Chrome's private browsing is broken
This defeats the purpose of Incognito. If any website is able to tell you're browsing in private mode, then the browser is leaking data that shows it's not private
@cypnk Unfortunately it's fairly easy to detect private browsing in all major browsers. E.g. here's how the Boston Globe does it: https://bugzilla.mozilla.org/show_bug.cgi?id=781982#c56
This is definitely something browsers ought to fix, but it's tricky because of how you need to handle certain types of storage in private mode (localStorage, IndexedDB, etc.).
@nolan @cypnk Would it not be obvious simply by the 'quietness' of private-browsing? Rather than simply not leaking data, wouldn't a browser have to replace whatever kinds of data it hands out in regular-browsing mode? If this is so, I think it'd probs. be hard to generate convincing spoof data in a manner that wasn't detectable to clever server-side data-gatherers..
@cypnk @nolan In this particular case, then, wouldn't you either have to stop passing the referrer header field in regular browsing mode too, or else start passing (say) "referrer=fictional-domain.org" in private browsing mode, so's the server can't see the difference between modes?