Show HN: Poisson – Chrome extension that buries your browsing in decoy traffic

14 points

4 months ago

I built a Chrome extension that generates noise traffic to dilute your browsing profile. Instead of trying to hide what you do online (increasingly difficult), it buries your real activity in a flood of decoy searches, page visits, and ad clicks across dozens of site categories.

  The core idea is signal dilution — the same principle behind chaff in radar countermeasures and differential privacy in data science. If you visit 50 pages today and Poisson
  visits 500 more on your behalf, anyone analyzing your traffic (ISP, data broker, ad-tech) sees noise, not signal.

  How it works:

  - Uses a Poisson process for scheduling, so timing looks like natural human browsing rather than mechanical intervals
  - Opens background tabs (never steals focus), injects a content script that scrolls, hovers, and clicks links to look realistic
  - Batches tasks within Chrome's 1-minute alarm minimum, dispatching at calculated Poisson offsets
  - Four intensity levels: ~18/hr to ~300/hr
  - Configurable search engines, task mix (search/browse/ad-click ratio), and site categories

  What it explicitly does NOT do:

  - No data collection, telemetry, or analytics
  - No external server communication
  - No access to your cookies, history, or real tabs
  - No accounts or personal information required

  Every URL it will ever visit is hardcoded in the source. Every action is logged in a live feed you can inspect. The whole thing is ~2,500 lines of commented JS.

  I know this approach has real limitations — it doesn't defeat browser fingerprinting, your ISP can still see the noise domains, and a sufficiently motivated adversary could
  potentially distinguish real traffic from generated traffic through timing analysis or behavioral patterns. This is one layer in a defense-in-depth approach, not a complete
  solution.

  Similar prior art: TrackMeNot (randomized search queries since 2006) and AdNauseam (clicks all ads to pollute profiles). Both from NYU researchers. Google banned AdNauseam from
  the Chrome Web Store, which says something.

  Code: https://github.com/Daring-Designs/poisson-extension

  Not on the Chrome Web Store — you load it unpacked. MIT licensed.

7 comments

The core idea is signal dilution — the same principle behind chaff in radar countermeasures and differential privacy in data science. If you visit 50 pages today and Poisson visits 500 more on your behalf, anyone analyzing your traffic (ISP, data broker, ad-tech) sees noise, not signal. How it works: - Uses a Poisson process for scheduling, so timing looks like natural human browsing rather than mechanical intervals - Opens background tabs (never steals focus), injects a content script that scrolls, hovers, and clicks links to look realistic - Batches tasks within Chrome's 1-minute alarm minimum, dispatching at calculated Poisson offsets - Four intensity levels: ~18/hr to ~300/hr - Configurable search engines, task mix (search/browse/ad-click ratio), and site categories What it explicitly does NOT do: - No data collection, telemetry, or analytics - No external server communication - No access to your cookies, history, or real tabs - No accounts or personal information required Every URL it will ever visit is hardcoded in the source. Every action is logged in a live feed you can inspect. The whole thing is ~2,500 lines of commented JS. I know this approach has real limitations — it doesn't defeat browser fingerprinting, your ISP can still see the noise domains, and a sufficiently motivated adversary could potentially distinguish real traffic from generated traffic through timing analysis or behavioral patterns. This is one layer in a defense-in-depth approach, not a complete solution. Similar prior art: TrackMeNot (randomized search queries since 2006) and AdNauseam (clicks all ads to pollute profiles). Both from NYU researchers. Google banned AdNauseam from the Chrome Web Store, which says something. Code: https://github.com/Daring-Designs/poisson-extension Not on the Chrome Web Store — you load it unpacked. MIT licensed.