.
I put in the little effort to setup classic IE on my win10 tablet because edge was basically unusable due to the fact it doesn't have an ad blocker. I really have no idea how people can surf the modern internet without an ad blocker, the auto-playing videos and popups everywhere make it completely insane.
I posted this as a question: slashdot.org/submission/5518507/what-do-you-think-about-icab-browser-for-mac
There's a Kiosk mode also a way to record sessions. this is a lot for me to learn about. Has anyone tried it? Like it
I am flunking the I AM HUMAN?! wtf?! My daily news letter isn't coming either :/ is this all due to the new owners?!
At Microsoft the security badge logo goes on the package before the security is added, comrade.
Trust in the computer!
-- Tigger warning: This post may contain tiggers! --
Windows.
> The not-so-private browsing featured by Edge makes its very purpose seem to fail, and you can't help but ask how such a fundamental aspect of private browsing could be so fantastically borked. It beggars belief
> Microsoft
I think I found the problem.
- For the complete works of Shakespeare: cat
Apparently....https://urlquery.net/report.php?id=1454188045917