websites can still detect when we use incognito mode

At the beginning of the year, Google announced that Chrome would receive an update to prevent websites from knowing when we were using browser incognito mode. It was a change that took as long as it represented another way some websites might follow us,

With the advent of Chrome 76 just a few weeks ago, this change finally came into force, but as security researchers recently demonstrated, Google's decision really didn't solve anything.

Websites can continue to detect when we use incognito mode

To find out why the "solution" failed, you need to find out what the problem is with the incognito mode. Keeping aside that nothing is in private mode, Google uses a Special API for creating an isolated virtual file system in the browser This was a privacy problem.

This virtual file system serves so that the website can use a lot of resources without having to download them every time and thus be able to function better and faster. This API called FileSystem API, until the arrival of Chrome 76, it was not available in incognito mode, so for a website to find out if you're using it or not, you just need to check that the API is available.

To correct this, Chrome has continued to allow incognito API usage, with some settings, that is, changing the location where the virtual file system is stored on RAM instead of storing the device, as in normal mode.

So with Chrome 76, when using incognito mode, a site in theory cannot distinguish between normal and incognito mode simply by examining whether the API is used.

That really didn't solve anything, because as this researcher discovered, a website could be more ingenious and instead understand the amount of space that the API writes to a websitebecause in incognito mode there is a limit of 120 MB.

Basically, a website that you just have to check if the API in your browser can store more than that limit to distinguish whether it is a normal or unknown section. And in addition, another researcher also found that the writing speed that the API uses between modes is also different.

Chromium developers are already working to resolve both of these errors. In the meantime, there are already websites that use them to find out which mode we use.