Privacy

Open a page and it loads files from companies you have never heard of. Each of those requests carries your address and your browser's answers.

Two unrelated sites load the same third-party file, so one company sees both visits and joins them. Neither site had to cooperate with the other.

Thirty-one hosts are blocked: analytics, ad exchanges, session recorders, crash reporting, mobile attribution. An entry matches the host and its subdomains.

Both engines read the same list, and the rule names every resource type. Leave one out and a click that navigates straight onto a blocked domain passes.

Forty parameter names come off the address before the request leaves: click ids, campaign tags, mail ids, analytics linkers.

A tracker that also carries a click id is blocked rather than cleaned and let through.

• Ad platform click ids

  fbclid, gclid, msclkid, dclid, ttclid, twclid, yclid, wbraid, gbraid, rdt_cid, ScCid, epik, igshid, mibextid, li_fat_id

  15

• Campaign tags

  utm_source, utm_medium, utm_campaign, utm_content, utm_term

  5

• Mail campaign ids

  mc_cid, mc_eid

  2

• Analytics linkers

  _ga, _gl

  2

• The professional-network set the cleaner started from

  trk, trkInfo, lipi, lici, src, trackingId, refId, eBP, recommendedFlavor, midToken, midSig, trkEmail, connectionOf, orig, anchorTopic, contextUrn

  16

WebRTC gathers candidate addresses, including your machine's address on your own network, and hands them to the page. No permission prompt is involved.

By default a profile with a proxy starts with a rule that keeps WebRTC from gathering addresses past the proxy. Real shows this computer's address on purpose, and an extension with the privacy permission can override the rule.

For a set of profiles that is the worst leak there is: ten profiles on ten proxies share one local address, and the group is tied together by it.

1. 1

   Run the leak test in your everyday browser

   The tool builds an RTCPeerConnection with an empty ICE server list, so nothing goes out, and lists the addresses your browser hands over unasked.

2. 2

   Run it inside an ARMANOS profile

   Launch a profile that has a proxy and open the same page in it.

3. 3

   Read the difference

   A changing name ending in .local is the browser hiding the address on purpose. A raw 192.168 or 10.x address is the value that ties your profiles together.

The browser is our own build, and the reporting is compiled out rather than switched off. Beacons are replaced in the page, because a beacon fires while a page is unloading.

The start page is served from loopback, so a launch is never announced to anyone.

The three tools named below compute inside your browser. There is no request out of any of them, and a stand fails if one appears.

The leak test asks the browser for its own candidate addresses with an empty server list. Pointing it at somebody's server would tell that server about you.

1. 1

   Measure your everyday browser

   Open the fingerprint check and copy the eight-character code.

2. 2

   Measure each profile

   Open the same page inside each ARMANOS profile and copy each code.

3. 3

   Count the repeats

   Paste all the codes into the counter on that page. Two profiles with one code look like one machine to a site.

4. 4

   Go deeper inside the app

   Test fingerprint in the profile menu runs the fingerprint self-test, up to 37 readings, against the browser that profile actually launches with, and scores it out of 100.