Work 2 Different Logons (or Sessions) with Private Browsing Modes

Here’s a trick that’s fairly obvious to web developers but probably not so for everyone else.

Private browsing modes – such as Incognito (in Google Chrome) or InPrivate (IE 8) clear out locally stored browser cookies (snippets of tracking data) each time they are run, and do not share cookies with the main (non-private) browser tabs.

Since these cookies are the core mechanism by which web sites associate independent browser tabs/windows with a single user session, the private browsing modes can be used to interact with multiple different logons or accounts at the same time.

How does this work in practice?

Let’s say you want to interact with two totally different accounts (logons) at, say, Gmail, Yahoo, eBay, Orbitz, or some other site. You’ve probably noticed that if you are logged in to, e.g., Yahoo with one browser tab, and you open another window or tab in the same browser, and go to Yahoo, it will “know” who you are and allow you to interact with the same account.

In many cases, this is a desired behavior. But if you want to work with two different Yahoo accounts at the same time, it is quite tricky.

Here’s where the private browsing mode comes in.

Open a private browsing window/tab, and log on to Yahoo with the second account. Since the private tab doesn’t share cookies with the main tab, you now have two interactive sessions with the two different accounts, and they “stay separate.”

There are three catches though:

First, since the private browsing tabs are designed to discard cookies on shutdown, they will “forget” your logon when you close the browser even if you select “stay logged in” on a specific web site.

Second, it is possible (though unlikely) that this mechanism could fail if the site uses “Flash cookies” apart from regular cookies.

Third, while this trick works perfectly well, do not assume that the service you are connected to has no idea what you are doing. They probably don’t care. But if they do care, assume that they could guess that the same user was on both sessions (through IP addresses, NAT port assignment patterns, etc.) at the same time.