During the last Usenix Security Symposium was presented a research by G. Aggrawal, E. Bursztein, C. Jackson, and D. Boneh. This research was published as a PDF and you can download it.

According to their research the “private mode” features offered by the major browsers (Internet Explorer, Firefox, Chrome and Safari) don’t work as promised.

In theory these features should let you to browse the Web without leaving any trace on your computer , but they don’t. For example when you visit a website that uses SSL security certification,also if you are using Firefox, IE, and Safari “private mode”, this visit will be recorded in a file on your computer.

In Firefox, the private mode leaves traces everytime you set preferences for a specific site or use a plug-in, an add-on, or visit a site that uses the HTML5 advanced features. Instead, Internet Explorer has a problem in those sites which carry query SMB for any reason.

More in general the problem is that these browsers don’t distinguish browsing sessions between private and “non-private”. So a specially crafted website can track who visit it in public mode or in private mode.

The authors of the research also found a way to allow a site to find out if the visitors use public or private mode just using an IFRAME and a bit of Javascript.

The researchers used this system to know in which situations users use private browsing feature. This feature is presented by manufacturers as a solution to buy gifts without the recipient knowing it in advance, although the researchers proved that this feature is mainly used to visit adult website. The real surprise is that the proportion of users adopting the private mode to visit adult websites is very close to the one of those who use it for shopping or browsing for generic topic: respectively 8% and 6%.

The other interesting aspect, found by researchers, is that there is much variability from browser to another browser: Internet Explorer users are those that less use this feature (2%, including pornographic sites). Safari users are at the opposite end with a 14%.

The problem is that researchers proved that this feature is not what you think it is and everything you do on the Web is recorded. So whatever you do online, you better know you are going to be observed and remember: you are not invisible.

This article was originally published by Paolo Attivissimo on his blog Il Disinformatico in italian language.