New: a threat-model-first guide to choosing your network defence, plus the nym-smoldvpn dVPN package and nym-swizzle sender hygiene.
Network
Threat Model
Worked Examples
Web Browsing

Web Browsing

Browsing a website means fetching pages by name. Each request carries a URL and often a query string. The site on the other end is the party you talk to directly, so it is the primary adversary.

What must not leak

The secret here is not your identity alone. It is your browsing history: the set of pages and queries, tied to a person. That history must not be attributable, and the requests must not group into one profile.

The threat model

The primary adversary is L2, the website or API. The dominant vector is V3 content: the URL and the query are the request, so the site reads which pages you fetch. Hiding your IP does not change that.

Browsing also faces an application-specific public observer.

L1Public-record observer
VantageReads public DNS and Certificate Transparency logs.
SeesWhich domains and subdomains exist, and the certificates issued for them.
Cannot seeWhich user visits a site, which pages they request, or request content.

The invariants a browser must hold:

InvariantStatementDepends on
A. History not attributableThe set of URLs and queries must not link to a person.P1, plus P2, plus V3 content discipline: the URLs name the content.
B. Requests not groupableThe site must not group requests into one profile.P2 exit rotation, plus V3 request-shape discipline.

Unprotected: the site reads everything

The browser talks to the website directly. The site sees the client IP, every URL and query, and the full request pattern. The history is attributed with no effort.

L2The destination❌P1❌P2

Sees

  • Real client IP
  • Every URL and query string
  • The full request pattern and content

Residual / countermeasure

  • The browsing history is attributed with no adversarial effort. This is the baseline network protection must improve on.
L3LLocal network observer

Sees

  • Endpoints, timing and volume of the page loads
L3GGlobal network observer

Sees

  • Endpoints, timing and volume (collapses with L3L on a direct connection)

Cons / mitigations

  • Needs IP hiding and exit rotation, then content discipline on the requests themselves

Fit

  • Baseline only: offers no protection

Protected: rotate exits, and the site still reads the URLs

Distinct WireGuard peers at several exits split requests across exit IPs. Per-request rotation unlinks requests at the transport layer, and browsing stays fast.

L2The destination✅P1✅P2

Sees

  • Requests arriving from many exit gateways
  • The exact URL, query string and body of every request

Can't see

  • Client IP
  • A complete per-client profile, for anonymous fetches split across exits

Residual / countermeasure

  • IP-hiding and exit rotation do not touch the dominant vector. The website reads which pages you request, because the URL and query are the request.
  • Any request that carries an identifier (a login cookie, a personalised query) re-links the session regardless of exit. Content discipline is a hygiene-layer job that transport cannot do.
L3LLocal network observer

Sees

  • Activity fingerprint: dVPN adds no cover and preserves packet timing
  • Page-load bursts that fingerprint which site is visited
L3GGlobal network observer

Sees

  • End-to-end flow correlation

Residual / countermeasure

  • The 2-hop route stops a single gateway linking client to website, but colluding gateways or a global observer still correlate.

Pros

  • The website sees traffic from many exit gateways, not the client
  • Fast dVPN speeds suit bulk page loads

Cons / mitigations

  • The website still reads every URL and query you request
  • No timing protection against network observers

Fit

  • Hides who you are from the website, not what you fetch
  • Pair with content discipline to protect the history itself
⚠️

The verdicts show P1 yes and P2 yes at the site, and that is only half the story. IP-hiding and exit rotation do not touch the dominant vector. The site still reads the exact URL and query of every request, because the content is the request. A login cookie or a personalised query re-links the session regardless of exit.

Transport hides who you are from the site. It does not hide what you fetch. Protecting the browsing history itself is a hygiene-layer job: discipline the request shape and strip the identifiers, work that no configuration does for you.

Where to go next

Private MessagingPacket Anatomy