Covering your tracks may be a little harder than previously thought in Chrome for Android
While it’s probably not earth-shattering news, you might be interested to know that there are some gaping flaws with Google Chrome’s incognito mode, as I discovered while attempting to fix a co-worker’s malfunctioning Chrome browser on his Android.
Incognito mode, for those who have never used it, doesn’t save or present tracking information to a website, nor save history, and basically functions as a blank new browser every time you launch it. It’s useful for surfing sites that you don’t want to know who you are, and also useful for not leaving tracks on your phone. Or it should be.
My co-worker’s phone had stopped loading web pages a day or two prior in Chrome, but he had not updated or done anything to change the Chrome app. So I went poking around to see what could be the matter. There wasn’t much in the history, and nothing for the past day, but the SD card was full. He said he hadn’t been doing anything with it.
The downloads folder tended to disagree with his assertion, as every single video he’d downloaded while in Incognito mode appeared there, and his keyboard also betrayed his trust, as looking at the custom dictionary revealed the names of some sites he regularly visited that really shouldn’t have been stored. I looked there as I started typing a web address in Chrome and one of my options was not something I’m going to mention here.
In the end, I’m not sure what was wrong with his Chrome. It was fixed by simply rebooting the phone. I did learn that Incognito mode downloads videos using a trackable method, I learned that the keyboard app remains unaffected and can and probably will store any embarrassing site names, and I learned to never trust Incognito mode or handle anyone’s phone without gloves.
I also found that System Tuner is a great application to use to locate a 14 gigabyte reports folder that had filled most of the SD card.
A keyboard and the downloads app are separate from Chrome though. Those apps would have to be aware that one was in incognito mode.
I totally agree with you though. This is technically not full incognito mode.
Of course, this isn’t very different from how incognito works on the desktop: your downloads stick around, and it’s not going to get around a keylogger or a soft keyboard that remembers what you’ve typed. The incognito disclaimer could mention the keyboard thing, though, like it mentions downloads.
I’ll echo what everyone else here said: the keyboard app is separate from Chrome, and because of the way Android is set up, I don’t think it would be possible for one app to modify the behavior of another, separate app for security reasons. The disclosure for incognito mode specifically says this doesn’t affect separate software – and downloads are downloads, just like if I were to download something on my desktop PC while in incognito mode. So I don’t think we can really blame Chrome here.
Also, have you ever used SD Maid? It’s great at finding huge files, too. :-)
Indeed. There would have to be API hooks exposed for a virtual keyboard or even the downloads app to know when to not save data during an incognito session.
It would be nice if this was possible, but it’s not really any different from a desktop experience in terms of what incognito mode encompasses. I’m pretty particular about these things, so I keep tabs of what traces are left behind.
For everyone saying downloads are downloads – I’m not talking a file sitting on the SD card, there’s a separate app that lists downloads by date. Chrome doesn’t seem to be doing its own downloading while in incognito mode.
Example: go into incognito mode, download a file. exit the mode. Delete the file using ES file explorer or some such.
There’s an app, even on Meanbean, called “Downloads” which will keep a record of that file and what date it was downloaded.
This means that Chrome is handing off the responsibility of downloading data to something else that’s recording it and not telling you that it’s being recorded. That’s where I found a rich and varied history.
That’s exactly the app I was talking about in my comments. The downloads app.
It basically handles ALL downloads for the system on an Android device (except apps from the Google Play Store/Amazon Appstore, etc). It’s a global download manager that’s been around since Gingerbread. It will not be aware of what Chrome is doing (incognito mode or not). So, you are always going to see your downloads there.
Sorry, that comment was pre-coffee… yeah, download manager does not need to be in the loop.
Just saying, Chrome needs to handle its own downloads, and have an incognito keyboard.
I agree. Like I said above, it would be nice if Chrome could “tell” other apps to not store data when in incognito mode.
I think it would be inelegant for Chrome to not use the downloads app (since everything else does, pretty much) in general (non-incognito), but it would make sense to just withhold what things were downloaded when in incognito mode. Same with a keyboard.
I agree with Paul on the downloads part. As a developer you do not have to use the Download Manager. Is it more efficient, absolutely, but when it comes to something like incognito, clearly the user is not looking to have things tracked and it is not difficult to handle the downloads in your own application.
The keyboard application, well that’s a different story, but a user who wants to keep things hidden, maybe should have thought to turn off the dictionary. Then again, maybe I am just too much of a geek to consider that the average user isn’t going to think of something like that.
I agree with Paul too. I just think that disallowing the use of the download manager app for even non-incognito downloads is a bit inelegant and not intuitive because we’ve been taught since Gingerbread to look for downloads there.
Ironically, the keyboards I use have never stored a website that I’ve been entering into an URL bar. Which keyboard does that? I use SwiftKey and I’ve never seen it suggest an actual website. Perhaps it IS storing it, but I’ve never had it populate that as a choice.
Kii does it automatically it appears, think Swype Beta did also.
I’ll play around with it in a bit, flashing anew ROM at the moment and having too many issues to jump on…
Weird. I was using Swype for a couple weeks (trying once again to like it), and I never remembered seeing a website suggested.
That being said, maybe I just didn’t enter in many website’s manually. I mostly use voice actions or Google search to get to websites. I haven’t given Kii a try yet. Maybe when I get some time.
I have found that if you type the website in the url then SwiftKey does not store it. Now if you go to google.com and type the search term, that term is indeed saved.
This made me laugh. Too funny.
And I quote: “Going incognito doesn’t affect the behavior of other people, servers, or software.” It’s even in bold.
The downloads part I could agree with.
I don’t want a web browser that includes a new keyboard just so that you can go super-incognito. First, it increases the size of the app and wastes resources. Second, that means that the browser is attempting to impose its behavior (keyboard) over my preference. Yuck.
This article should be deleted. The only point he makes is that chrome should have an incognito keyboard. Wtf? It’s a browser not an operating system.
You imply it’s “something wrong with chrome”. Nope, just something wrong with you understanding how a browser works.
I disagree that it needs its own incognito keyboard. If InBrowser (a browser specifically designed to be incognito) can prevent a keyboard from remembering words, why can’t Chrome have that functionality in its incognito mode?
To wipe names out of a custom dictionary, go into a text app, start typing words, URLs and e-mail addressed you don’t want showing up in auto-correct and long-press the offending word. This gives you the option of deleting it. Also, a long press in a text field will bring up a clipboard option, if you have ever copied anything to the clipboard. It saves ALL pastes, not just the most recent. You have the option there to clear those as well.
Also, to keep Android from remembering email addresses, URLs and such, go into your keyboard options and turn off auto-predict. You’ll have to type everything by hand and can’t use swype or auto correct, but it also keeps potentially embarassing text entries from auto-saving into your custom dictionary
How do you check the SD?