Show HN: Poisson – Chrome extension that buries your browsing in decoy traffic(github.com)

14 pointsby daringdesignshá 5 meses7 comments

Show HN: Poisson – Chrome extension that buries your browsing in decoy traffic

https://github.com/Daring-Designs/poisson-extension

I built a Chrome extension that generates noise traffic to dilute your browsing profile. Instead of trying to hide what you do online (increasingly difficult), it buries your real activity in a flood of decoy searches, page visits, and ad clicks across dozens of site categories.

  The core idea is signal dilution — the same principle behind chaff in radar countermeasures and differential privacy in data science. If you visit 50 pages today and Poisson
  visits 500 more on your behalf, anyone analyzing your traffic (ISP, data broker, ad-tech) sees noise, not signal.

  How it works:

  - Uses a Poisson process for scheduling, so timing looks like natural human browsing rather than mechanical intervals
  - Opens background tabs (never steals focus), injects a content script that scrolls, hovers, and clicks links to look realistic
  - Batches tasks within Chrome's 1-minute alarm minimum, dispatching at calculated Poisson offsets
  - Four intensity levels: ~18/hr to ~300/hr
  - Configurable search engines, task mix (search/browse/ad-click ratio), and site categories

  What it explicitly does NOT do:

  - No data collection, telemetry, or analytics
  - No external server communication
  - No access to your cookies, history, or real tabs
  - No accounts or personal information required

  Every URL it will ever visit is hardcoded in the source. Every action is logged in a live feed you can inspect. The whole thing is ~2,500 lines of commented JS.

  I know this approach has real limitations — it doesn't defeat browser fingerprinting, your ISP can still see the noise domains, and a sufficiently motivated adversary could
  potentially distinguish real traffic from generated traffic through timing analysis or behavioral patterns. This is one layer in a defense-in-depth approach, not a complete
  solution.

  Similar prior art: TrackMeNot (randomized search queries since 2006) and AdNauseam (clicks all ads to pollute profiles). Both from NYU researchers. Google banned AdNauseam from
  the Chrome Web Store, which says something.

  Code: https://github.com/Daring-Designs/poisson-extension

  Not on the Chrome Web Store — you load it unpacked. MIT licensed.

7 comments

legitimate_keyhá 5 meses

Interesting and smart approach - most noise generators are obviously artificial in their traffic patterns.

I've been thinking about browser privacy from a different angle: not hiding what you browse, but hiding what's visible on your screen when you share it. Screen sharing during video calls basically bypasses every privacy tool you have running (VPN, tracker blockers, etc.) because the other person sees your raw screen.

The layered privacy defense framing makes sense. This handles the ISP/tracking side. But what handles the "accidentally showed my email to my entire team during a screen share" side? Different threat model but equally common.

Congrats on shipping.

s_u_d_ohá 5 meses

Hey, smart one! - Why not allow the behavioral/timing intervals somehow random, with predefined threshholds? Just to simulate real user interactions. - Also, what’s the criteria for choosing those URLs? (Any security measures?) - Those URLs being visited are the same? i.e. you mentioned the URLs being visited are hardcoded, so eventually the ISP can filter our those URLs… unless if they are continuously enriched/interchanged.

daringdesignshá 5 meses

It does follow links as to randomize it some but yes the hardcoded list or urls is a limitation and possible pattern. This list can be changed and added to (accepting PR's).

daringdesignshá 5 meses

Just thinking, I'll make a feature to configure additional urls.

s_u_d_ohá 5 meses

Cool. Also, maybe a nice-to-have efficiency feature is to prevent the visited URLs from fully loading (to minimize excessive data consumption) — i dk if there’s a way to prevent JS from fully loading/downloading certain stuff.

victorbjorklundhá 5 meses

I wonder if it will ”flag” you in cloudflare and google so you will end up in captcha hell.

daringdesignshá 5 meses

I haven't seen that so far!