How Heretic Measures Browser Integrity with Physics

Every claim a browser makes about itself — its operating system, its location, its hardware, its user-agent — is a string that any script can forge. Physics is not. The round-trip time between two points on Earth has a speed-of-light floor no VPN can dissolve. The TCP options a kernel writes into a SYN packet are chosen by the OS, not the application layer. The TLS ClientHello a runtime emits is a structural fingerprint of the library that built it. Heretic reads these physical and structural facts out-of-band from your origin, compares them against what the browser declares, and issues a verdict — never a score.

​

The ruling algebra

Heretic organises every signal it collects into one of four tiers. The tier of a signal determines how much weight it carries when the verdict engine reasons across the full evidence set.

​

The five verdicts

Every session Heretic evaluates resolves to exactly one verdict.

• contradicted — At least one signal directly falsifies a browser claim; the session is not what it says it is.
• refused — The browser actively blocked or suppressed the probes required to form a verdict; refusal is itself a strong negative signal.
• disputed — The evidence is internally inconsistent: some signals support the declared environment, others contradict it, and the engine cannot resolve the conflict with the available data.
• uncontradicted — No signal contradicts the declared environment; the session is consistent with a genuine browser of the claimed type.
• insufficient — The pipeline collected too few signals to issue any ruling — network conditions, aggressive privacy tooling, or an incomplete probe cycle prevented a conclusion.

​

The five heresies

Heretic’s design rests on five principles that set it apart from fingerprint-matching and ML-scoring approaches.

1. Physics over probability. A speed-of-light RTT violation is not a suspicious pattern — it is a physical impossibility. Heretic grounds every absolute verdict in measurable constraints, not learned distributions that drift and degrade.
2. The kernel testifies. The TCP SYN options, window scale, and initial congestion window written by the kernel are outside the JavaScript sandbox entirely. No browser API, no spoofing library, and no user-space proxy can rewrite them in transit.
3. The absent attempt. When a browser refuses or is incapable of completing a probe — such as a QUIC handshake that never starts — the absence of the attempt is itself evidence. Heretic treats non-response as a signal, not as missing data.
4. Weak evidence never convicts. A single weak signal, or even a pile of them, cannot produce a contradicted verdict. The ruling algebra requires absolute or composite contradictions. This protects ordinary users whose environments happen to look slightly unusual.
5. Out of band on your origin. Heretic’s probes run from edge nodes that connect directly to the browser. No traffic routes through a Heretic proxy, no DNS changes are required, and the probes are invisible to network-layer observers between your origin and the client.

​

Why no score?

Most browser-integrity products return a risk score between 0 and 100 and leave the threshold decision to you. Heretic does not do this. A score encodes a probability derived from a training distribution. That distribution reflects the bots of yesterday, not the tooling deployed against you today. Thresholds become a negotiation between false-positive risk and false-negative risk, and they drift as the adversarial landscape shifts. Heretic instead asks a narrower question: does the physical and structural evidence contradict what this browser claims? If yes, the answer is contradicted. If not, the answer is uncontradicted. A binary ruling based on physical constraints does not drift, does not require retraining, and does not ask you to pick a threshold. When the evidence is genuinely ambiguous, Heretic says so: disputed or insufficient. Honest uncertainty is more useful than a false-precision score.

​

Where it runs

Heretic’s collector initialises on your page and dispatches probes to bare-metal edge nodes operated by Heretic. Those nodes measure the session’s network geometry — RTT, path characteristics, QUIC reachability — and relay the structural signals back to the verdict pipeline. The entire probe cycle runs out-of-band: it does not interfere with your page’s own requests, does not add latency to your critical path, and is not visible to intermediaries watching the connection between your origin and the client. Because the collector operates on your origin domain (via a small script tag or npm package), no DNS changes, CNAME delegations, or proxy configurations are required. Your origin stays your origin. The apostate tier runs on shared edge infrastructure. The planned heretic tier adds more edge locations for tighter coverage. The inquisition enterprise tier provisions dedicated bare-metal nodes for customers who require physical isolation of their measurement infrastructure.

---