Unman, it seems I underestimated your suggestion.
I have done more research now on the new info you have given.
But let me first highlight the irony in that. That I, a user, needs to do the research, instead of the expert/developer.
I have been very comprehensive in my posts, and detailed. Explaining where I’ve learned (Whonix docs and forum) and why I see the issues I describe.
I think you should as a developer see that the problem is a lack of documentation. Because the statements you are making are undocumented. Such as qubes event buffering being unnecessary because qubes by default already has enough random delays to prevent being identified by mouse movement fingerprinting.
This makes what the undocumented statements you say, contradicting to the information in Whonix docs.
I will tell you what I’ve found out with my new research, but I also must point out that it’s not ideal that I, the user, is doing this. It really should be another expert, such as one of the developers of Kloak, who are specialized in mouse movement fingerprinting, to debate with you.
But with that said (me not actually being qualified), I think your solutions have a lot of merit. This is why (warning: I used an AI to help me research):
Your custom ML uses Random Forest algorithm, is much better than VMONACO which uses k-NN. It shows you know what you are talking about, which I previously wasn’t sure about.
This is what the AI said (after it rigorously studied all the source code):
The vMonaco test uses a k-Nearest Neighbors (k-NN) algorithm, which works by memorizing your specific mouse movement features (velocity, angle, acceleration) and comparing new movements directly to them based on mathematical distance.
Why k-NN Fails Against Obfuscation (Kloak): k-NN is a “lazy” algorithm that relies on the exact numerical values of your features. Obfuscation tools like Kloak work by introducing random time delays and path jumps.
Because velocity = distance / time, randomizing the time completely scrambles the velocity value.
Because k-NN measures the “distance” between data points, this randomization makes your obfuscated movements appear mathematically far away from your original clean data.
The algorithm sees a completely different pattern and fails to match you. It is highly sensitive to this specific type of noise injection.
Why Big Tech (Deep Learning) Would Be Better: Big Tech likely uses Deep Learning (LSTMs/Transformers), which are fundamentally different:
-
Pattern Recognition vs. Direct Matching: Instead of comparing raw numbers, these models learn underlying behavioral patterns. They understand that “a user who types fast usually moves fast” or “a user who hesitates before clicking has a specific rhythm.”
-
Robustness to Noise: These models are trained on massive datasets with natural variations. They can filter out random jitter or minor delays to find the core “signature” underneath.
-
Temporal Context: Deep Learning models analyze the sequence of events over time. Even if Kloak adds random delays, the relative order or high-level rhythm of your actions (e.g., “mouse moves to button, pauses, clicks”) may remain detectable to a sophisticated model, whereas k-NN sees only chaos.
Conclusion: The vMonaco test proves that simple, naive algorithms can be easily broken by obfuscation. However, it does not prove that sophisticated, AI-driven trackers used by Big Tech cannot identify you, as those models are specifically designed to ignore the exact type of noise that fools k-NN. Passing the vMonaco test confirms you are safe from basic scripts, but not necessarily from advanced behavioral biometrics.
It also said this about deep learning vs Random Forest (Warning: I sensed the AI might be making a mistake in the below info. An expert would need to verify if this is wrong or correct):
Adversarial Defense
Random Forest: Can sometimes be tricked by simple noise injection.
Deep Learning / LSTM (Likely used by Big Tech): Often more robust against sophisticated obfuscation (like Kloak’s random delays).
Cross-Session
Random Forest: Struggles to link sessions months apart without re-training.
Deep Learning / LSTM (Likely used by Big Tech): Can build long-term “personality” profiles that persist over years.
There are many things that really needs more answers, research, work on. But the most immediate question I have, is also an answer to your question about why I think Kloak is necessary.
The reason I think so is because the unintended random delays qubes cause by default, even without VNC or qubes event buffering, as you explained, is randomly unreliable if that phrasing makes sense.
The problem i see is this:
If I have two accounts but I don’t want big tech to know they are both mine, so I need to avoid being identified by mouse movement fingerprinting.
If i successfully obfuscate and avoid being identified 9 consecutive days, then on the 10th day, the randomly unreliableness of qubes unintended delays, cause me to become identified. Then it doesn’t matter if I was avoiding identification the previous days.
Kloak ensures that obfuscation is intentional and constant. It’s dependable.
Kloak can ensure that there’s constant criterias being applied. For example: maximum 10 hz frequency, 20% packet loss, jitter.
Does qubes do that by default? Because this really should be precise science.
I could argue more things you said which I have a problem with, such as your claim that many things I said in first post are unsubstantiated but you didn’t explain why. How am I supposed to defend myself against that when I don’t know what exactly is the issue?
But I will just let all those other things you said slide so we can get back to making constructive progress on what matters most.
“log into this website and do this”.