I think there are two use cases for incognito mode:

1. I don't want others who have access to my client machine to be able to see a history of what I did online.

2. I don't want servers to be able to know anything about me except maybe my IP address.

It feels like tying these two together under one setting makes them both fragile. E.g. for scenario 2, I don't care whether a web page can use local storage as long as they don't have access to the data between sessions.

I'd much rather have two options - hide from the server and hide from your boss (or whoever). And maybe some UI to help me always hide from specific servers or delete all the artifacts from a specific session after the fact.

I want #1 for all machines, almost 100% of the time. Maybe 99%.

I try to wipe my drives and repartition every 30 to 60 days, with a full OS reinstall. The Virtual Machines I run with VirtualBox are even less persistent than the bare metal, often stateful for mere hours. I do not retain browser history, and I have only about 5 bookmarks, and trash my cookies and cache at least every day, multiple times usually.

But I want #2 for like 75% of the time. The other 25% of the time, that state almost never lasts 48 hours. When I go to bed, the current browser state dies forever. I usually have a hard time staying awake for 48 hours straight.

This means #2 will become 100% every 48 hours, with 48 hours being an extreme maximum lifetime for session data, and the true norm being 8 hours (9 to 5, each work day).

Considering that #1 & #2 are sure to intersect every 48 hours, dividing attention between them seems burdensome.

I'm going to go out on a limb and say you're not the typical user. Besides, in your case it would be a matter of selecting "hide from everyone" in the drop-down.

Yes! I think this is exactly the way to think about it. Especially the part about giving the user control over just what sites they hide in this manner.

What if you want both?

Indeed – I have a hard time believing that the vast majority of people who want one of these things wouldn't also want the other.

Hypothetical examples:

I don't want the New York Times to ID me, but I don't care if my wife knows I read it.

I don't want red tube to forget about my all access pass, but I don't want it in my browser history.

right, and i do want the times in my history so i know if i have seen it already. but as is suggested elsewhere, private mode does not prevent ID.

the times could switch to genuine browser/device fingerprinting and store that information server side. if they are careful enough so that false possibles are not possible (rather let a few slip through) then they could effectively control how much free access everyone gets.

If Chrome encrypted the data it wrote to disk, it can throw away the encryption key and delete the file when you close the incognito window, thus giving you access to the disk securely.

Any sort of file system imprint would at least leave a trace that incognito had been used. I’m not sure how much of a problem at is, and how much of a trace it currently leaves.

What about swap space used on the disk by the OS, transparent to the application? Is that also a concern for “file system imprint”? What’s the threat model here? The application would have to use RAM that’s never swapped for storing this sort of information. That would make it quite heavy.

I think chrome devs want to limit the "file system imprint" as much as possible to enforce "no-history in incognito". There's been some discussions on finding a way around crash reporting in incognito session which stores the dump in the disk, and to my knowledge this is the only violation of this policy. [1]https://bugs.chromium.org/p/chromium/issues/detail?id=876270...

there are many mundane reasons to use incognito mode. and the system would work in a way that the user will not even know the decryption key since it can be generated on the fly for each session.

the browser could even encrypt all their data by default. (but for non-incognito mode with a known key) it could then write the normal and incognito data in such a way that you can't even see that there is incognito data in there if you don't have the incognito key

Initialising a fixed storage image with random data offers plausible deniability.

> thus giving you access to the disk securely

The amount of encrypted data could be a side channel

We need the same thing on mobile apps too. If the Facebook app wants access to my entire storage or else it refuses to take a picture, then why not show it a facade filesystem instead?

indeed, i come across that several times. for some apps that i don't trust i'd like them to get access to a private storage. or a fake location. some apps insist that they need my real location in order to serve me properly. sure, that would make things convenient, but i am perfectly fine with using the app with out that convenience.

Incognito mode was conceived to not leave traces in your local system, hence its shortcomings to bypass paywalls. Making websites unaware of incognito mode was not part of the original design.