How your traces leak
A leak is rarely one fatal bug. It is correlation across layers: one item alone proves nothing — together they name a person.
Six layers: IP and ASN, DNS, WebRTC, device fingerprint, TLS fingerprint, behaviour. The first three are hard leaks exposing real location; the rest give you away by entropy. What works is consistency between layers and lower correlatability.
Six layers
| Layer | Leaks | Seen via | Grade |
|---|---|---|---|
| 1 · Network | Exit IP, ASN type, IPv4/IPv6 | Source address | Hard |
| 2 · Resolution | Resolver, subnet, resolver vs exit | DNS path, ECS | Hard |
| 3 · UDP | Public IP, LAN address, NAT type | STUN, ICE | Hard |
| 4 · Device | GPU, fonts, canvas, timezone, language | Plain JS | Soft (entropy) |
| 5 · Protocol | TLS parameters, HTTP/2, TCP | Handshake | Soft (strong) |
| 6 · Behaviour | Typing rhythm, hours, style, naming | Telemetry | Soft (hardest) |
Layer one: IP and ASN
An IP exposes geography, network type (residential, mobile, cloud) and who shares the exit.
IPv6 often does not follow. Many tools proxy IPv4 only, so a dual-stack site reaches you directly. Test it separately.
ASN type discriminates more than country. A country can be dressed up; a datacenter cannot pass as home broadband, and many accounts on one ASN look suspicious.
Self-test
curl -s https://www.cloudflare.com/cdn-cgi/traceip= is the exit, loc= the country, warp= WARP. Compare proxy off and on; the difference is what it took over. IPv6: test-ipv6.com.
Proxy both stacks and match the exit type to your claimed location. Limit: an IP is shared; you inherit others' history.
Layer two: DNS resolution
A DNS leak means what you looked up became known to someone you did not choose: the network, your ISP, a third party.
- System resolver → ISP: pages proxied, DNS to the ISP, so the sites are exposed.
- System resolver → DoH: encrypted, but the provider sees your real IP and every query.
- Inside the tunnel: the only shape where resolver and exit agree.
EDNS Client Subnet. Resolvers attach your subnet prefix — not the whole IP — so CDNs answer nearby. It leaks a subnet and breaks consistency: a Los Angeles exit with ECS from elsewhere leaves CDN node, latency and certificates wrong. RFC 7871.
Self-test
dig +short TXT o-o.myaddr.l.google.com @ns1.google.comIt returns the IP the query was sent from; anything but your exit is a leak. browserleaks.com/dns or dnsleaktest.com shows the resolver's country.
Limit: DoH encrypts what you asked, not who asked.
Layer three: WebRTC and STUN
WebRTC asks a STUN server your public address to traverse NAT, then publishes it in ICE candidates — over UDP that bypasses an HTTP proxy.
- srflx: the public IP STUN saw — the real exit, the leak most quoted.
- host: once the LAN address; modern browsers use an mDNS name — mitigation, not removal.
- NAT type, candidate count: extra entropy.
Chromium's WebRtcIPHandlingPolicy can disable non-proxied UDP, routing WebRTC through the proxy — common in enterprises, but it degrades calls.
Self-test
At browserleaks.com/webrtc, Public IP should equal the exit; Local IP should be an mDNS name.
Layer four: browser and device fingerprint
No permission needed: a few dozen lines of JS. The power is combined entropy.
| Signal | Read via | Entropy | Changeable |
|---|---|---|---|
| Canvas | Pixel hash | Very high | GPU, driver, fonts |
| WebGL | UNMASKED_RENDERER_WEBGL | Very high | Names the card |
| AudioContext | Float output | High | Implementation-specific |
| Fonts | measureText | High | Installed fonts |
| Screen, DPR | screen, devicePixelRatio | Medium | Easy to mismatch |
| CPU cores | navigator.hardwareConcurrency | Medium | Reveals the count |
| Device memory | navigator.deviceMemory | Low | Coarse |
| Timezone | Intl.DateTimeFormat() | Medium | Most forgotten |
| Language | navigator.language(s) | Medium | Separable from region |
| UA, Client Hints | navigator.userAgentData | Medium | Replaced the UA |
| Media devices | enumerateDevices() | Low | Labels need permission |
Self-test
Cover Your Tracks gives bits of identifiability, AmIUnique a uniqueness rank, BrowserLeaks the raw values where contradictions show.
Isolate sites in containers, or shed distinctiveness: custom fonts, odd resolutions. Randomising every item fails: random sets sit at the edge of device space, more conspicuous than an ordinary setup.
Layer five: TLS and protocol stack
No script reads this; it is collected passively during the handshake.
- JA3/JA4: version, cipher order, extensions, curves, hashed from the ClientHello.
- HTTP/2: window size, streams, frame order.
- TCP/IP: TTL, window scaling, MSS.
Browse normally and the fingerprint is the browser's; a local proxy client makes it that client's. A Chrome claim with a Python handshake is a contradiction.
Layer six: behaviour and content
The first five can be changed with tools; this one cannot.
- Hours: activity settles into one timezone's working day.
- Input rhythm: keystroke intervals, mouse paths, dwell time.
- Writing style: word choice, punctuation, mixed languages.
- Naming habits: the same handle, bio line or avatar hash.
- Entities: private repo paths, window titles, author fields, EXIF.
Erasing this is discipline, not technology: share no habit between identities.
The contradiction matrix
One item is harmless; two that disagree raise identifiability.
| Contradiction | Why it stands out | Fix |
|---|---|---|
| US exit, timezone Asia/Shanghai | No user carries a stale timezone | Follow the location |
| Datacenter ASN, "home network" | ASN type is hard to fake | Change the exit type |
| IPv4 proxied, IPv6 direct | Two addresses, one owner | Proxy both stacks |
| WebRTC public ≠ exit | Two addresses in one session | Tighten WebRTC |
| Resolver A, exit B | CDN and certificates go odd | Match resolver to exit |
| UA Windows, GPU Apple | That combination cannot exist | Be consistent overall |
| Chinese language, US dates | Two settings, two worlds | Native language, local format |
How far erasure reaches
The levels differ hugely; "erasure" only fits the first three.
| Level | Method | Blocks | Does not block |
|---|---|---|---|
| L1 Cleanup | Sign out, clear storage | Local state | IP, DNS, WebRTC, fingerprint |
| L2 New exit | Proxy or VPN | IP and ASN | DNS/WebRTC leaks, TLS, behaviour |
| L3 Containers | Profile per site | Cross-site stitching | Correlation inside it |
| L4 Anti-fingerprint | Dedicated browser | Most JS entropy | Protocol stack, behaviour |
| L5 Anonymity network | Tor-class design | Exit-to-origin link | Behavioural de-anonymisation |
Self-test checklist
Each has a pass criterion.
- IPv4 exit: does
ip=match your exit - IPv6 exit: does
curl -6agree - ASN type: residential or mobile, not cloud
- DNS source: does
digreturn your exit - DNS location: resolver country equals exit country
- WebRTC public: Public IP equals exit IP
- WebRTC local: mDNS name, or private address
- Timezone: plausible for the exit country
- Language, region: native language, no clash
- GPU, platform: WebGL renderer and UA agree
- Uniqueness: Cover Your Tracks bits, AmIUnique rank
- TLS: handshake changes via a local client
Six common misjudgements
- "Private mode means invisible": it clears local state.
- "A VPN means no leaks": DNS and WebRTC bypass the tunnel.
- "Changing the UA is subtler": it adds a contradiction.
- "Random fingerprints are safer": they raise uniqueness.
- "DoH equals privacy": the provider sees who asked.
- "A new device is clean": same behaviour, accounts, payments.
Boundaries and ethics
- Self-protection and self-testing: where your data leaves, and how to cut it. Not a route to fake identity or fraud.
- There is no complete erasure. Anyone promising invisibility deserves suspicion.
- Compliance risk is yours. Misrepresenting location can breach platform terms.
Sources
| Content | Type | Source |
|---|---|---|
| Identifiability bits | Authoritative | Cover Your Tracks |
| Raw values, tests | Tool | BrowserLeaks |
| Uniqueness rank | Dataset | AmIUnique |
| Resolver origin | Tool | DNSLeakTest |
| EDNS Client Subnet | Protocol | RFC 7871 |
Does private browsing hide me?
No. It clears local cookies, cache and history; IP, timezone, fonts and GPU stay identical, so the server still sees you.
Does a VPN remove DNS leaks?
Not necessarily: queries can bypass the tunnel, or be forwarded to a resolver in the exit country. Test who sends the query with dig +short TXT o-o.myaddr.l.google.com @ns1.google.com.
Is randomising my fingerprint safer?
Usually worse. Random combinations exist on no real device, so you end up more unique than an ordinary setup.
Does this site's tool check DNS or WebRTC leaks?
No. It measures exit, country, timezone, language, platform, cores, engine and location only; DNS and WebRTC are not tested.