> it can not be detected, unlike Incognito mode

This may be true today, but that's because Chrome has a bug. (At least, I can't see why we wouldn't view it as a bug.)

Incognito Mode shouldn't be detectable. Hopefully they'll fix that.

It is true that Google will supposedly start making an effort to make Incognito mode non-detectable [0], but Incognito mode is still crippled compared to the way I use Chromium (through a simple shell script), mostly because of the option to use multiple "sessions" simultaneously and whitelisting of browser data that gets copied/used.

[0] https://www.blog.google/outreach-initiatives/google-news-ini...

What do you do for sites that complain each session you're using an "unrecognized browser" and require additional forms of authentication? Just deal with it every single session?

I assume by additional forms of authentication you mean codes sent over either email or SMS? Email is not a bother to deal with, because one can just copy the code over from the email; while phone SMS is not an issue because I did not confirm my phone number to any Web services. (For example, I think Paypal asks me to "confirm" my phone number every time I log in, even though Paypal knows the number is mine it is probably bound by regulation or law not to force multi-factor-authentication on me. So, just say no when asked about confirming your phone number.)

Do you have an example of a site that requires "additional forms of authentication"? I remember something like that happening to me before, but I can not remember which site it happened on.

I made a Microsoft account to use Skype. Twitter too recently. Both sent me messages immediately saying I had either broken the terms of service, or had been potentially compromised, and needed sms second factor to log in.

Since I had never used either account before this happened, it’s just a thinly veiled requirement that they can connect my account to an identifiable human.

Perhaps twitters bot problem is some justification, but when they warned me about violating their rules I just deleted my almost-unused account. It was insulting

Many sites ask for your phone just to simplify the "forgot my credentials, help me" customer support calls. Some, especially money-related, want to know your phone as a separate confirmation of your state-controlled identity, in countries where buying a SIM card required legal identification (which likely can be retrieved by a court order if need be).

Yes, SMS can easily be diverted so it's not great for 2FA purposes; a voice call is often an option, and is harder to spoof.

Sites that actually care about your security would go for things like TOTP, or SSH key, or a certificate. These forms do not map easily to your legal identity, but are more reliable proofs of knowing a secret.

For most services I cancel the account and explain why.

That's what I do.