Research
Measurement first, conclusions second.
Studies, datasets and teardowns from the Northsline team. Everything here is published in full: method, apparatus, raw counts and the parts that did not work.
-
Fingerprint resistance in modern browser stacks
We re-measured canvas, audio and font enumeration across nine browser builds to see whether entropy claims still hold after several years of incremental mitigations. Entropy is still high, but it is concentrated in fewer surfaces than defenders assume.
-
A field study of home router DNS logging
Over eleven weeks we logged resolver traffic from volunteer households in four countries. Median retention before rotation was longer than most published guidance assumes, and secondary routers were the single largest source of unexpected queries.
-
Tracker detection recall on shared networks
Detection lists are usually evaluated per device. We evaluated them per household instead, and found recall drops sharply once a second device on the same network is also phoning home. The dataset and scoring script are released alongside.
-
Measuring third-party script chains
Static call-graph analysis of script loading on the top thousand sites, tracing how far a single third-party dependency propagates before hitting a first-party boundary. The tail is longer, and less owned, than most teams believe.
-
Pedestrian traffic patterns in anonymity networks
Timing shapes in low-latency anonymity tooling remain distinguishable from padded baselines, and the padding that defeats one detector tends to inflate latency enough to stand out under another.
-
The practical cost of onion routing in rural deployments
Circuit construction over congested last-mile links dominates end-to-end latency. We quantify the tradeoff across three tunnel configurations and identify where pre-sealed circuits pay for themselves.
-
Passive traffic fingerprinting on consumer hardware
What can be inferred from packet sizes alone, using only commodity hardware and no decryption. Results are narrower than the headline claims in prior work, which we think is the more useful result.
-
Shutdown cascades in darknet markets
Seizures rarely end with the seized host. We tracked how vendors, payment rails and buyers re-converge within weeks, and published the indicator set so defenders can watch the same transitions live.
Open access Nothing on this page is gated behind an account, and we do not run trackers to read it.