PROKSIMITY
Identity read from the traffic a browser cannot help emitting — no required script, no cookie, no fingerprint.
Session continuity is collapsing.
The signals that used to hold a session together are being switched off by the same vendors that ship the browsers.
Storage · killed
Apple ITP blocks third-party cookies and caps script-writeable storage. Firefox ETP partitions it. Chrome moved to user-choice.
Sandbox · retired
Most Privacy Sandbox replacement APIs were retired in October 2025. The planned successors never arrived.
Credentials · blind
Password + MFA can't see session hijacking, token theft, or a shared account once the login succeeds.
The client-side fingerprinting that filled the gap is being killed too. The gap is now permanent.
We removed visitor-identifying code once we shipped it, not just avoided writing it — commit c75c403, 2026-08-23, reviewable in the repository during diligence.
Read what the stack can't hide.
Every browser's network stack emits structural artifacts at the TLS-terminating edge — the shape of the handshake, the order of frames, the casing of headers. It can't opt out of being itself.
- 01JA4 / ClientHelloCipher suites, extensions, curve list — the TLS greeting's fingerprint.
- 02H2 / H3 framesSETTINGS, PRIORITY, WINDOW_UPDATE order and QUIC session behavior.
- 03Header grammarName order and casing — grammar only, never values.
- 04WebSocket timingFrame size and cadence, plus session-level behavior events.
- 05PQC key-exchange postureHybrid post-quantum groups offered — one bit, never the group list.
- 06TCP SYN stackKernel TTL, window and option order — the real OS, versus the claimed one.
One passive signal path, end to end.
An event-driven pipeline over an append-only decision journal. Horizontal ingest, bounded auth latency, forensically reconstructable state.
Edge
Stateless TLS-terminating collector emits typed events only.
edge/ · GoBackbone
Kafka 4.x KRaft, franz-go, per-conn ordering.
backbone/Extract
55 bounded features + explicit missingness mask.
processing/Embed
128-d identity embedding, CPU-only inference.
ONNXScore
Calibrated risk over the identity graph.
decision/Decide
Full / Step-up / Restricted / Reject.
≤ 250msAn identity graph that never names a person.
Embeddings link sessions across devices through calibrated thresholds. Edges decay, clusters merge and split — all against opaque anonymous nodes. A link gates step-up; it never grants auth on its own.
Calibrated links
Threshold derived from calibration, not a magic number.
Merge · split
Journaled, reversible cluster operations.
Decaying edges
Per-class half-lives — stale links fade.
Network-shift proof
An IP change alone never severs a link.
Every decision fails toward step-up.
One continuous score, four bands, never a silent accept. Every failure mode degrades fail-closed — the safe answer is always to ask for more proof.
Not an authenticator
Per NIST SP 800-63B, traffic fingerprinting is a continuity and risk score — it gates step-up, never a factor by itself.
Ground truth loop
WebAuthn / OTP step-up outcomes feed back as labels, so the model calibrates on real answers.
The boundary is the architecture.
Not a policy bolted on afterward — the collector is physically incapable of reading a payload. What it can't see, it can't leak.
Reads · traffic artifacts
- +TLS ClientHello structure JA4 / JA3
- +H2 / H3 / QUIC frame metadata
- +Header order & casing grammar only — UA → family, Accept-Language → 2-char
- +WebSocket frame size & timing
- +First-party path prefixes no query strings
- +TCP SYN header fields kernel values only — source IP discarded, never retained
Never reads · ever
- ×Request / response bodies
- ×Query strings & form values
- ×OS / hardware APIs
- ×Client fingerprinting JavaScript
- ×Any payload, retained anywhere
Numbers, not adjectives.
Honest scope: collection, featureization, the Kafka backbone and the decision service are built and under test. What only real traffic can settle — the trained embedding and the thresholds calibrated on it — is what the pilot measures against these targets.
Re-auth in five minutes,
on traffic you already terminate.
Collection plane, feature store, Kafka backbone, identity-graph linking, the calibrated decision service, consent and retention enforcement. Static Go binaries on the serving path.
The trained embedding and the thresholds calibrated on real traffic. Measured against the precision, latency, and calibration targets on your edge.
Not an authenticator — a calibrated continuity score that gates step-up (NIST SP 800-63B).