Question: Wouldn't the real data be easy to differentiate?

[tinkerpunktheprol]

Your question

To start I just want to be clear that if this works like you've said, then this is one of the greatest privacy tools we have, not just on a personal level but for society as a whole. Data poisoning is our only real offensive weapon against this stuff. This software needs to continue no matter what. And not to get too conspiratorial, but I think it'd be unwise to not consider how the 'adversaries' mentioned might feel about this sort of thing. You are a literal saint for making this open source.

---

Ok, sorry about the rant. I'll delete it if you want. Just let me know. To my question:

Is the current implementation really enough to mask a users activities? If my false profile spends 34 seconds on a million websites and I spend hours on one, doesn't it become obvious where the real data is?

I have only a slightly above layman understanding of all of this, so I'm probably missing an important piece. Either way, cool project. I'll be using it no matter what, if only to clog up their databases. 😜

What have you tried?

No response

[digital-grease]

No worries on the rant lol

Plausible noise is doing real work even when it isn't indistinguishable from your real activity. The point is to make filtering it out expensive enough that the broker can't safely throw it away without losing real data too.

You're right that brokers session-stitch. GA4 does it, FB Pixel does it, dwell-time feeds Google's Quality Score. So your 34s vs hours asymmetry isn't invisible, But session-time is one signal among many, and the broker doesn't get to make a clean "trust or filter" call either. In practice they down-weight by IP reputation, score by ad-ID stability, corroborate via cross-device identity. Plausible noise raises the cost of every one of those checks. They can't cheaply filter it out, so they have to give it some weight even when they discount it. How much that helps you depends on the volume ratio you configure vs your real activity level.

The bigger limit is authenticated identity. Anything you do while logged into Gmail or Amazon or your bank is ground truth no amount of noise touches. Fauxx is calibrated for the unauthenticated web-tracking layer; it's on my to do list to investigate authenticated traffic, but that sort of thing would have to be bulletproof before release since there's potential for real harm there.