Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I am pretty sure your authentication cookie isn't shared between your regular and privacy sessions.


Yes, but it's shared between different sites within your "incognito" session. Open an incognito window, log in to Google, then go to some other place, and your Google login information is seen by that site.


What do you mean by "your Google login information is seen by that site" because I can't think of anything it could correctly mean, even in non-incognito mode.


Login to gmail. Now go to docs.google.com in a new incognito tab and all your docs will be visible.


Or login to Gmail. Open another tab to read Hacker news, not logging in. Close your incognito Gmail tab. Read HN. Forget that you ever were in Gmail. Then leave HN and go to some other, completely different website that allows Google login. You'll get in there without another Google login; the incognito session remembers you.


How would you implement it? Make each new tab a separate profile that we destruct on close?


You could make an argument whether you want one session per tab or one per window, but yes. Sharing state between "incognito" instances is both counterintuitive and potentially harmful.


I think the current approach is that there is just one regular and one incognito instance. So as long as any incognito tab is alive, your session is potentially alive as well.

This allows us to move tabs across Windows. How would we do that with one session per tab or per window? Also what happens when user opens link in new incognito window?


OK, you specifically meant subdomains of google.com. That really wasn't clear!


You are right.

But it does seem to be shared between all incognito tabs in all incognito windows (including in further new incognito windows) until you close all incognito tabs/windows. This is not necessarily what users expect. New incognito window should mean NEW && INCOGNITO!


I would love if it could, but chrome can only handle a single incognito session.


It can handle a single incognito session per profile. If you start another one from a window belonging to a different profile, you'll get a different session. (And you can tell them apart because they copy some of the theming and appearance settings from the profile they were created from.)




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: