Chrome's private browsing is broken

This defeats the purpose of Incognito. If any website is able to tell you're browsing in private mode, then the browser is leaking data that shows it's not private

@cypnk Unfortunately it's fairly easy to detect private browsing in all major browsers. E.g. here's how the Boston Globe does it: https://bugzilla.mozilla.org/show_bug.cgi?id=781982#c56

This is definitely something browsers ought to fix, but it's tricky because of how you need to handle certain types of storage in private mode (localStorage, IndexedDB, etc.).

@nolan @cypnk Would it not be obvious simply by the 'quietness' of private-browsing? Rather than simply not leaking data, wouldn't a browser have to replace whatever kinds of data it hands out in regular-browsing mode? If this is so, I think it'd probs. be hard to generate convincing spoof data in a manner that wasn't detectable to clever server-side data-gatherers..

@ej @nolan That would also block visitors who are coming from a fresh installation of a browser. I think it's some other combination of data

There is some difference in the header data
E.G. Here are my incognito headers vs regular headers in Chrome (courtesy of DuckDuckGo)