News for hackers. Stuff that matters.
Re:Is Private Browsing Really Private? by AdamSC1 on Friday February 03, 2017 @12:09PM (#13561302)
There are plenty of things a browser can see without being logged in.

Consider checking this page: http://webkay.robinlinus.com/

Private Browsing simply prevents cookies and nothing else, and for the average person we find that is not what's expected from something defined as "private" browsing.

Re:Is Private Browsing Really Private? by mintplant on Friday February 03, 2017 @01:47PM (#13562125)
> Private Browsing simply prevents cookies and nothing else

Not true, at least for Firefox. In Private Browsing mode, Firefox will avoid saving temporary files and other data to disk, keeping everything in RAM instead, which is wiped when Private Browsing mode is exited. This includes history, cookies, and cache data. I believe localStorage behaves differently as well.

Firefox also makes an effort to block tracking scripts/servers in Private Browsing mode, using Disconnect's filter list.

The Private Browsing new tab page explains this all pretty succinctly: https://i.imgur.com/MGp53eP.png

Re:Is Private Browsing Really Private? by AdamSC1 on Friday February 03, 2017 @02:07PM (#13562309)
You're right there. In this whitepaper we had different questions for each of the browsers to make sure this distinction was noted.

However, users still in general think that private browsing modes do things like prevent their IP address from being seen, or prevent a search engine from recording their searches. So there is still a gap in their expectations.

Re:Is Private Browsing Really Private? by bmm6o on Friday February 03, 2017 @02:50PM (#13562670)
> I believe localStorage behaves differently as well.

My recollection is that the browser claims to support localStorage, but attempts to use it fail. I don't know why it couldn't just be backed by non-persistent storage.

Re:Is Private Browsing Really Private? by throwaway2016a on Friday February 03, 2017 @12:26PM (#13561443)
I'm a full stack web developer. I'm well aware of what the HTTP headers and Javascript methods can expose even while in private. I was oversimplifying fingerprinting a bit.