PROKSIMITY
Identity read from the traffic a browser cannot help emitting — no script, no cookie, no fingerprint.
Session continuity is collapsing.
The signals that used to hold a session together are being switched off by the same vendors that ship the browsers.
Storage · killed
Apple ITP blocks third-party cookies and caps script-writeable storage. Firefox ETP partitions it. Chrome moved to user-choice.
Sandbox · retired
Most Privacy Sandbox replacement APIs were retired in October 2025. The planned successors never arrived.
Credentials · blind
Password + MFA can't see session hijacking, token theft, or a shared account once the login succeeds.
The client-side fingerprinting that filled the gap is being killed too. The gap is now permanent.
Read what the stack can't hide.
Every browser's network stack emits structural artifacts at the TLS-terminating edge — the shape of the handshake, the order of frames, the casing of headers. It can't opt out of being itself.
- 01JA4 / ClientHelloCipher suites, extensions, curve list — the TLS greeting's fingerprint.
- 02H2 / H3 framesSETTINGS, PRIORITY, WINDOW_UPDATE order and QUIC session behavior.
- 03Header grammarName order and casing — grammar only, never values.
- 04WebSocket timingFrame size and cadence, plus session-level behavior events.
One passive signal path, end to end.
An event-driven pipeline over an append-only decision journal. Horizontal ingest, bounded auth latency, forensically reconstructable state.
Edge
Stateless TLS-terminating collector emits typed events only.
edge/ · GoBackbone
Kafka 4.x KRaft, franz-go, per-conn ordering.
backbone/Extract
~35 bounded features + explicit missingness mask.
processing/Embed
128-d identity embedding, CPU-only inference.
ONNXScore
Calibrated risk over the identity graph.
decision/Decide
Full / Step-up / Restricted / Reject.
≤ 250msAn identity graph that never names a person.
Embeddings link sessions across devices through calibrated thresholds. Edges decay, clusters merge and split — all against opaque anonymous nodes. A link gates step-up; it never grants auth on its own.
Calibrated links
Threshold derived from calibration, not a magic number.
Merge · split
Journaled, reversible cluster operations.
Decaying edges
Per-class half-lives — stale links fade.
Network-shift proof
An IP change alone never severs a link.
Every decision fails toward step-up.
One continuous score, four bands, never a silent accept. Every failure mode degrades fail-closed — the safe answer is always to ask for more proof.
Not an authenticator
Per NIST SP 800-63B, traffic fingerprinting is a continuity and risk score — it gates step-up, never a factor by itself.
Ground truth loop
WebAuthn / OTP step-up outcomes feed back as labels, so the model calibrates on real answers.
The boundary is the architecture.
Not a policy bolted on afterward — the collector is physically incapable of reading a payload. What it can't see, it can't leak.
Reads · traffic artifacts
- +TLS ClientHello structure JA4 / JA3
- +H2 / H3 / QUIC frame metadata
- +Header order & casing grammar only — UA → family, Accept-Language → 2-char
- +WebSocket frame size & timing
- +First-party path prefixes no query strings
Never reads · ever
- ×Request / response bodies
- ×Query strings & form values
- ×OS / hardware APIs
- ×Client fingerprinting JavaScript
- ×Any payload, retained anywhere
Numbers, not adjectives.
Honest scope: collection, featureization, and the Kafka backbone are built and running. The trained embedding, identity graph, and calibrated decision service are engineered and specced — the pilot proves them against these targets on your traffic.
Re-auth in five minutes,
on traffic you already terminate.
Collection plane, feature store, Kafka backbone, beacon, banned-surface gates. Static Go binaries on the serving path. Epic 1 shipping.
Trained embedding, identity graph, calibrated decision service. Measured against the precision, latency, and calibration targets on your edge.
Not an authenticator — a calibrated continuity score that gates step-up (NIST SP 800-63B).