Hmm, according to panopticlick, my Chrome provides about 70 bits of identifying information. There are about 2^33 people. I don't feel incognito.

70 bits? That's a ton. I'm at:

  17.62 Chrome 75.0.x normal (non-incognito)
  16.62 Chrome 75.0.x incognito
  15.62 FF 68.0.1 (Private doesn't seem to make a diff, I get the same score)

Seems like in Chrome, at least, the most offending (most unique) "characteristic" is HTTP_ACCEPT Headers, which looks something like

  text/html, */*; q=0.01 gzip, deflate, br en-US,en;q=0.9,fr-FR;q=0.8,f...

If there is a good way to control this (FF does a much better job -- could be tied to plugins and such tho), one could further reduce the number of identifying bits.

Chrome seems to do better (less unique) in both Hash of canvas fingerprint and Hash of WebGL fingerprint. I've summarized the main differences I see below, seems like combining the best of Chrome w/ the best of FF would result in even better privacy:

https://i.imgur.com/QQQ6R85.png

Edit: I think Chrome's HTTP_ACCEPT Headers is like that because I've installed/enabled many languages in it for l10n testing. I'm removing them now, which should make Chrome get a better score than FF.

FWIW, I've not taken the number quoted by the website ("at least x bits", which appears to be the maximum of the per-characteristic numbers, which sort of assumes that the characteristics are fully dependent (such that knowing further characteristics does not tell you anything beyond that one maximally informative characteristic)), but the sum of the per-characteristic numbers (which sort of makes the opposite assumption that the characteristics are fully independent, and knowing all the other characteristics does not reduce the information added by any one characteristic).

So, the true number is somewhere in-between.

In my experience the biggest entropy generator with browser fingerprinting in system fonts. I ran Panopticlick against both my Firefox browser instance (running Ghostery, uBlock Origin, and Privacy Badger) against a Chromium instance running no plugins and both cases yielded 17 bits from browser fingerprinting. It makes me curious whether system fonts are a major source of privacy leakage.

What do you mean by 'secure'? I just ran panopticlick in a fresh installation of Chrome on Windows in incognito mode. It returned a near-unique fingerprint with >14 bits of estimated entropy.

Of course, that makes total sense, because many of the factors that can identify your system have little to do with the browser, but are determined by the underlying system: fonts, display, date/time information, graphics fingerprints, etc.

That's really cool! Who knew Chrome was doing so well?

The second article CiPHPerCoder linked seems to be more focused on the VPN marketing aspect. A more interactive approach might be https://faq.dhol.es/@Soatok/cryptography/which-vpn-service-w...

Are there differences in how Chrome and Chromium handle incognito? Chromium appears to have a pretty unique fingerprint.

https://ibb.co/9ZB3Yxr

its because google wants exclusive access to your browsing data.