Use this file to discover all available pages before exploring further.
Identity isolation in BlackOps OS means that every signal an external party could use to recognize a returning client is scoped to a single session. This page enumerates the surface explicitly.The reason for the enumeration is that “incognito mode” is not the same thing. A typical browser private mode resets cookies and storage and stops there. The OS underneath continues exposing a consistent MAC address, a stable hostname, an NTP offset history, a DNS resolver, a TLS clock skew, and dozens of other signals an observer can use as a long-lived identifier without the browser’s involvement. Real isolation has to address all of them.
These are not OS-level identity isolation in the strict sense. They are the browser’s responsibility to clamp, but listing them here makes the boundary clear. See BlackOps Browser.
Surface
Per-session behavior
TLS handshake fingerprint (JA3-class)
Browser ships a profile consistent across users.
HTTP/2 SETTINGS, header order, priority frames
Normalized by the browser.
User-Agent, navigator properties
Set to a value consistent across the BlackOps Browser population.
Two sessions started by the same physical device, on the same network connection, by the same physical user, present as activity from two unrelated clients on every surface listed above.What an observer can still do:
Correlate sessions through voluntary disclosures (account logins, identifying form submissions).
Correlate sessions through user behavior (content, timing, style).
Correlate sessions if the observer has visibility on both the entry side and the exit side of Route, with timing analysis.
These boundaries are documented in the threat model.
