{"id":51408,"date":"2024-06-05T08:05:27","date_gmt":"2024-06-05T12:05:27","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=51408"},"modified":"2024-06-07T10:18:44","modified_gmt":"2024-06-07T14:18:44","slug":"incognito-myth-how-private-browsing-works","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/incognito-myth-how-private-browsing-works\/51408\/","title":{"rendered":"The incognito myth: how private browsing really works"},"content":{"rendered":"

Ask anyone how to protect your privacy online, and they\u2019ll probably mention private browsing. Every major browser has it, although the names differ: it\u2019s Incognito in Chrome, InPrivate in Edge, Private Window\/Tab in Firefox, and Private Browsing in Safari. All these names evoke a sense of security \u2014 even invisibility: like you could browse the web safely and in full anonymity. Alas, this mode is far from being \u201cincognito\u201d in reality, although it is still helpful if you understand how it works and supplement it with anti-surveillance security<\/a>.<\/p>\n

How incognito mode works<\/h2>\n

In private mode, your browser doesn\u2019t save your browsing history, remember information you enter in web forms, or store the graphics and code of the websites you visit in its cache. The tiny text files called cookies<\/a> in which websites save your settings and preferences are only stored for as long as the private window stays open, and are deleted when you close it. This way, no traces of your browsing activity are left on your computer<\/strong>.<\/p>\n

However, your actions are still visible from the outside. The websites you visit<\/a>, your browser itself, browser extensions<\/a>, your ISP, the office or school system administrator, and various advertising and analytics<\/a> systems \u2014 such as those owned by Google \u2014 can all still track you.<\/p>\n

Some browsers, such as Firefox, include additional privacy measures in private mode. These may include disabling browser extensions and blocking known analytics sites that track users and third-party cookies that weren\u2019t set by the website you\u2019re opening. However, even this doesn\u2019t guarantee complete invisibility.<\/p>\n

Five billion\u2019s worth of incognito data<\/h2>\n

To get an idea of how much information can be collected about incognito users, look no further than the Brown v.<\/a> Google<\/a> lawsuit, which ended in the internet giant\u2019s defeat. The company was ordered to destroy \u201cbillions of data records\u201d pertaining to the activities of users who were browsing in incognito mode, and collected up until the end of 2023. Data that won\u2019t be deleted immediately must be further de-identified, for example by removing part of each user\u2019s IP address from the records. The court estimated the monetary value of the data to be deleted plus the data that will no longer be collected at a staggering $5 billion. However, affected plaintiffs will have to seek monetary compensation individually, so Google isn\u2019t likely to lose much money.<\/p>\n

More significantly for all users though, Google was ordered to start blocking third-party cookies in Incognito mode and generally provide a clearer description of how Incognito works. While Google\u2019s methods for collecting information in Incognito mode weren\u2019t fully disclosed to the public during the legal proceedings, some of the techniques were mentioned publicly: gathering data through Google Analytics, recording IP addresses, and collecting HTTP header data.<\/p>\n

None of the above is news or a secret: any website on the internet can collect and use the same data, and this data gets sent out in private mode just fine.<\/p>\n

How websites track incognito visitors<\/h2>\n

By login. <\/strong>If you enter your email, phone number or username, and password on a website, your browser configuration no longer matters: you\u2019ve announced your identity to the website.<\/p>\n

Cookies.<\/strong> Although the website can\u2019t read \u201cregular\u201d cookies from your browser as long as it\u2019s running in private mode, it can still set new ones. If you use a private browsing window day in, day out, without closing it, there\u2019ll be plenty of information gathered about your movements around the web.<\/p>\n

The IP address.<\/strong> Private browsing doesn\u2019t hide your IP address in any way.<\/p>\n

Digital fingerprinting.<\/strong> By combining information transmitted from your browser in HTTP headers with data that the webpage can collect with JavaScript (such as screen resolution, battery level for mobile devices, and the list of installed fonts), the website can generate a digital fingerprint<\/a> for the specific browser on the specific device and use that later to identify you. Private browsing mode has no effect on this.<\/p>\n

All of the above.<\/strong> Advanced analytics and tracking systems try to use a number of techniques to track you. Even if old cookies are unavailable due to private browsing, you can be remembered with an auxiliary method, such as digital fingerprinting. This means that even if you visit an online store in a private browsing mode without logging in, you might still see products you were interested in during previous sessions in your search history.<\/p>\n

What you should and shouldn\u2019t do in private browsing mode<\/h2>\n

\ud83d\ude0d<\/strong> Search for a birthday present for a family member.<\/strong> Private mode will come in handy, as the keywords that could spoil the surprise won\u2019t come up in the browsing and search history. It also will reduce the likelihood of the context ads that permeate today\u2019s web, giving away your plan with banners about the subject. However, private mode will be of no help if you sign in to your account at the online store or marketplace and make a purchase, as the website will remember both you and the purchase. The search history and \u201crecently viewed\u201d items also may display on other devices where you\u2019re logged in to the same account, so there\u2019s still a chance of that surprise getting ruined. To sum it up, logging in to any account is a bad idea when browsing in private mode.<\/p>\n

\ud83e\udd14<\/strong> Look for a new job or secretly check medical symptoms<\/strong>. The computer will retain no traces of the activity, but your ISP will, and so will your office network\u2019s system administrator. This isn\u2019t something you should do at work for example, as you can\u2019t rely on private browsing to help.<\/p>\n

\ud83d\ude21<\/strong> Download illegal content.<\/strong> Don\u2019t. And if you do download something like that in private mode, your ISP will still have recorded this activity under your account.<\/p>\n

\ud83d\ude0e Sign in to your account on someone else\u2019s or a public computer.<\/strong> In this case, private browsing is the least you can do to protect yourself. It prevents you from leaving any undesired traces like an account name, web form data, a saved password, or locally stored cookies or personal files \u2014 unless you save something manually. That\u2019s a start, but it doesn\u2019t guarantee complete security: public computers are often infected with malware<\/a> that can steal any data from the browser, with private browsing or not. So if you have to use someone else\u2019s computer, it\u2019s best to make sure it has reliable malware protection<\/a>. If you\u2019re not sure, we recommend changing your password for each account that you signed in to on that computer and enabling two-factor authentication<\/a> after you log off and get back to your usual device.<\/p>\n

\ud83e\uddd0<\/strong> Sign in to two accounts with the same site.<\/strong> Most browsers make this possible: you can sign in to one of the accounts in regular mode, and to the other \u2014 in private mode. This is about convenience rather than privacy, so private mode doesn\u2019t really have any drawbacks when used this way.<\/p>\n

What\u2019s better than private browsing?<\/h2>\n

Private browsing mode is helpful, and there\u2019s no reason to shun it entirely. For maximum privacy though, it should be combined<\/strong> with other measures:<\/p>\n