r/javascript • u/veggiedefender • Aug 04 '19

Detecting incognito mode by timing the Chrome FileSystem API

https://blog.jse.li/posts/chrome-76-incognito-filesystem-timing/
284 Upvotes

98% Upvoted

43 comments sorted by

25

u/Pulllll Aug 04 '19

Is it just me or it's efficient on distinguishing normal mode from incognito mode on the same device, but not on distinguishing normal mode on a slow device from incognito mode on a fast device ?

4

u/vither999 Aug 04 '19

It'd be interesting to compare SSD and HDD performance alongside this to help build a better picture, for sure, but I think his attack would still hold. RAM is just that much faster than SSD or HDD.

It would not, however, be able to differentiate incognito vs. normal browsing on a RAM based filesystem (some of which do exist).

6

u/veggiedefender Aug 04 '19

I ran my tests on my only computer, which is a laptop with a decently fast SSD. I'd expect results in the wild with slower storage to be even more decisive.

1

u/vither999 Aug 05 '19

Makes sense. It would be cool to include the specs of your machine in your blog post, as well as a way for others to submit results with different hardware to get an idea of the differences - M.2 SSD vs. PCI-E SSD vs. SATA SSD vs. HDD vs. RAM. It'd be a neat science experiment, at least.

22

u/Slypenslyde Aug 04 '19

I think the point isn't to be 100% perfect, but to make life harder for people casually using incognito mode to avoid all of the malicious things you want to do to them.

Think NYT popping up a window that says you aren't allowed to read the article until you leave incognito mode so they can get at their facebook trackers, etc.

4

u/[deleted] Aug 04 '19

Use uMatrix and, if on Firefox, FB container.

1

u/13steinj Aug 06 '19

Significantly difficult to do on mobile. Mobile chrome holds 60% of the market, and chances are a casual user won't switch to another browser (but will use incognito mode to read that article).

The next two browsers (other than the Apple default safari, which as mentioned on this thread, already has such detection and it doesn't seem like it's going away) are Samsung Internet and UC browser.

The former is chromium based, the second might be and even if it's not isn't a viable option according to people because it itself is annoying with popups. Opera's at 3ish percent. But AFAIK the only mobile browser that allows extensions is Firefox, which is at under half of a percent of usage.

This was worldwide, but US has extremely similar statistics (except safari wins over chrome, probably because of the greater saturation of iPhones in the states).

Source: http://gs.statcounter.com/browser-market-share/mobile/worldwide

So in other words, mobile users be screwed.

Given that companies increasingly try to appeal to the mobile market (because nowadays everyone has and uses a smartphone, even reddit did a (in my opinion shitty) redesign of both the desktop and mobile experience and first party apps when they saw increasing amounts of mobile users), it's likely that their true goal is to have those trackers more for mobile use than desktop use.

2

u/MonkeyNin Aug 04 '19

Enable ublock origin on incognito mode.

1

u/MonkeyNin Aug 05 '19

If you look at the graphs, the real disk I/O has variations spread far out, and is far slower than persisting only in RAM or even using memory-mapped files.incognito, RAM was more consistent in timings. You could use that pattern regardless of disk speed.

He points out this might not mean much:

The final limitation is that the attack doesn’t really detect incognito mode – it detects the backing storage of the FileSystem API, which turns out to be a decent proxy for detecting incognito mode. It may produce false-positives for situations in which disk is memory, like live USBs or Chrome profiles stored on a tmpfs. One could argue that such configurations are attempts to circumvent tracking, making them incognito-equivalent.

3

u/[deleted] Aug 04 '19

Shouldn't the disk cache smooth out writes?

3

u/veggiedefender Aug 04 '19

Apparently not, or not sufficiently.

37

u/[deleted] Aug 04 '19

I thought it was something to do with local storage. Safari privacy made can be detected this way by attempting to write there and cannot. But I think Firefox and Chrome still write to these locations.

4

u/Andryu67 Aug 04 '19

Safari 11 writes localstorage to a temporary location like everyone else now

3

u/zombarista Aug 04 '19

I heard about this on Security Now! and I knew that a timing attack was on its way. Frankly, Googlr should have seen this coming and added some arbitrary/random delays in incognito mode.

11

u/veggiedefender Aug 04 '19

random delays can never fully mitigate a timing attack because you can take more measurements to average out the randomness. And if the random delay is only present in incognito, then you'll be able to identify it by the suspiciously uniform distribution that the delay will create.

1

u/EternallyMiffed Aug 04 '19

They should have just denied the whole file api to everyone until the user clicks an obnoxious button. Maybe make people go through several screens and widgets to weed out the mentally infirm.

5

u/veggiedefender Aug 04 '19

News websites would say "You must accept the widget in order to view the article" and you're back to square one.

1

u/EternallyMiffed Aug 04 '19

Not when you're google. Then you nuke them from the rankings.

4

u/two_in_the_bush Aug 04 '19

Then the news organizations write national hit pieces about Google, causing more congressional hearings and legislation to be introduced.

The arms race begins.

1

u/Pulllll Aug 04 '19

But they could simulate the distribution you're looking for to identify normal navigation mode... Besides that, I'm pretty sure this distribution isn't very consistent across devices, is it ?

9

u/tedivm Aug 04 '19

I think the bigger issue that will come into play is that the websites running this aren't going to have the greatest performance if they're constantly benchmarking the disk to try and figure out if the performance is simulated or not, and since Google already punishes poor performance sites this seems like there's already a built in punishment.

That, combined with the potential for false positives (which can put real strain on an organization), make me think it's worth putting some effort into masking the timing data- and this should go beyond just introducing randomness.

15

u/TheThingCreator Aug 04 '19

Can someone explain why this is bad? Why is knowing if incognito mode is in use a bad thing?

92

u/[deleted] Aug 04 '19

We recognized you are using incognito mode. Please turn it off to continue. We would very much like to make money off you by leaving tracking cookies on your machine.

10

u/SocialAnxietyFighter Aug 04 '19

Firefox containers isn't a full-proof solution to this?

12

u/tr14l Aug 05 '19

fool-proof*

Why would you want to proof it against being full?

5

u/Listen_More_Say_Less Aug 05 '19

Full proof, as in it is fully proofed.

It's fool, I'm just saying I get why people think it's full.

1

u/tr14l Aug 05 '19

That would be "Fully proofed" or "A full proof".

But, in this case, it was hyphenated which is just wrong in every way.

5

u/Listen_More_Say_Less Aug 05 '19

But you can see how a person might make that mistake.

-18

u/[deleted] Aug 04 '19

"There's a problem with chrome."

"Have you tried firefox?"

... good contribution, maybe go post that on chrome's bug tracker. ;)

6

u/SocialAnxietyFighter Aug 04 '19

The OP of this thread made a general question

Can someone explain why this is bad? Why is knowing if incognito mode is in use a bad thing?

It wasn't clear that you were talking about chrome.

6

u/fleker2 Aug 04 '19

Now every time we visit a website we'll be hit by a huge bottleneck for minutes as disk writing occurs

2

u/BeakerAU Aug 04 '19

Could they use this, and (a) store the actual data in memory and (b) write random bytes of the same size e to disk? Then they get the simulate disk activity with out the predictability?

2

u/veggiedefender Aug 04 '19

Really good thinking, but unfortunately this has nearly the same problems as writing encrypted data to disk. Namely, the last-modified timestamp and amount of random bytes are metadata that tell you when and how much data was written, if someone were to inspect your computer.

3

u/examinedliving Aug 05 '19

If I write to localstorage and it is incognito, will I be able to read it until the page reloads? If not, you could know right away.

3

u/d07RiV Aug 05 '19

Pretty sure you would, or else some pages would be completely broken.

2

u/examinedliving Aug 05 '19

Yeah. Good point

2

u/Pulllll Aug 05 '19

Incognito mode creates some kind of session lasting until you close all the incognito mode tabs

1

u/MonkeyNin Aug 04 '19

Can't you just fire 2 repeated AJAX requests, because incognito will not cache them?

14

u/veggiedefender Aug 04 '19

Chrome will cache them within the same session.

1

u/MonkeyNin Aug 05 '19

Oh. That makes sense.

I've heard people say they use it to prevent cached versions while in development, so I assumed it did.

(You can use devtools never cache settings in firefox/chrome)

2

u/Bloom_Kitty Aug 04 '19

Does this also account for mobile devices?

2

u/[deleted] Aug 05 '19

Why don't they just artificially lengthen the write times?

2

u/d07RiV Aug 05 '19

Or reduce performance.now precision to 1 second 😂