Hi WebKit Team, I came across following test page: https://underpassapp.com/StopTheMadness/PrivateWindowTest.html and noticed that websites are able to detect when we are in Private Window at least in Safari (this test case does not reflect this in Chrome but it could be due to UA String filtering or browser level check in this website as well). Anyway - if you visit this test page, you get 'Private Window: Yes', while this information shouldn't be available to website. This was added to web extension recently: Earlier Version relying on WebSQL (but now fixed since Safari 13) - https://lapcatsoftware.com/articles/private-browsing.html Latest (used by Medium as per Extension Developer) - https://underpassapp.com/news/2023-5-30.html "I've recently learned that Medium, for example, exploits a newer technique to detect whether you're viewing the web page in a Safari private window. I've created my own test page to demonstrate the technique. I've also created a new StopTheMadness website option to stop it: Protect private windows. This option is enabled by default, so if you update to the latest version of StopTheMadness, you're protected! Private browsing is now really private again." Appreciate if you can fix this workaround and improve privacy further. Thanks!
(function () { "use strict"; function isPrivate(flag) { document.getElementById("status").textContent = flag ? "Yes" : "No"; } window.indexedDB.open("test", 1).onupgradeneeded = function(event) { const db = event.target.result; const objectStore = db.createObjectStore("test", { autoIncrement: true }); try { objectStore.put(new Blob()); isPrivate(false); } catch (error) { const message = error.message; isPrivate(typeof message === "string" && /BlobURLs are not yet supported/.test(message)); } finally { db.close(); window.indexedDB.deleteDatabase("test"); } }; })(); ____________ This is JS used by website leveraging IndexedDB.
<rdar://problem/112032178>
Example provided shows that private browsing is detected because blob URls aren't supported.
*** This bug has been marked as a duplicate of bug 156347 ***