11

In Safari on Mavericks, I sometimes get a dialog from web sites indicating that some site functions will be blocked or degraded unless I turn off Private Browsing mode. Most users probably expect their choice of whether to use Private Browsing to be private. My impression is that other major browsers do not leak Private Browsing state to web sites.

I have noticed that while in private Browsing mode, Safari will not request favicons, so in theory a site could block caching of the favicon and make a pretty good guess that Private Browsing is on.

In contrast, on iOS, Safari doesn't request favicons at all. But it will, even in Private Browsing mode, request any "apple-touch-icon" if you access the Sharing panel (the apple-touch-icon is used as the Home Screen icon if you subsequently "Add to Home Screen" for that URL).

Other than favicon, are there other known ways that a web site could determine (or guess with reasonable accuracy) that you are using Private Browsing mode in desktop Safari?

| improve this question | |
  • Can you provide an example website? – sayzlim May 22 '14 at 18:58
  • e.g., video.pbs.org "A error has occurred. For the best experience with this website, please check if Private Browsing is OFF." – pseudon May 22 '14 at 19:01
  • It is possible that the web site is keying off of some other factor, such as DNT=1 or some tracker blocking. If that's the case, the error message is misleading. But I have gotten something similar on other sites. – pseudon May 22 '14 at 19:02
  • 1
    I just tested DNT and blocking extensions and those don't seem to be a factor. In Private Browsing mode with all extensions off and DNT unset, I still get the error dialog. But with Private Browsing off and DNT=1 and (blocking) extensions on, I don't get the error. – pseudon May 22 '14 at 19:10
  • Why would you not want a site to know that you are in privacy mode? Our web based application is going to be completely nonfunctional in that configuration since we rely heavily on indexeddb, appcache, local storage, web workers and a variety of other HTML5 features that are simply not available when in privacy mode. So, what you are asking for is a way to keep us from telling our users that they have configured their browser so that our web application won't work. What's the value of that? (If you don't understand why this doesn't make any sense, just relax. You aren't harmed by a site knowin – user3343404 Sep 29 '15 at 17:10
14

On iOS, HTML5's local storage is not available in private browsing mode, which means you can detect it by attempting to save something to local storage and catching the exception with the following JavaScript:

try { localStorage.test = 2; } catch (e) {
  alert('You are in Private Browsing mode');
}

Modified from https://stackoverflow.com/a/17741714/

On OS X, there's not really a canonical method, but this should provide some useful information:

If you're looking for implementation guidance, you should probably try Stack Overflow instead

| improve this answer | |
  • Thanks. I'm interested in server-side implementation only to the extent that it helps me with defense against the dark arts ;) – pseudon May 22 '14 at 19:25
  • 2
    Beware of false positives though — the provided JavaScript snippet would also show the alert in non-private mode if the local storage locker for that origin is full. – Mathias Bynens May 30 '14 at 6:33
  • github.com/Maykonn/js-detect-incognito-private-browsing-paywall – Maykonn Aug 2 '18 at 20:16
4

Safari’s Private Browsing doesn’t work in the same way as the other browser Private Browsing.

For example, Chrome’s Incognito Mode creates a separate new session that all the data will be deleted after the browsing session (the website can still track your actions from the IP address in that mode).

While Safari forbid website from creating/writing a file locally, discard all the changes made to cookies, including your activities in browser during this browsing session (the website can still track your activity in this mode, except that they stored cookies in this session will be discarded).

So how does a website know if you’ve turned on Private Browsing? Because it checks if it can write files locally.

| improve this answer | |
  • Safari does allow cookies within the Private Browsing session though, right? I am able to log into web sites while in Private Browsing and do everything I normally do, and have encountered no limitations, except in the rare cases where I get a dialog like this. – pseudon May 22 '14 at 19:21
  • Yeah, modified my answer a little bit. I mean your cookies during this session are not saved after Private Browsing is turned off. – sayzlim May 22 '14 at 19:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .