4

If I open an incognito window in Google Chrome and go to a webpage where Chrome has a saved username and password from (for example the login form on http://gmail.com), I see that my username and password are automatically filled in.

Does that mean that I am not really incognito? Can the website see my username even if I don't explicitly log in? Or is there some mechanism behind the scenes that prevents the webpage from grabbing auto-filled values unless I actually log in?

Clarification: Stored usernames (and passwords) are a lot like cookies: your unique identifier linked to a certain site, stored locally in your browser, available to the site when you open it. When you go incognito you ask your browser not to identify you to the sites you visit. It does that by (among other things) not exposing its cookies. Exposing the stored username in this mode does not make sense to me (but maybe I'm missing something...).

Update (2014-09-25): it seems recent Chrome versions don't do this anymore.

Improve this question

1 Answer 1

Reset to default
7

Does that mean that I am not really incognito? Can the website see my username even if I don't explicitly log in? O

Incognito means Chrome destroys all cookies created & doesn't record any websites that you visited. The passwords are filled in from Chrome's password manager, not from the site.

Incognito is also a client-side, browser-specific implementation - it doesn't mean no body will be able to track you.

Read Chrome's incognito message:

You've gone incognito. Pages you view in this window won't appear in your browser history or search history, and they won't leave other traces, like cookies, on your computer after you close the incognito window. Any files you download or bookmarks you create will be preserved, however.

Going incognito doesn't affect the behavior of other people, servers

When you go incognito you ask your browser not to identify you to the sites you visit. It does that by (among other things) not exposing its cookies. Exposing the stored username in this mode does not make sense to me (but maybe I'm missing something...).

No, you've misunderstood here. Incognito mode works by destroying the cookies after the session is complete( which is signaled by you closing the incognito window). Incognito does not mean do not identify myself, it means do not keep a track of my activities when I'm on an incognito session.

The thing you are missing is how incognito works - the browser does not present any cookies - that does not mean the browser does not know which website you're visiting - the username/password is fetched by the browser by matching which site you're on - not via cookies.

Improve this answer
3
  • They are stored in (roughly) the same place as cookies: your browser. The part of Chrome's incognito message you emphasize is irrelevant here: (just like disabling cookies) this is about the behaviour of your browser; not other people, not servers. Edited the question to clarify.
    – Wouter Coekaerts
    Jun 28, 2011 at 22:01
  • 1
    @WouterCoekaerts Cookie storage & password management are not comparable. The message is still relevant - you've misunderstood how the browser works. Edited.
    – Sathyajith Bhat ♦
    Jun 29, 2011 at 4:35
  • You seem to have missed @WouterCoekaerts' point: if the browser auto-fills the input[type='text'], is there a way for the webpage to retrieve that value? It could listen to the JavaScript onchange event, and then AJAX the value back to the server. I guess the inferred question is: Does Chrome Incognito still trigger the onchange event when it auto-fills?
    – Rikki
    Aug 28, 2014 at 9:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.