Chrome 76 will block incognito browsing detection loophole

Google company reported about changes to the behavior of incognito mode in the release of Chrome 76, scheduled for July 30. In particular, the possibility of using a loophole in the implementation of the FileSystem API, which allows one to determine from a web application whether the user is using incognito mode, will be blocked.

The essence of the method is that previously, when working in incognito mode, the browser blocked access to the FileSystem API to prevent data from sagging between sessions, i.e. from JavaScript it was possible to check the ability to save data via the FileSystem API and, in case of failure, judge the activity of incognito mode. In a future release of Chrome, access to the FileSystem API will not be blocked, but the content will be cleared after the session ends.

This method was actively used by some sites that operate on a model of providing full access via a paid subscription (paywall), but before limiting the ability to view full texts of articles, they provide new users with demo full access for some time. Accordingly, the easiest way to access paid content in such systems is to use incognito mode. Publishers are not satisfied with this behavior, so they have recently been actively using the associated
FileSystem API is a loophole for blocking access to a site when incognito mode is enabled and prompting you to disable this mode to continue browsing.

Source: opennet.ru

Add a comment