network-geometry
Family ID:network-geometry
Network geometry measures whether the physics of the connection are consistent with the client’s declared location. It compares the measured round-trip time against the speed-of-light floor — the minimum time a photon could travel between the claimed endpoint and the server, given the geodesic distance and fiber refraction index.
No amount of software tuning can make a packet travel faster than light. A measured RTT below the theoretical minimum is a physical impossibility, and therefore a conclusive indicator that the declared location is false.
Key signals
Key signals
transport-stack
Family ID:transport-stack
Transport stack fingerprints the TCP options, SYN flags, window sizes, and QUIC reachability of the incoming connection. Every operating system kernel has a characteristic TCP/TLS handshake structure that is difficult to spoof from userland. If the kernel’s SYN packet identifies a Linux 5.x network stack but the client declares macOS 15, something is misrepresenting itself.
Key signals
Key signals
tls-construction
Family ID:tls-construction
TLS construction inspects the structure of the TLS ClientHello: the cipher suite ordering, supported groups (elliptic curves), signature algorithm list, and extension layout. Each TLS library — BoringSSL, NSS, OpenSSL, the Windows SChannel — produces a characteristic fingerprint. A ClientHello assembled by a headless automation library looks different from one produced by a genuine Chrome browser, even if the User-Agent string matches.
Key signals
Key signals
compute
Family ID:compute
Compute probes CPU characteristics: model corpus matching, core count claims versus measured parallelism throughput, and timing resolution. A client that declares an 8-core desktop CPU but can only execute tasks at 2-thread throughput is either running in a constrained VM or misrepresenting its hardware.
Key signals
Key signals
render
Family ID:render
Render probes the GPU, canvas rasterization, WebGL renderer string, audio processing pipeline, parallel execution timing, and frame delivery cadence. Real GPUs produce characteristic rendering outputs — software rasterizers (SwiftShader, llvmpipe) produce different pixel hashes and timing profiles. Frame timing irregularities reveal headless environments that lack a real display compositor.
Key signals
Key signals
You can disable device fingerprinting by passing
render: false to the collector options. This removes the render family from the session entirely, which eliminates canvas and audio probes. You lose the render clustering signal and any composite corroboration it would have contributed. Use this option only when your privacy requirements explicitly prohibit device fingerprinting.declared
Family ID:declared
The declared family reads the values the browser exposes directly: navigator, screen, Intl, userAgentData, and WebGL renderer strings. These values are never treated as ground truth. Heretic reads them only as claims — inputs against which the other five families test for contradiction.
What is read
What is read