Clean private tab on tab close

[hmrodrigues]

Did you search for similar issues before submitting this one?
Yes

Describe the issue you encountered:
When you close the last incognito tab, the browsing data is stored until the browser is restarted

Expected behavior:
Clean incognito browsing data on last incognito tab closed

• Platform (Win7, 8, 10? macOS? Linux distro?):
  Linux (Ubuntu 14.04) and Arch Linux
• Brave Version (revision SHA):
  0.12.15
• Steps to reproduce:
  1. Open Private Tab
  2. Open page that stores cookies (In my case Odoo that saves login and seleted database)
  3. Close Private Tab
  4. Reopen Private Tab and page.
  5. Page finds cookies and does autologin

[diracdeltas]

2 options

1. all private tabs that are open at the same time share the same session. when the last private tab is closed and then a new private tab is opened, the new private tab is in a new session. this would achieve @hmrodrigues's expected behavior.
2. each private tab has its own session

i feel that #2 is more intuitive behavior and also easier to implement

[diracdeltas]

related: #597

[diracdeltas]

@bbondy mentions the second option might be harder with tab opener relationships so we could try starting with option 1

[SilverPuppy]

Having private tabs spawned from links in other private tabs share a session with the tab which spawned them would be expected behavior to most users. Having each private tab use its own session regardless of its origin would be annoying because if someone were signed in in the originating tab, the newly-spawned tab would not be, which would at the least require another sign-in unnecessarily.

When a new private tab is opened manually, it should create a new session. It should share that session with all tabs descended from the original tab or its children. When the last tab in the private session is closed, that session should cease to exist. Other private tabs with different sessions should keep their own sessions alive until the last tab in the session is closed.

From a privacy standpoint, option 2 is definitely preferable to the current implementation, provided that it is amended slightly to read "each private tab has its own session WHICH IS DESTROYED WHEN THE TAB IS CLOSED."

Also, kudos for getting back to this.

[diracdeltas]

@bbondy mentions the second option might be harder with tab opener relationships so we could try starting with option 1

oops, i originally switched options1 and 2 in this comment. it's been corrected.

[NumDeP]

I'm curious, would the same set of rules apply to TPB as well? #1185

I don't mean to go off topic but I mention this specifically as I think it does sort of pertain to this issue, particularly your 2nd option of each private tab having it's own session that is if you do apply the same rules to the TPB tabs as well when it comes to it during or after 1.2. #1185
I'm basing this on the fact that users not wanting to make cookies and such traces available on the new (session) tab but then if the content of each tab is related to each other I don't see what the point of it would be.
Personally, I very rarely open more than a hand full of tor tabs if or whenever I do use it but don't you think this will just exacerbate it more in Brave?

It will be interesting to ascertain how you juxtapose the New Tor Circuit on top of the private tab or will the overall menu be changed to consolidate it?

I suspect having the same session (as well as sharing the same IPs) from the first tab on each New Tab after seems better unless a users selects New Private Session. At least from a privacy context it does seem better because having a different set of IPs for each New Tab depending on what a user may be doing could be damaging.

There was an interesting report made by a German duo where they analysed mechanisms and lengths to which industries go to de-anonymizing user data.
The researcher Dewes called it, “combinatorial deanonymization”, based on earlier research...published in 2007. This takes advantage of the fact that you only need around 10 URLs to identify someone uniquely – it turns out that people are very different in their browsing habits. So if there is additional information available that links data in those URLs to an identity, it is likely that all of the other URLs also relate to that person too.'
I can't speak too much about the validity of it, only I hope it isn't as accurate as it states though you're probably already aware of it.
The report is available on PIA's blog and here - https://community.brave.com/t/browser-extensions-disclose-personal-data/5305

Sorry for boring you; you're welcome to delete this comment if you don't think it aligns with the issue at hand. Thanks.

[bsclifton]

Moving to 0.21.x since we aren't using Muon 4.6.x yet

[diracdeltas]

@NumDeP Tor Private Tab will be a new tab type, independent of private/session tabs as they are currently implemented. There will be no such thing as 'TPB New Session Tab'; i imagine there will just be a menu item for 'New TPB Tab'.

My initial thinking on this was that TBP tabs would share the same session state but run in different Tor circuits (same to how tabs in Tor browser work right now). If a user wanted to clear all session state and use fresh circuits, there would be a 'New Identity' button.

[LaurenWags]

+1 via email