Session identity isolation

Identity isolation in BlackOps OS means that every signal an external party could use to recognize a returning client is scoped to a single session. This page enumerates the surface explicitly. The reason for the enumeration is that “incognito mode” is not the same thing. A typical browser private mode resets cookies and storage and stops there. The OS underneath continues exposing a consistent MAC address, a stable hostname, an NTP offset history, a DNS resolver, a TLS clock skew, and dozens of other signals an observer can use as a long-lived identifier without the browser’s involvement. Real isolation has to address all of them.

​

The surface, by layer

​

Hardware-derived identifiers

​

Kernel and OS-image identifiers

​

Network-layer identifiers

​

Userspace state

​

Application-layer signals (browser)

These are not OS-level identity isolation in the strict sense. They are the browser’s responsibility to clamp, but listing them here makes the boundary clear. See BlackOps Browser.

​

What is not isolated

Voluntary disclosures and user behavior remain observable. The OS does not flatten any of the following.

• Account credentials. Logging in links the session to that account for the duration of the session. The OS does not retroactively unlink.
• Content of communications. The transport is encrypted; the content is whatever the user sent.
• Reading patterns. Visiting the same niche sites in the same order across sessions is a behavior signal an external observer can use to correlate.
• Linguistic style. Stylometry can identify a user across pseudonymous sessions if the writing surface is large enough.

These are addressed by user practice, not by the OS.

​

What an observer can reconstruct

Two sessions started by the same physical device, on the same network connection, by the same physical user, present as activity from two unrelated clients on every surface listed above. What an observer can still do:

• Correlate sessions through voluntary disclosures (account logins, identifying form submissions).
• Correlate sessions through user behavior (content, timing, style).
• Correlate sessions if the observer has visibility on both the entry side and the exit side of Route, with timing analysis.

These boundaries are documented in the threat model.

​

Continue from here