Private browsing, a.k.a. incognito mode, is useful for more than just porn. It can protect you against sites (including online banks, health sites, and insurance companies) that are storing your sensitive data on your hard drive when they shouldn't be.

When you visit a site that uses the HTTPS or SSL encryption protocol to protect sensitive data, you might expect that sensitive information to be cleared once you close the browser. You know, things like your customer account number, account balances, prescription history, canceled checks images, statements, credit reports, and more.

Unfortunately this isn't the case, according to a recent study by security firm Independent Security Evaluators. They found that twenty-one of the thirty sites evaluated (70%)—including Verizon Wireless, PayPal, Allstate, Equifax, and Scottrade—are saving sensitive data to users' disk caches.


That means if you ever share your computer with someone else, or if your laptop is stolen, that data is completely unsecured. According to ISE:


The sensitive information is stored on your computer and easily retrievable (even if you didn't know it's saved to disk).


The problem stems from the way browsers and web servers communicate about caching content to disk. Web servers—especially the financial ones we're talking about—are supposed to send a standard "Browsers Control: no store" header to tell browsers not to cache the content. ISE found that some don't send any caching instructions. Others do send a "no cache" header, but are using antiquated, non-standard instructions that only work with Internet Explorer and not Chrome or Firefox. All three browsers enable disk caching by default even for HTTPS sites, rather than letting you opt-in. So, in short, there's plenty of blame to go around between the browsers and the websites themselves.

There are two things you can do to prevent your sensitive information from being saved to disk: The easiest is to just use private browsing mode for your financial and similar sensitive accounts or restrict disk caching for encrypted sites.

Alternatively, ISE offers these recommendations:



Firefox. Install our “HTTPS Caching Controller” Firefox add-on, which adds a toolbar button allowing disk caching of SSL content to be disabled or enabled at any time. This add-on works only on the desktop version of Firefox. Manually, or on the mobile version, navigate to "about:config," enter the preference "browser.cache.disk_cache_ssl," and double-click to switch the value from "true" to "false." Alternatively, use Private Browsing mode.




You could also clear your browser's cache whenever you close it or on a schedule. For example, you could run CCleaner after browsing or create a cleanup script to run after your browsing session. Firefox users can set their browser to automatically clear the cache when the browser closes and Chrome users can use the Click & Clean extension to do this. Here are instructions on WikiHow for clearing the cache manually for all browsers. This, however, wipes out everything cached by your browser, including stuff from regular HTTP sites.

Until browsers and web servers get their act together, it's better to be safe than sorry and keep your sensitive info safe from being saved to your computer unencrypted.

Industry-wide Misunderstandings of HTTPS | Independent Security Evaluators via LA Times