<story><title>Cookieless cookies (2013)</title><url>http://lucb1e.com/rp/cookielesscookies/</url></story><parent_chain><item><author>i_v</author><text>I was surprised to see that this tracking works across both regular and private browsing in Firefox (67.0.4 on macOS). I can see the number of visits increment and whatever message I&amp;#x27;ve saved on either side is displayed to both.</text></item></parent_chain><comment><author>soheil</author><text>It is creating a new session it&amp;#x27;s just that the server code uses a deterministic session key which is created based on your IP address and user agent. So as long as you use the same browser&amp;#x2F;IP combo you will get assigned the same etag, (at least user-agent is in there otherwise it would be extra trippy to load the page on FF and go to Safari and see the # visits&amp;#x2F;message displayed there too)&lt;p&gt;&lt;pre&gt;&lt;code&gt;  $etag = substr(sha1($secret . sha1($_SERVER[&amp;quot;REMOTE_ADDR&amp;quot;]) . sha1($_SERVER[&amp;quot;HTTP_USER_AGENT&amp;quot;])), 0, 18);&lt;/code&gt;&lt;/pre&gt;</text></comment>
<story><title>Cookieless cookies (2013)</title><url>http://lucb1e.com/rp/cookielesscookies/</url></story><parent_chain><item><author>i_v</author><text>I was surprised to see that this tracking works across both regular and private browsing in Firefox (67.0.4 on macOS). I can see the number of visits increment and whatever message I&amp;#x27;ve saved on either side is displayed to both.</text></item></parent_chain><comment><author>clinta</author><text>I just tested Firefox 67.0.4 and Chromium 75.0.3770.100 on Arch and both have the same behavior. Definitely not something I expected.</text></comment>