I manage a couple of twitter accounts for businesses/websites that are separate from my personal account. For simplicity, I prefer to log in from an incognito window so that I don't need to log out of my primary (personal) twitter account.
I was shocked when I recently logged into one of the secondary accounts in an incognito window, closed the window, and later was logged into that secondary account when visiting twitter in the non-incognito main window.
I did some testing, and found that the auto-login occurs regardless of whether I'm currently signed in to twitter or not in the main browser session, any time I sign in via the incognito window. If I leave the incognito window open and log into a different account, the primary browser session also switches to that twitter account.
After some additional poking around, I decided to disable any extensions I had enabled in incognito mode, to determine if that was related. The problem disappeared with all extensions disabled. The only 2 extensions I had given permission to operate in incognito mode were Adblock and HTTPS Everywhere. I enabled each of them individually, and the problem only occurs when HTTPS Everywhere is enabled. I further established that the problem only appears to happen on Twitter. Logging into a different Facebook, Gmail, or Reddit account in incognito mode (with HTTPS Everywhere enabled) did not affect the login status in the primary browser session.
Obviously, this is a security concern, especially for a privacy-oriented extension to be leaking session data. Specifically, I am wondering:
- How does HTTPS Everywhere help Twitter escape the incognito mode "sandbox"?
- Why does this happen with Twitter but no other sites?
- In what ways could a malicious website exploit this bug to steal or alter user credentials?
Note: this does not happen in Firefox using Private Browsing Mode with HTTPS Everywhere enabled.