Why JavaScript can read your behavioral identity — and what HOLogram does about it

BaffiSan — Thu, 10 Sep 2026 12:27:26 +0000

Every page you visit runs JavaScript.

And that JavaScript is reading you — not just what you type,
but how you type it. The rhythm between keystrokes. The trajectory
of your pointer. The micro-pauses in your scroll. The way your hand
hesitates before clicking.

These signals are called behavioral biometrics. And they are today
one of the most powerful identification tools available to tracking systems,
AI classifiers, and fraud detection platforms.

They work without cookies.
They work across VPNs.
They work even on Tor.
Because they happen inside the page, before anything leaves your browser.

The threat no privacy tool addresses

Most privacy tools protect the network layer:

VPNs hide your IP address
uBlock Origin blocks known trackers
Privacy Badger stops cross-site tracking cookies
Tor anonymizes your traffic

None of them protect your behavioral signals — because those signals are
collected by JavaScript running inside the page you're visiting,
before any network request is made.

A classifier trained on behavioral biometrics can identify you with
high accuracy across sessions, across sites, and across devices —
using only the way you interact with a keyboard and a mouse.

This isn't theoretical. Behavioral biometrics systems are commercially
deployed today for fraud detection, user tracking, and cross-site
identity correlation. Companies like BioCatch, ThreatMetrix, and others
offer this as a service to banks, e-commerce platforms, and publishers.

What HOLogram is

HOLogram is an open protocol that introduces a local obfuscation layer
between the user and the page.

It intercepts behavioral signals at the browser layer — before JavaScript
can read them — and replaces them with a synthetic behavioral profile
that is functionally identical but behaviorally unidentifiable.

The page receives correct input. It just doesn't receive your input.

The protocol is MIT licensed, local-only, zero-retention, and designed
as a formalizable open standard — not a proprietary tool.

How it works: six independent modules

1. ShadowDOM Input Vault

Intercepts native keyboard events (keydown, keyup, keypress) before
page scripts can read them. Removes micro-timing information —
the inter-keystroke intervals that are the primary feature used by
keystroke dynamics classifiers. Re-emits functionally identical
synthetic events with timing information removed.

The semantic content of what you type is preserved exactly.
The temporal pattern is not.

2. Pointer & Scroll Normalizer

Applies downsampling, coordinate quantization, and trajectory smoothing
to mouse movement and scroll events. Reduces the granularity of pointer
data to the level where individual identification becomes infeasible,
while keeping movements natural-looking.

3. Persona Mixer

This is the key differentiator from naive noise injection.

Instead of adding random noise — which is statistically detectable as noise —
the Persona Mixer generates a session-consistent synthetic behavioral
signature. Each session gets a stable set of synthetic behavioral parameters:

pointerJitterRange — magnitude of pointer micro-movements
scrollPauseProbability — probability of micro-pauses during scroll
typingLatencyOffset — offset applied to inter-keystroke intervals
smoothingAggressiveness — degree of trajectory smoothing
curvatureSoftening — reduction of sharp angular changes

The output looks like a specific, plausible human — just not you.
And not the same synthetic human across sessions.

4. Behavioral DP Engine

Applies calibrated noise inspired by differential privacy principles
to the real-time event stream. Reduces the sensitivity of the output
to individual behavioral variations without making the output
statistically implausible.

Note: this is explicitly inspired by differential privacy, not
formal DP on static datasets. The whitepaper documents this distinction
openly and considers it an area for future formalization.

5. Behavioral Privacy Budget

Tracks the cumulative behavioral exposure per session. Every interaction
has a cost — computed as a function of event type, frequency, geometric
complexity, and entropy. When the budget approaches defined thresholds,
the protocol escalates its obfuscation strategy automatically.

6. Exposure HUD

A minimal, non-intrusive interface that shows the user their current
protection level and which modules are active. Transparency as a feature.

Prior art: how HOLogram differs

Kloak (used in Whonix) is the closest existing tool. It operates
at the OS/kernel level on Linux, requires root, and introduces random
delays between physical events and their delivery to applications.
It's a solid tool — but it's OS-level, not browser-native, requires root,
doesn't generate session-consistent synthetic personas, and isn't a
formalizable open standard. Kloak itself acknowledges it doesn't protect
writing style, high-level cognitive behavior, or scroll patterns.

MouseFaker (Leiva et al., CHIIR 2021) is a research Chrome extension
that applies adversarial noise to mouse coordinates. Mouse only, no
session consistency, not actively maintained.

These tools and HOLogram are complementary. None of them defines a formal
open protocol with compliance tests and a community governance model.

Where we are — and what we need

The whitepaper v1.0 is complete and notarized (SHA-256 + IPFS).
The architecture is defined. The governance model, RFC process, and
compliance test specification (HCT) are in place.

The reference implementation doesn't exist yet.

This is where you come in.

We're looking for contributors with experience in:

Browser extension development (Chrome/Firefox/Safari)
Privacy engineering
Differential privacy applied to event streams
Behavioral biometrics research

Research and design contributions are equally welcome — not just code.
Good first issues are open and ready to be picked up:

[R-01] Survey browser APIs for input event interception
[R-02] Survey pointer and scroll event APIs across browsers
[R-03] Behavioral biometrics classifier survey
[R-04] DP libraries for real-time event streams
[R-05] Anti-bot system behavior analysis
[D-01] Define human plausibility ranges for Persona Mixer parameters

Links

HOLogram is an independent open project. No company, no VC, no advertising interest.
Community-driven from day one.

DEV Community: BaffiSan