Fri 31st May

This is still in the draft stage.

Introduced in Chrome XX (which hit stable release in YY), Chrome on Android can be launched directly into Incognito mode.

Launching

Doing so is simple - you craft an Android Intent with the org.chromium.chrome.browser.incognito.OPEN_PRIVATE_TAB action, for example:

Intent intent = new Intent("org.chromium.chrome.browser.incognito.OPEN_PRIVATE_TAB");
startActivity(intent);

TODO: Create gif

Restrictions

There are however two complicating factors to be aware of.

It may be disabled

Just because the user has Chrome installed doesn’t mean that this Intent will be answered - and firing an Intent that Android can’t handle is a easy way to throw an exception. Possible reasons for the this are:

• The user has Chrome disabled.
• The user has an old version of Chrome.
• The user is unable to use Chrome Incognito (Incognito can be disabled for child accounts or work accounts).
• The user hasn’t signed Chrome’s Terms of Service.

Expanding on the last point, it seemed like a bad user experience for them to press an “Launch Incognito Search” button in some app and then, while expecting to start private browsing they be given Chromes Terms of Service.

Other browsers

If the user has other browsers installed that answer to this Intent, they could be launched instead. Which browser is chosen is based on Android - so if the user’s default browser is not Chrome that would be picked instead.

This is a good thing if the user has other legitimate browsers installed, however if you are putting this code in your app beware that any Android app on the user’s device could be triggered.

TODO: Give a code example here.

Can’t provide a URL

The biggest restriction of this feature is that you can’t launch an Incognito Tab to a certain URL, you can only launch a new Incognito Tab and then let the user type their own search term. The reason for this is to do with security.

The way Incognito works is that it removes all trace of what you’re doing once you’re finished using Incognito. However this only happens once the last Incognito Tab has been closed. If you open an Incognito Tab, log into your favourite video site then open a second Incognito Tab, you’ll be logged in in that second Tab. This is kind of what the users expect, but it has the consequence that if you open an Incognito Tab, log in, forget about that Tab somewhere and then open an Incognito Tab a week later, you’ll still be logged in.

On desktop Chrome, you can have multiple user Profiles and so you could have isolated Incognito sessions, but unfortunately on Chrome on Android there’s only one Profile and only one Incognito Profile.

So, if we were to allow developers to launch Incognito with a URL, the following could happen:

1. User has a Reddit app installed on their phone, logged in as ILovePuppies.
2. They have an alternative account (ActuallyPreferCats) which they only use through Chrome Incognito.
3. They have an Incognito session (as ActuallyPreferCats) open on their phone.
4. Reddit launches an Incognito Tab providing the url www.reddit.com/blah?user=ILovePuppies.
5. They see that someone logged in as ActuallyPreferCats visit that URL and can now associate that the accounts come from the same person.

In this situation, Chrome has let information about what the user does in Incognito leak.

More reading

The main Chromium class responsible for this logic is the IncognitoTabLauncher.