> I'm pretty sure that the idea is to report back random (existing) domains, yes.

Here's a concern that comes up from that implementation option: any outliers from the set of existing domains (which would likely simply be implemented as a list of strings) would immediately be able to be called out as a "True" value, while a single reporting of a domain could reliably called out as a "False" value. Unless, of course, you choose a randomization algorithm which exhibits a very strong clustering trait.

You could also limit reports to those domains which are in the whitelist, but that would voluntarily neuter the reporting; something they seem less-than-eager to do.

Ultimately, it will all come down to the implementation details, which are unlikely to be available until after the opt-in release, and auditable by a remarkably small number of people in the open source community.

RAPPOR uses a Bloom filter. It doesn't report the domain itself; it reports (a corrupted version of) a handful of bits of a hash of the domain.

Good info, thanks!