For example, if I start a Mullvad VPN, and open up an incognito window, but am still signed into Google (on my non-incognito window), Google now knows who I am (in both windows). Then if I browse a website that has GA (within incognito), theoretically Google could figure out who I am. This would be avoided if I shared nothing (not IP address, not browser fingerprinting) between my two windows. Is there any way to do that at scale besides just... closing everything before I go into incognito?
Google has actively fought against this, and many people haven't noticed. Things like requiring 2FA for new Google account activation are ridiculously destructive to the ability to maintain any privacy or security. My workplace started demanding 2FA phone/email activation and their response to "So give us a workplace email account then, I'm not using my personal phone" was literally "Just go create a free GMail", which isn't a thing any more without a personal phone.
And it goes beyond new accounts.
I have a 2006-vintage, realname, [email protected] forwarding account for formal uses that I can't access any more DESPITE HAVING THE PASSWORD AND CONTROL OF THE RECOVERY EMAIL because I refused to hook up 2FA, and moved from the old PC to the new PC which Google doesn't recognize session cookies on. Give Google the keys to the castle or fuck you, we're walling up the doors.
These are dark patterns that, if Google is going to fight us on, demand regulation. Consistent access to specific email & phone numbers were never supposed to be this important to a functioning life, and not supposed to provide a shady for-profit private entity with a permanent panopticon dossier on your activities either. We would flip the table and replace governments if they tried to do this to us. We have, in some cases.
Burn it all down and create some kind of nonprofit NGO to run email or to run the Google Empire, which needs to be simultaneously secure and feasibly pseudonymous in order for people to continue having the basic human rights they enjoyed in the 2010's and 2000's when Google was still in the "Be Less Evil" phase.
Isn't this essentially Tor? Per-connection almost-random IP addresses.
Incognito does not hide your activity from Google. Especially when you googled in incognito and they likely use IP addresses as part of their targeting. I am also assuming it's different for different kinds of ads given you wont see ads if you look at something personal. They infact allow IP address targeting somehow. [1] Their privacy stance is more about 3rd party not having access to the data google has collected.
[1]: https://www.shopifreaks.com/google-to-allow-the-use-of-ip-ad...
I don't think there is consensus on HN regarding privacy issues.
I'm with the author. I view Google as a mass surveillance operation that has grown so large and invasive that I no longer want anything to do with them. I avoid their services as much as I can, and try to minimize and isolate cases where I can't.
But sure, sending that extra tidbit of information specifically to servers that they can verify won't track you would be a good tradeoff.
Even worse is that they probably do try to detect if you're in an incognito session, but only for their benefit.
Edit: Here's an easy thing they could do. Even if we accept or pretend to desire cross-browser correlation at all, new-seeming browser profiles could have their information siloed for a few days and if they disappear in that time it all gets treated as an incognito session.
They would google for things and suddenly my ads would show nightclubs near them (thousands of miles from me) and google’s default language would even change to the country they currently reside in. Just because the outgoing ip is shared across both users.
It’s actually gotten “better” but one could argue maybe they’re able to perform more precise targeting instead of throwing away signal.
Personally I wouldn't put it past them to absolutely do it on purpose/by design.
the common narrative is that they're gathering as much ad-targeting data as possible. No-one seems to care. What do they have to lose?
something to think about…
How would that work without unmasking the use of incognito mode? All the backend[1] knows is that it got a request for a search. There's (by design!) no way to know that that came from an incognito window in a browser that is otherwise logged in to a Google account.
[1] I know I know, this is a(nother) anti-Google rant. But Facebook and Microsoft and TikTok and everyone else does this too. If you flag your interest in $THING on the internet to $SITE, then $SITE will try to show ads for $THING to your roomates, kids, grandparents, etc...
Obviously, this is technically feasible: I was on my home internet (both computer & phone), and presumably there are <5 accounts that share this IP address. So when I search, they ~know who I am, and so therefore could serve me ads when I'm logged in. But I was still surprised that Google would do it — I guess I would've thought that Google would drop incognito mode requests and not use them for ad targeting. (Since, well... it is quite trust destructive.)
Does anybody know if Google is doing this intentionally? It seems like this is pretty value destructive for them long-term? Or... am I just being paranoid and this is just a frequency illusion?