How would you explain this that wouldn't be considered "twisting"?

If you're in incognito mode, and you buy something on Amazon, post something on Facebook, purchase a NYTimes subscription, do you expect none of those entities to have information about what you did?

If you're in incognito mode and you visit a website with an embedded Facebook Like button, and Facebook's Javascript uses browser fingerprinting[1] to track you and build a further profile of you, do you expect that entity to not know who you are just because they don't have access to their usual cookies?

[1] https://blog.mozilla.org/internetcitizen/2018/07/26/this-is-...

Wouldn't the same be true with any other browser's incognito? What does this have to do with Chrome? The irony is that to do what these people ask for (Analytics somehow not tracking you in incognito), they would have to actually add in a way for Analytics to detect you are in incognito.

No, because I directly interacted with those entities. That's different from Google Analytics, where an entity with which I directly interact informs a third party unbeknownst to me.

No need to explain any different. The solution is to simply not track the user on websites, which they own, when the user uses incognito mode. That would be the honest way, but it will never happen, because then other browsers could try to pretend, that they are incognito Chrome.

So that leaves us with "do not trust privacy protection of an ad company".

A reasonable expectation would be that Amazon doesn't know about the Facebook post, that Facebook not know about the Times subscription... etc.

Replace the left side of the expression with "Google" and you'd have what most users might expect from Incognito. That is, that Google not know about the Amazon purchase, Facebook post, or Times subscription. That Google does know, essentially, even from Incognito, is the problem.

But Google doesn't know who you are when you're in incognito. They famously "don't do fingerprinting".

Of course, if Amazon or Facebook or the Times tell Google or at least hire someone to figure out who you are and tell Google then it's surely not Google who is tracking you.

And likewise, if Google Tag Manager and Google DoubleClick Ads make it easy to add and integrate with the one or two missing pieces from third parties to make this work, then it's not Google's fault either.

Why do you think Google knows about the Amazon purchase or the Facebook post? They don't.

I was sticking with the analogy established in the post I was replying to. To me they are variables in the pseudo-code, for the purpose of understanding the algorithm, not the actual underlying reality being discussed.

Right, but GP picked those variables intentionally, as things that Google doesn't (can't) track. If, for example you replaced "Amazon" with "Google", well you'd obviously expect Google to have the data.

So then if you replace "Amazon" with "company that subcontracts to Google for analytics", you'd still expect Google to have the data.

I think the issue here is a little more nuanced than right hand vs left hand, etc... Incognito was developed as a feature to hide your browsing history back when all users having individual accounts on a computer was much more rare. It wasn't developed in a world where "privacy" meant what it typically means today.

Things have changed and perhaps Google should have changed as well, but to paint this as some sort of nefarious plot is a bit disingenuous.

Incognito seems to be a bad name for what it does. Maybe Alzheimers mode would be better suited to describe the local forgetfulness without implying an attempt to hide the users identity.

The common name for it is "porn mode". It communicates the design goal very well: the point is to hide the fact you're visiting some pages from other people who may be using the same computer.

Everyone was too embarrassed to admit this was the origin of the feature. Fast-forward a few decades, and people are shocked that what was a euphemism doesn't honestly describe how the feature works.

Making incognito mode detectable is much worse for privacy, no? It adds another identifying bit that can be collected and it gives sites the ability to block people attempting to avoid tracking.

Yes, just like the do-not-track bit. That could change if courts start treating these bits as a "no, I do not consent to any tracking" statement. What if it was illegal to track users with this bit set?

"Tracking" becomes a little more subtle for websites that try to maintain some per-visitor state in order to function. But if it were well defined legally, it could probably be a really nice move for the sake of peoples' privacy.

Of course, that only helps with agents subject to the relevant laws.

Which, one would hope, Google is.

There's a reason big tech companies have entire PR departments with "We can do better™" statements ready to go.

Sometimes I wonder if there are cynical teams in Google or Facebook who implement features and also write public apologies for those features ahead of time.

Maybe the really advanced ones have PR statements that say "Oh, this feature sounds bad but it only really does this thing which is mostly okay" and then another one for "okay yeah you caught us it doesn't just do that okay thing but all the other not okay stuff you worried it did ahead of time".

I'm sure there are entire machine learning teams working out the best way to word these non-apologies and the best schedule for releasing them to best soften the impact of getting caught with their hands in the (literal or figurative) cookie jar.

I think the reality is much simpler. There's nobody in Google writing public apologies in parallel to implementing features. Through the magic of free market economy, they can just outsource it. Some court frowns at what they're doing? A quick call to a reputation management company (which they probably have on a retainer, or at least on speed dial), and they get all the press releases and training they need to manage the crisis. Why do it in house, if you can have experts do it for you?

Much like testing what would happen if a migration script dropped a column, features need to be tested against the possible outcomes in the court of opinion. I expect a well-organized corporate to have Product Owners who design the packaging of the feature and have it reviewed by the higher-ups when it’s a user-facing feature, or to design the apology letter and have it reviewed by the higher-ups when it’s an advertiser-facing feature.

But it’s our role as a society to not be gullible, and eventually organize against such behaviors, which this judge is doing.

If it just sets the "do not track" header, you don't necessarily know whether the user is in private browsing or just always has that enabled. I think adding the extra identifying bit to the sea of identifying information would be worth it if we had regulation (with teeth!) around what sites were/were not allowed to do with "do not track" on.

The header takes the values DNT=null (user didn’t specify), DNT=0 (can track), or DNT=1. We could have DNT=2 (really do not track?). Why not DNT=3 (“please disregard my login even if I attempt to”?).

Why would incognito mode be any more detectable? If it's a question of not giving access to certain data that could be used for fingerprinting (e.g. user agent, screen resolution, storage API, statistics of accelerometer noise, gyroscope drift rate), the browser should respond with fake data instead of no data.

There's a lot of data that doesn't need to be present, or presented, without user approval. The info at https://browserleaks.com/ is just... ridiculously detailed.

I don't see why a website should be able to get information about my WebGL capabilities without me being asked first if I want to let them display content, or why they can get a list of audio and video input devices without asking to use them first.

Even on Firefox, which I think is generally doing a much better job about this stuff, there's so amazingly much data that shouldn't be shared without asking first.

> why they can get a list of audio and video input devices without asking to use them first

I don't think they can do this without audio/video permissions (?)

The problem is that you cannot just add a new permission and expect things to not break. The flow for requesting permissions is different and would break pretty much every website that uses these APIs.

No there really is not. You can't always "twist" the words how you need it, otherwise you behave just like Google. Chrome is a separate product. It's a browser. If it says that Chrome won't remember history in private mode, but then you go and visit a Google website, then this website can still track you the same as any other website in private mode. You can't really say "Oh Google should be broken up and be treated as separate entities (at least when it suits me)" and then start complaining "Oh Chrome and GMail are acting like separate entities but they should be really acting as if they were the same thing (at least when it suits me)" ... lol

Private mode never was meant to be a privacy feature against websites. Private mode is to prevent your LOCAL history from containing anything you searched/visited and the legit use case is sharing of the computer with other members of family, for instance. For websites, nothing really changes. They can still track you all the way they want.

I mean, Firefox sends Do Not Track when in private browsing. So clearly it's trying to do more than just hide local history. It obviously can't guarantee it, but it's trying.

Chrome is not, and it seems pretty clear that it's not because that would hurt Google's bottom line. There's no conflict here between "Google shouldn't track you" and "Google should be split up".

Chrome also has an option for Do Not Track. Are you saying it should be enabled by default in Incognito? That may seem like it would help but not really because now you've given trackers a pretty unique signal to further track you (as very few people set that header).

Chrome has an option to send DNT, but Google's sites do not honor DNT:

> Most websites and web services, including Google's, don't change their behavior when they receive a Do Not Track request. Chrome doesn't provide details of which websites and web services respect Do Not Track requests and how websites interpret them.

https://support.google.com/chrome/answer/2790761

> I mean, Firefox sends Do Not Track when in private browsing. So clearly it's trying to do more than just hide local history. It obviously can't guarantee it, but it's trying.

You got scammed by Mozilla if you think that.

Please have a deep look at the various documentation on how the Internet works and realize that sending that header does absolutely nothing for users. It is, as it has always been, up to the receiving server to decide whether to even consider that data point or not.

This means that Firefox is not "trying" to do anything there, and it's actually doing an incredibly hypocritical thing as a browser vendor, making non-technical users believe that Firefox sending that header is somehow proof that Mozilla cares.

> Please have a deep look at the various documentation on how the Internet works

Wow. I understand how the internet works, but thanks for the personal attack.

> ... and realize that sending that header does absolutely nothing for users. It is, as it has always been, up to the receiving server to decide whether to even consider that data point or not.

Of course, and Google controls the receiving server in this case. If they honored the Do-Not-Track header, and if Chrome sent it, users would be better off. Of course browsers can't control what all servers will do. But by sending it, servers that do honor it will.

> This means that Firefox is not "trying" to do anything there, and it's actually doing an incredibly hypocritical thing as a browser vendor, making non-technical users believe that Firefox sending that header is somehow proof that Mozilla cares.

You seem to be saying that because not all services honor the header, it should never be sent. I would say that sending it is better than not sending it, because some services do honor it. And the fact that Google doesn't honor it is telling itself.

Firefox obviously does try, and DNT is not the only proof. They have put in a ton of work to make fingerprinting harder.

Two separate issues:

1) Chrome should enable the Do Not Track header when in private browsing, as any reasonable person would expect they would.

2) Google websites and analytics should respect Do Not Track.

I'm repeating what others have said but I think it's important to separate these out as different issues, because it completely nullifies everything you just said -- both are strong arguments on their own, and Chrome being a Google product is completely irrelevant to both.

Except Do Not Track basically died in 2018. [1] The W3C abandoned trying to standardize it, and virtually no websites pay attention to it, because the legislative efforts behind it fell apart. It's merely a "feel good" HTTP header that does virtually nothing whatsoever in practice.

I also disagree that "any reasonable person" would expect the header to be used in private browsing. Safari invented private browsing in 2005, and Chrome Incognito mode launched in 2008. Do Not Track didn't even exist as a concept back then.

Incognito mode was never intended to be anti-tracking. It's only ever been intended to hide your browsing history locally, e.g. from family members.

Tracking protection has an entirely different purpose. And if you want protection from tracking, you'd presumably want it in all windows, not just incognito windows, right?

These are the important issues to be kept separate. Anti-tracking is something that should be consistent across all browser windows. It has nothing to do with Incognito. Incognito is about not saving browser history locally. Totally separate.

[1] https://en.wikipedia.org/wiki/Do_Not_Track

> Incognito is about not saving browser history locally. Totally separate.

They're totally separate now, but it's not clear that they should be, and it seems pretty clear that they're not separate in the minds of users.

I'm having a hard time imagining a scenario where a user would want to hide their local history, but are totally cool with people who don't have physical access getting access to their activities.

> I'm having a hard time imagining a scenario

Very easy.

Let's be honest, incognito mode is generally used for watching porn without worrying that it will pop up in the autocomplete box or history later.

But you log into the porn site, in incognito mode, in order to access your saved videos, subscriptions, etc. The porn site knows exactly who you are, tied to your credit card number, etc. Your ISP knows you visit the porn site. Your credit card knows you pay for it.

That's the main use case. The privacy is ONLY regarding local history. That's the only expectation there's ever been.

> That's the only expectation there's ever been.

Given that the judge in this case had different expectations, that's clearly false. That may have been the intention of the feature, but I can easily see why it may not be the expectation of users.

I gave you the scenario. It's reasonable.

The judge in this case is simply seriously misinterpreting the feature. There are always going to be some percentage of users who misunderstand a feature no matter how explicit and clearly it's been described. Even if they're a judge.

Google isn't misleading anyone here. Every time you open an Incognito page it says EXACTLY what it does and doesn't. If some users and even some judges can't read, that's their problem.

Do Not Track died the minute Microsoft killed any possible distinction that header provided. They may have backtracked on that dumb idea with Edge but the damage was done, the momentum of DNT was killed and they effectively "poisoned the well" and ensured that the largest portion of DNT headers seen were not in any way set by the user. The W3C abandoned it because it was already gone.

"Google. Chrome is a separate product"

So basically: "Your honour, I can prove I didn't rob John, I had my brother do it for me!"

The US government does the exact same to circumvent the 4A.

which is likewise reprehensible.

is google going to wait until there's regular street fighting in cities across the nation before they change their surveillance behavior?

Please read the HN guidelines on commenting. You're attacking the commenter's account, assuming bad faith, and name-calling their argument a "rant" instead of responding to the actual argument they're making.

My account has been around for a long time and I agree with them. It's a well-reasoned explanation. It is correct on the purpose of incognito mode (to protect privacy locally only, e.g. from family) as well as the obvious point that if you're using Google.com while in incognito mode (very common), it's tracking you as it would anywhere. Websites aren't even supposed to know you're in incognito mode.

Incognito means and has always meant "fresh browser tab with no history". It has never meant no tracking.

No I'm not, I said "I love these accounts", I find them enormously entertaining

Just apologize for baselessly attacking the gp and admit your condescending "high ground" is indefensible. I've done it on HN before, it feels pretty good vs continuing to defend a rash comment.

Please don't post unsubstantive comments or flamebait to HN. Please do follow the site guidelines. You've broken them badly in this thread.

https://news.ycombinator.com/newsguidelines.html

Throwaways are important for being able to discuss opinions you might not want to on your main. Treating them as unacceptable worsens the quality of discussion here.

I somewhat agree with the point they made and this is not a throwaway if that helps.

@malux85, except their point is pretty solid. At the very least martamorena943 made a coherent argument to support a point of view they are sharing politely. None of which you have bothered to do at all, in spite of (or I guess because of) the condescending high ground you feel entitled to.

It would be a really interesting result if Google couldn't offer an "incognito mode" because of their position as a data harvester. Rare for vertical integration to be a disadvantage.

Others pointed out here in the comments, and elsewhere everytime this subject comes up, that Incognito window has a very carefully worded disclosure when you open it that websites can still track you.

I think any judgement saying that Incognito/Private Browsing/etc are lying unless they somehow prevent websites from knowing that you accessed the website would be downright technologically impossible, short of perhaps Tor browser, and even Tor Browser doesn't make this kind of guarantee.

I think their disclosure is very misleading. The disclosure sounds more like "we can't prevent other people from tracking you, but we're doing our best to stop it". What they should say is "Google will still track you. Other websites may still track you."

Saying specifically that Google will track you isn't true either - it doesn't track you and associate the incognito session with your existing ad profiles, it tracks a new identity with its own interests. Google shouldn't have to specifically list itself when it behaves the same as other third-party analytics services or ad networks.

Why do you say it is carefully worded? It seems like a basic description of how the internet and how browsers work.

Exactly. Many people (like the judge in this case, clearly) have a dream about how they think it works. But if they just read what the text said, it's very clear.

They've changed the wording a few times, but as far back as I can find screenshots, it's always said that websites can still track you.

> They can twist the words to be technically accurate, but not everyone is going to understand this.

I think there will have to be some kind of large-scale privacy crisis with real and visible consequences for the public to ever become alert to what surveillance capitalism REALLY means for them.

Some folks are aware that these practices are bringing us down as free people (rather than as individuals), but these voices just sound like nitpicking to most people. I am just concerned about what kind of tragic consequences we'll have to see before people get wise to this.