I agree with your critique of DNT, but private browsing isn't magic, there's plenty a bad actor could do to track you regardless of what you throw away at the end of the session, which means the same critique applies (unless you're using it for it's intended purpose, privacy from other users of your computer, and even then it's got holes).
Current implementations of private browsing just throw everything away at the end of a session. That doesn't prevent cross site tracking during a session. If you start up a browser in private browsing mode, then log in to Facebook and visit some site with a like button on it. Facebook still knows you visited that site. At least, I think that's how it works.
Thanks. So a better implementation should perhaps instantiate a different session for each browser window (sharing the same session for the tabs in the same window). The user should also avoid logging in to any service linked to a known profile.
A better implementation would be one which instantiates a different session not on a per window basis, or even a per tab basis, but on a per "domain in address bar" basis.
And by session, this wouldn't just be the cookie store, it would also be the cache store and everything else which can be manipulated for tracking purposes.
EDIT: I'd also want it clearing between browser restarts too.
If this became (over night) the default standard way for browsers to behave, the vast vast majority of websites (at least 99.9% I'd guess) would continue to work without issue and it would pretty much annihilate nearly all privacy/tracking issues on the web.
Stuff like Google Analytics would continue to be able to work, but wouldn't be able to gather as many different types of information. Advertisers would be able to continue to advertise, but they would lose the ability to track you across sites, which potentially might hit their revenue a bit.
Well, I was thinking that cross site authentication would be impossible in case of per domain session, but yes, a completely new anonymous user profile directory should be created.
Why would it be impossible? If you need to completely pass the user off to a different website temporarily, you should add the challenge/response data to the query string or post parameters. Cookies not required.
The fact that Flash had it's own cookies that weren't cleared by private browsing modes was a big story (don't know if they've fixed that yet) but there's a general problem of Zombie Cookies (as long as one ID method works the others can be recreated) and Panopticlick (ID you uniquely based solely on the random info, like installed fonts, sent to the server by your browser).
