Network

What Is Technical Information Correlation?

IP, DNS, cookies, User-Agent, WebRTC, login state, browser state, devices, and operations can combine into identification risk.

In anonymity, technical information from communication and devices is important, not only post content and writing style.

IP address. DNS queries. Cookies. Browser information. WebRTC. Login history. Device and app identifiers.

These are not pieces of information that the user wrote directly. However, they become clues that indicate the same person or the same environment.

This article organizes how technical information correlation relates to anonymity.

What Technical Information Correlation Is

Technical information correlation means combining communication and device information to infer that activity may come from the same user or the same environment.

For example, even if you change your IP address with a VPN, if the same cookie is sent, it is treated as the same browser. Even if you delete cookies, if the browser fingerprint is similar, the appearance of the same environment remains. Even if you change the communication route, logging in to the same real-name account connects the activity to you.

In anonymity, looking at only one piece of technical information is not enough. You need to look at combinations.

Information	What it indicates	Caution
IP address	Source network	VPNs and Tor change how it appears, but other information remains
DNS query	Queried domain	It may leak separately from the communication route
Cookie	Same browser	Repeat visits can be recognized even if the IP changes
User-Agent	Browser and OS	Becomes a characteristic of the usage environment
WebRTC	Communication route and local information	Depending on settings, it can cause leaks
Login history	Account use	Strongly links to the person

IP Alone Is Not Enough for Judgment

IP addresses are important. The destination website usually sees the source IP address.

However, anonymity is not determined by IP address alone.

If you use a VPN, the IP visible to the destination changes to the VPN server. If you use Tor, the destination sees the IP address of a Tor exit node.

Even so, if cookies, login state, browser information, and post content remain, they can be correlated.

The article "Hiding your IP is not enough for anonymity" covers this point in detail.

DNS and WebRTC Leaks

Even if you change the communication route, DNS queries or WebRTC may send information through a different route.

DNS is a mechanism for converting domain names into IP addresses. Even if you think you are using a VPN, if only DNS queries go out through the normal ISP side, the domains you tried to view can be seen.

WebRTC is a mechanism for real-time communication in browsers. Depending on settings and environment, it can cause unintended network information to become visible.

Type	What happens	What to check
DNS leak	Domain queries go through an unintended route	VPN and browser DNS settings
WebRTC leak	Communication route or device-side information becomes visible	Browser settings, extensions, tests
Return to normal connection	Communication goes through the normal network connection when the VPN disconnects	Kill switch, connection state
App-specific leak	Only some apps go outside the VPN	Whether protection applies to the whole device or per app

DNS leaks and WebRTC leaks are covered in detail in separate articles.

Browsers and Devices Also Become Clues

Technical information is not only network information. Characteristics of browsers and devices are also used for correlation.

User-Agent, screen size, language, time zone, fonts, Canvas, WebGL, extensions, and similar information become materials for browser fingerprinting.

If you continue using the same device, same browser, and same extensions, the appearance of the same environment remains even if you change the communication route.

When thinking about anonymity, you need to separate the browser used for real-name activity from the browser used for anonymous activity. In high-risk situations, also consider separation at the device or OS level.

When separating browsers, separate not only visible bookmarks but also internal state.

Cookies, local storage, extensions, saved passwords, notification permissions, and logged-in accounts mix together the more you use the same browser. Even opening a real-name service once in an anonymous browser brings real-name-side information into that environment.

Information inside the browser	Cause of correlation
Cookie	Repeat visits from the same browser can be recognized
Local storage	Site-specific identification information remains
Extensions	Become characteristics of the environment
Saved login	Links to a real-name account
Notification permission	Sites used in everyday life may be visible

Login Is the Strongest Correlation

Among technical information, login state is an especially strong clue.

The moment you log in to a real-name account, that behavior becomes linked to the account. Even if you use a VPN or Tor, the account you logged in to indicates the person.

Email, social media, cloud services, shopping sites, payment services. These hold personal information and histories.

Mixing anonymous activity and real-name logins in the same environment greatly weakens anonymity.

Technical Information Mixes Through Operations

Technical information correlation happens not only through setting mistakes, but also during everyday operation.

Viewing real-name email in an anonymous browser
Creating an anonymous account on a real-name device
Posting anonymously while the VPN is disconnected
Saving anonymous files in the same cloud
Using the same extensions for anonymous and real-name use
Registering the same recovery email

All of these become causes of correlation.

In anonymity, technical settings and operational rules need to be considered together rather than separately.

Check From the Outside

When checking technical information, it is important not to trust only your own settings screen.

Even if a VPN app says it is connected, DNS may be going through another route. Even if you think you changed browser settings, another app may be communicating over the normal connection.

Place to check	What to look at
IP visible to the destination	Whether it is going through the intended VPN or Tor route
DNS	Whether queries are going through the intended route
Browser	Whether cookies and login state are mixed
Apps	Whether non-browser communication is leaking
Files	Whether metadata or cloud history remains

Technical information correlation cannot be prevented by one settings item. Check communication, browser, device, and accounts together.

Separate Low Risk and High Risk

The strength of technical-information countermeasures changes depending on the situation.

For everyday privacy protection, start with browser separation, cookie management, and preventing real-name login mixing. For high-risk anonymous activity, you need to separate devices, OSes, communication routes, files, and even work time.

Not everyone needs countermeasures at the same strength. However, at any level, it is important not to stop at "IP only," "VPN only," or "browser settings only."

Summary

Technical information correlation means combining information from communication and devices to infer that activity appears to come from the same user or the same environment.

IP addresses, DNS, cookies, User-Agent, WebRTC, login history, device information, browser settings, and similar information become materials.

VPNs and Tor are important, but they do not make technical information correlation disappear by themselves. Cookies, login state, browser fingerprints, DNS leaks, WebRTC leaks, and app-specific communication routes also need to be checked.

To protect anonymity, it is important to look separately at networks, browsers, devices, and accounts.

Related tools

WebRTC Leak Test

BrowserLeaks WebRTC

An external resource related to this article. Open it only when it fits your situation and threat model.