How does Hacker News remember my login between windows when I'm using Tor Browser?

Question

Somehow Hacker News (and maybe other sites) remembers my login despite my closing the windows and changing Tor routes. How? Here's what I do:

1. Start Tor Browser 7.0.2; open some websites in tabs.
2. Go to http://news.ycombinator.com, click Login, and then login.
3. Hacker News now shows my username at the top right. I also check the exit node by clicking the onion button.
4. Close the tab showing Hacker News. Tor Browser is still running with other sites loaded, but no tabs have Hacker News loaded.
5. Open a new tab, without changing identities, and load http://news.ycombinator.com.
6. Hacker News shows my username at the top right. Click the onion button to check the route and exit node: Sometimes no route is shown at all (?!); other times it shows a different route and exit than in step 3.
7. Check cookies: Tools > Options > Privacy shows: Always use private browsing mode and Accept cookies from sites are both checked. Click Show Cookies, which shows no cookies at all. Also, via NoScript, JavaScript is disabled for ycombinator.com (and no other hosts try to load any JS).

It seems to me that step 6 shouldn't happen. There is no cookie, and my IP address has changed. I'd be surprised if Hacker News uses browser fingerprinting or other tracking and I haven't seen signs of it ... but maybe I should be surprised. More likely, there's something I don't understand about Tor Browser.

Answer 1

As far as I know Tor browser will only remove (forget) cookies when closing/restarting the browser, including when using the New Identity option, not just the tabs. I assume the reason cookies aren't shown in the Cookies pane under Privacy options (it's the same for me btw, also on 7.0.2) is for security. The cookies will be there however, otherwise you wouldn't be able to successfully login to any sites to begin with - or at least would effectively get logged out as soon as you navigate to any other page on those sites. I was going to suggest you check if cookies are being sent via the Network Monitor under Web Developer Tools but actually I don't think that would confirm much. It's there if you're curious anyway.

I'm not sure if there's an option to have tor browser forget relevant cookies for particular sites when all tabs pointing to that site have been closed, but I haven't come across one and suspect it doesn't exist.

Edit; additional note: This is the same behaviour as for Incognito mode in Chrome btw - closing tabs will not forget cookies for those sites, until the Incognito session is ended (i.e. all Incognito windows are closed)