News for hackers. Stuff that matters.
Re:Microsoft Edge records browsing history in InPrivate mode by curveship on Monday February 01, 2016 @09:18AM (#11011832)
I'm betting this isn't a bug but isn't malicious either. Possible scenario:

Product: So Sue, how's the restore-session-after-crash feature going?

Dev: Great, just about done.

Product: So it's working for all sessions now? Fantastic!

Dev: Yep! Well, all sessions except private ones of course.

Product: ... so you haven't finished private sessions yet?

Dev: No, it's just that we don't store anything on disk for them, so there's nothing to restore.

Product: ...

Dev: ...

Product: Users don't know what "stored on disk" even means. They're going to be very upset if we lose their work after a crash, just because the session happened to be private. Maybe even more so.

Dev: But with nothing on disk, that would be impossible.

Product: You devs have such a fixed mindset. If I had a penny for every time I'd heard one tell me something was "impossible." So store what you need on disk, and ...

Dev: But history ...

Product ... and flag it so it doesn't show up in history or as a visited link. Wouldn't that work?

Dev: Well, kind of, but ...

Product: Great! So we have a solution. How long to get that coded up?

[Later] Product: "Impossible" laugh Hah!

Re:Microsoft Edge records browsing history in InPrivate mode by rdudek on Monday February 01, 2016 @10:34AM (#11012284)
I actually wouldn't be surprised that a similar scenario occurred during development. There are stupid decisions made constantly. Even the place I work, our Chief Security Officer in charge of security asked me to remove all authentication from all printers with email function so that it won't affect user's workflow... on top of that, I'm told to allow users to type in the "From" field as well.

I'm about to scan my butt to the CEO and type in the CSO's email address in the From field just to prove my point....

Re:Microsoft Edge records browsing history in InPrivate mode by arjie on Monday February 01, 2016 @01:20PM (#11013880)
If you don't have some sort of card + short-pin access to the scanner (or something else that's minimally interrupting), auth is an incredibly annoying thing. I mean, what's the threat vector here? Scanned butts? I think people will survive.

Everyone's supposed to have some fancy alphanumeric-with-special-characters password and sit there in front of the machine copying it in slowly from their LastPass. No, thank you.

Re:Microsoft Edge records browsing history in InPrivate mode by rdudek on Monday February 01, 2016 @02:03PM (#11014347)
Considering we're in healthcare business... I can see problems. We are working towards implementing a badge-in option but wont begin testing until this summer.
Re:Microsoft Edge records browsing history in InPrivate mode by akshatpradhan on Monday February 01, 2016 @04:01PM (#11015395)
>We are working towards implementing a badge-in option

Where else in a healthcare business can you implement those?

Re:Microsoft Edge records browsing history in InPrivate mode by rdudek on Monday February 01, 2016 @04:40PM (#11015699)
We already have the ability for staff to badge into any computer without typing their credentials.
Re:Microsoft Edge records browsing history in InPrivate mode by bargl on Monday February 01, 2016 @10:36AM (#11012297)
This explanation made me giggle and cry a little. It also made me think of the quote from Scott Hanselman, "We're not nearly as organized as we'd need to be to be as evil as you might think we are."

http://www.hanselman.com/blog/MicrosoftKilledMyPappy.aspx

Microsoft is thought of as this hugely evil company, but I don't know, maybe they are just as disorganized as every other company I've worked with and the product owner doesn't understand their customers all the time. The key is some comapanies I've worked for pivot fast and fix things they see as a mistake. Others try to bury and hide it.

Are they going to kill my pappy this time? I don't think so, but we'll see.

Re:Microsoft Edge records browsing history in InPrivate mode by xenophon on Monday February 01, 2016 @12:16PM (#11013187)
This heuristic, generalized, is sometimes called Hanlon's Razor: "never attribute to malice that which is adequately explained by stupidity."
Re:Microsoft Edge records browsing history in InPrivate mode by kibwen on Monday February 01, 2016 @02:14PM (#11014463)
I actually think that Hanlon's Razor goes too far. Allow me to present Kibwen's Corollary to Hanlon's Razor: "never attribute to stupidity that which is adequately explained by apathy".
Re:Microsoft Edge records browsing history in InPrivate mode by jobu on Monday February 01, 2016 @01:28PM (#11013959)
The razor also has a corollary in Clark's law, which states that "any sufficiently advanced incompetence is indistinguishable from malice".
Re:Microsoft Edge records browsing history in InPrivate mode by harryjo on Wednesday February 03, 2016 @03:56AM (#11025483)
Microsoft's evil was on display in open court.

https://en.wikipedia.org/wiki/Halloween_documents

Hanselman's point was that they weren't as evil as you might think

Re:Microsoft Edge records browsing history in InPrivate mode by reader_1000 on Monday February 01, 2016 @11:51AM (#11012945)
When you try to open closed tab back (ctrl+shift+T), Chrome does not open it. I thougt this is a good way of handling history in private mode, you close the tab and everything is gone. However when I tried same thing on Firefox, I saw that Firefox happily opens the closed tab back, which surprised me. So I think while trying to find a balance between usability and privacy, browser vendors choose different paths.
Re:Microsoft Edge records browsing history in InPrivate mode by aembleton on Monday February 01, 2016 @03:14PM (#11015037)
In Firefox you create a private window, not a private tab.

Inside the private window, you can have multiple tabs; closing them and restoring them. Once you close the private window everything is gone.

Re:Microsoft Edge records browsing history in InPrivate mode by oneeyedpigeon on Monday February 01, 2016 @03:19PM (#11015063)
Chrome also uses a private window, not private tabs. You just can't restore closed private tabs, which is probably how it should be.
Re:Microsoft Edge records browsing history in InPrivate mode by Spellman on Monday February 01, 2016 @05:45PM (#11016232)
Chrome fires up a separate thread for each tab. So any information about that tab is lost once the tab, (and thus sandbox) closes. No information specific to the tabs is stored in the window unless explicitly done (like bookmarking). Thus, the session history is stored inside that sandbox, so it's gone once it's closed.

Firefox is maintaining a window with tabs within it. So it can still keep your session info for each tab stored at the window level and restore it even after a tab is close.

Re:Microsoft Edge records browsing history in InPrivate mode by atrotors on Monday February 01, 2016 @05:06PM (#11015920)
The thing is that chrome sandboxes every tab, but firefox doesn't and it's easier for firefox to restore tabs than for chrome is to do.
Re:Microsoft Edge records browsing history in InPrivate mode by thaumasiotes on Monday February 01, 2016 @05:26PM (#11016085)
> In Firefox you create a private window, not a private tab.

This isn't true either. Log in to a site in one private window and then open another one. You'll be logged in in that one too.

Re:Microsoft Edge records browsing history in InPrivate mode by reader_1000 on Monday February 01, 2016 @03:47PM (#11015284)
I was talking about how tabs is handled in private window.
Re:Microsoft Edge records browsing history in InPrivate mode by rush340 on Monday February 01, 2016 @06:16PM (#11016442)
While Chrome does forget about the history of the closed tab, cookies are shared across incognito tabs/windows and aren't wiped until all incognito tabs are closed. You can still be tracked and associated with anything you visited in that closed tab if you have other tabs open.
Re:Microsoft Edge records browsing history in InPrivate mode by user8341116 on Monday February 01, 2016 @09:52AM (#11012001)
This post gave me PTSD.
Re:Microsoft Edge records browsing history in InPrivate mode by KirinDave on Monday February 01, 2016 @10:35AM (#11012293)
Exceeeeept, Edge doesn't restore those sessions or evidently do anything with this data, suggesting a regression on how the tab history is handled.

I mean, good story. 6 years ago it might have even been realistic for ms. These days, the middle level product manager who did that would rapidly find themselves on a high speed track to a new employer.

The Edge team isn't a bunch of faceless goons. Heck, a lot of them are really active in the browser development community and you can see they're trying really hard.

As much fun as it is to carry on the Slashdot tradition and make fun of every bug at MS as indicative of a toxic and stupid culture, maybe that's not entirely appropriate anymore.

I mean, it's not like Firefox and chrome haven't had bugs in this vein before. Hell, neither can fully protect repeatedly visited private urls on Android either.

Re:Microsoft Edge records browsing history in InPrivate mode by scholia on Monday February 01, 2016 @12:24PM (#11013277)
> As much fun as it is to carry on the Slashdot tradition and make fun of every bug at MS as indicative of a toxic and stupid culture, maybe that's not entirely appropriate anymore.

But betanews wouldn't have very much to write about....

Re:Microsoft Edge records browsing history in InPrivate mode by bengoodger on Monday February 01, 2016 @05:15PM (#11016001)
I don't know if this is the case, but I definitely understand how it could happen.

Chrome's Incognito mode has the exact behavior of not supporting things like session restore and closed tab reopening. It's kind of annoying for those of us who occasionally use Incognito windows like a convenient transient separate profile (specifically "give me a different cookie jar because some site's login is broken"), but I think the loss of functionality is worth it given what the mode is actually /for/.

It makes me wonder though if it'd be worthwhile having a mode that gives you a separate cookie jar but keeps the browser settings otherwise identical (bookmarks, suggest, etc). I suspect the distinction is too subtle for most people however.

Re:Microsoft Edge records browsing history in InPrivate mode by dalore on Tuesday February 02, 2016 @04:00AM (#11018358)
I used to use it for that but now with chrome profiles I've setup a new person for that called Mr Debug. It's good in that I can enable different extensions, ones that I wouldn't have enabled normally and disable the ones that interfere with dom inspections (looking at you Evernote).

You can run both at once.

Re:Microsoft Edge records browsing history in InPrivate mode by typon on Monday February 01, 2016 @11:10AM (#11012572)
This is too real. shudder
Re:Microsoft Edge records browsing history in InPrivate mode by dman on Monday February 01, 2016 @12:40PM (#11013438)
Microsoft makes a huge amount of money from enterprise sales. I would see how large companies would be worked up if employees could use private mode browsing to circumvent monitoring. I fear (without any evidence) that private browsing mode would be a tough feature to push in the enterprise space.
Re:Microsoft Edge records browsing history in InPrivate mode by lreeves on Monday February 01, 2016 @01:14PM (#11013792)
Monitoring in an enterprise environment (for browsing) works on a network level; even SSL sites are monitored by on-the-fly certificates that are trusted by the users machine. There's no need to persist history to disk for an IT team to capture that information.
Re:Microsoft Edge records browsing history in InPrivate mode by TheRealDunkirk on Monday February 01, 2016 @04:13PM (#11015494)
My favorite days are the one where central IT screws up the system, and we get certificate errors everywhere we go. Uh, do you think they're tracking us and snooping all supposedly secure communication? Naaaaaah. Luckily, I avoid most of those days working from home and NOT using the VPN. I SHOULD make sure I never log into something I care about (like iCloud) while on their network. The problem is that I can't get reception on my cell phone inside the building.
Re:Microsoft Edge records browsing history in InPrivate mode by Bromlife on Friday February 05, 2016 @04:46AM (#11040487)
If you don't want your employer to see it, do it on your phone. Everyone should realise that by now.
Re:Microsoft Edge records browsing history in InPrivate mode by slumberlust on Monday February 01, 2016 @01:46PM (#11014186)
I disagree with this, primarily because most enterprise solutions can track your traffic independently of the browser.
Re:Microsoft Edge records browsing history in InPrivate mode by jlgaddis on Friday February 05, 2016 @05:36AM (#11040621)
Sounds like something that would be much better controlled (i.e. "disabled") at the organizational level with a group policy setting.
Re:Microsoft Edge records browsing history in InPrivate mode by minusSeven on Monday February 01, 2016 @03:12PM (#11015015)
thats looking at it from the best possible way. The way windows 10 has gone so far I really doubt which is which. Maybe they knew and didn't want people to find out. They also don't seem to give a shit about what people actually want.
Re:Microsoft Edge records browsing history in InPrivate mode by dabodmb on Monday February 01, 2016 @11:59AM (#11013036)
This sounds like a very likely scenario... sad but true.
Re:Microsoft Edge records browsing history in InPrivate mode by fweespeech on Monday February 01, 2016 @09:56AM (#11012025)
I'm pretty sure you are right [or some similar scenario].

However, its disingenuous at best that they didn't mention it anywhere.