Steps to reproduce
- Add more than one language/keyboard layout on Windows 8 or newer and visit a website. Regardless of the InPrivate mode, the Accept-Language header can be used to track users.
- Open IE and open F12 network tool and click start capture
- Load a webpage
- Look at the Request header details on the GET request you will see “Accept-Language”
Repeat the steps above with IE running InPrivate
The InPrivate mode to not reveal language list to the websites. Currently the Windows settings is all-or-nothing but clearly suggests the list is a concern of privacy. It is not very difficult to end up with a language list (i.e. Accept-Language header) that helps to identify, or even uniquely identifies the visitor.
Comments and activity
- Microsoft Edge Team
Changed Assigned To to “Tony S.”
Changed Assigned To from “Tony S.” to “Warren S.”
Changed Assigned To from “Warren S.” to “Swathi G.”
Changed Status to “Confirmed”
Changed Assigned To from “Swathi G.” to “IE F.”
Changed Status from “Confirmed” to “Won’t fix”
Changed Assigned To to “Bogdan B.”