IPhone 5 Safari Faking "Private Browsing" Mode

Question

I recently posted in another forum about how suspicious click-through ads were appearing on my iPhone 5 within certain media web sites. Since I have never run Safari without “private browsing” mode being on; have always had “limit ad tracking” turned on; third-party cookies blocked;  and have geolocation and location services (for Safari) turned off, that should have been impossible. While the discussion participants had come up with some interesting possibilities, I realized that I had neglected to check the “Website Data” screen in iPhone’s Setup. So I just checked the web site storage. Got an unpleasant surprise when I was greeted with a screen-full of URL’s beginning with www.stayinvisible.com and carbonite.com. Tapped on “show all sites” and 100 or more URL’s scrolled by, among them many Apple web sites. Even found a competitor’s web site URL that should not have been there, since I’ve never visited their web site, nor any legitimate web site that would have hosted anything that would have set a cookie on this device.
Apple’s privacy policy with the current version of Safari for iPhone 5 (within IOS 7.1.2 11D257) is very clear:
"Private Browsing
When Private Browsing is enabled, Safari doesn’t remember the pages you visit, AutoFill information, and your open tabs aren’t stored in iCloud. Safari will also ask sites and their third party content providers (including advertisers) not to track you. Websites can’t modify information stored on your device, so services normally available at such sites may work differently until you turn off Private Browsing."
Apple stated that, “Websites can’t modify information stored on your device,…” yet I have in front of me proof that web sites CAN and DO modify information on my device while Safari’s “private browsing is on. This is very deceptive and a nasty way to treat customers who bought one of the most expensive PDA/smart phones on the market and now find that they have no web browsing security (Safari ignoring secure web site security certificate revocations, can’t detect bogus or malicious secure web sites), and apparently zero web browsing privacy, after Apple promised exactly the opposite.
Has anyone else finding that their web browsing security has been compromised with a recent vintage iPhone?

Answer 1

I’ve wiped the web cache several times since then. Several times I found more cookies in the web cache, at least once found over a hundred items, mostly for web sites I didn’t visit even once, but were all in my Safari bookmarks. Apparently, in addition to everything else going on, Apple appears to be rooting through my bookmarks without my permission.
Using Steve Gibson’s Cookie Forensics web page (https://www.grc.com/cookies/forensics.htm) I confirmed that web sites are able to save and retrieve cookie data from my iPhone with Private Browsing enabled. That violates Apple’s stated privacy policy.
The cookies that keep reappearing in the web cache, which also violates Apple’s stated privacy policy, apparently are leftovers from Safari crashes. I see five crashes in the past month, and crash logs for Safari going back to last year. Per my earlier post, after tapping the "delete" button, the cookies immediately disappeared, but then all came back at least once within a few seconds. That means IOS was hiding, and not deleting, the web cache when the "delete" button was tapped. The reappearing cookies are also only being hidden from the user, and become visible when a device crash prevents IOS from keeping the cookies hidden, since they've been in the web cache all the time.
I also see that other apps, like Podcasts, Stocks, and Weather are also writing or accessing items in the web cache, while “Private Browsing” mode has supposedly been “on.” The only thing “private” about “Private Browsing” mode is Apple deliberately hiding this activity from users.
Safari on IOS will allow web sites to track iPhone users regardless of an iPhone user’s device settings. Anyone who merely minimizes Safari between sessions, rather than killing the active Safari task, will find their device will act exactly the same whether “Private Browsing” is on or off. Safari might not prompt for, for example, a user name for a login, but if the web site stored a cookie with login info, it might already have you logged in (if a login were required for a particular page). And if a cookie were saved to the web cache after a device crash, Safari will again violate Apple's privacy policy and allow web sites to read and modify the cookies that were stored in the cache while "Private Browsing" mode were on. I confirmed that more than once.
Apple’s privacy policy for is a lie. Mobile Safari has no “Private Browsing Mode.”