What’s ironic about that? It just shows what I’ve been saying since the start is right. The AI is just giving a more comprehensive explanation than my simplified shorter explanations. And now the Whonix dev who’s a specialist in anonymity and mouse movement fingerprinting is also saying that Kloak is better than the default qubes delays you’re talking about.
You have a lot of experts and data stacked up against you, and you just make a joke of it? Why not discuss in detail the specifics instead? Like scientists are supposed to.
Now you’re being ambiguous. What do you think qubist is “right - not completely right, but right” about? That there exists other ways to fingerprint someone than just mouse movement fingerprinting? Why do you call that the main issue? This topic is clearly about mouse movement fingerprinting. Behavior fingerprinting is something else/broader. Mouse movement is specifically about the mouse movement. Mouse movement is not about if you always click on the hamburger button within 10 seconds or something else. So I don’t know what you are talking about other things like keyboard typing fingerprinting. Kloak handles that too but this topic is about mouse movement fingerprinting.
Kloak is what makes it possible to use a mouse device and not be identified by mouse movement fingerprinting when JS is enabled.
I don’t think there’s anything else to say to your vague claim except that it’s wrong.
Or are you talking about other tracking methods than mouse movement fingerprinting? It seems like it based on your previous statements.
You have to use the right tool for the right threat. And when browsing the internet, you need a large toolbox with a lot of tools in it. Kloak is just one of the tools you need to bring.
Remote desktop could even be done non-networked and completely air-gapped from the network, ie:
1. create Display Qube (disposable template recommended)
Display-dvm
2. create RDP Server Qube
RDP-Server
(Non-networked)
Install server on RDP-Server and client on Display-DVM
edit /rw/config/rc.local on Display-DVM
qvm-connect-tcp 5900:@default:5900
# qvm-connect-tcp for any other ports you may need
sudo chmod +x /rw/config/rc.local
The problem with your AI answer is you changed it from being “mouse movement fingerprinting” to “input fingerprinting”. That’s two different things.
You also only showed the result, not the explanation. The explanation is more important. It shows if the AI’s reasoning is wrong. We need to know how it arrived at the solution. Especially when the result of your AI’s answer contradicts what the experts about mouse movement fingeprinting is saying.
I would guess that one thing your AI did wrong is prioritize to not be detected as a bot. When it prioritizes that, it wants the mouse movement fingerprint or input fingerprint to appear human. I usually instruct the AI that is not important. I have to guess since you didn’t show the explanation.
I also think, moving forward in this discussion, it’s a big mistake to not use the information from both unman and arraybolt when making questions to AI. Definitely include the research from Vmonaco as context, which arraybolt linked to.
AI did not arrive at any “solution” there. I used it only for comparisons.
I had thought about using RDP as a way to obfuscate input fingerprinting after reading @unman post earlier in this thread re vnc and thought it could work as well.
The idea to air-gap it I think originally came from Easy sys-i2p
which Idea I also use for other purposes.
If it is ONLY Mouse fingerprinting you are concerned about then maybe something as simple as @unman earlier (text browsing) or @qubist idea of different mice, then may be easier.
I think the reason you have avoided to give the name of the browser is because I could easily prove you wrong immediately.
You cannot prove anything because you obviously lack the technical knowledge in the field you are trying to argue.
But I took a different approach this time and let the AI make an answer which is correct for all the text browsers.
No, that is not a “different approach”. This is your only approach so far. You raise an argument, you face actual technical facts by people who know more about all that, then you are unable to counter those actual arguments or prove your own claims, and you hope AI will help you. Basically, you are trying to prove something that is simply wrong by adding more and more to this avalanche of AI-generated nonsense.
qubist believes that if a browser sends no JavaScript and no CSS, the server sees nothing but a blank request. This is false.
That is beyond ridiculous.
I don’t “believe” these absurdities. The browser does not “send” JS and CSS. It runs JS and renders CSS. You must learn how browsers work.
I have never said anything about “blank request”. This is another nonsense out of nothing.
Even a bare-bones text browser (like lynx, w3m, or links) must send HTTP Headers to establish a connection. These headers are the primary source of fingerprinting data, regardless of whether the page renders visually or runs scripts.
Now read that for yourself and answer: what is the primary source? Your friend, the AI, has just told you that your theory of “the grandest obstacle” is simply false.
What the server still sees: […]
That is repeating what I shortly said in my first reply in this thread, while I was still thinking this thread may be something serious.
qubist thinks that having less bits (less data) automatically means better privacy. This is the opposite of how anonymity works.
No, that is not how anonymity works. And this oversimplification is not what I explained in my previous replies. You must understand that your unintelligent AI cannot grasp the essence and inject it into your brain. You need to learn and understand how things work.
The Goal: The goal is Anonymity Set. You want your fingerprint to be identical to as many other people as possible.
There is no such goal. The only goal of (call it whatever you want) online anonymity/privacy/hiding is that others don’t know who you are. The hiding-in-the-crowd approach is a means to that not the only means.
The Reality of Text Browsers:
A standard Chrome user on Windows has a fingerprint shared by millions of other Chrome users. Their bits are high, but their uniqueness is low.
This is nonsense and misses entirely:
your own argument: identification through mouse moves (“grandest obstacle”)
everything I explained
additional browser complexities I prefer not to go into
It is funny that you asked AI to abolish me and what it actually did is to 1) confirm what I said; 2) talk off topic
A text browser user has very few bits of data, but because almost no one uses that specific configuration, they are unique.
You can’t understand how false this is because you don’t understand networking. You don’t even know what a fingerprint is and what it looks like, so you avoided my earlier question about it, yet you continue to argue and publish these endless writings.
“No one uses that specific configuration” is so meaningless. Which specific configuration? What is specific about this negation? This doesn’t even address the existing possibility (which I mentioned and which you and your unintelligent AI missed) that each HTTP request can be different = different fingerprint on each web page - good luck identifying a person through this alone. But to understand this, you must understand networking.
As I said, you must learn. Start with networking basics. Learn how HTTP works.
Repeating the same fallacies with more words does make the fallacies “right”. You should really stop putting a silly machine to argue with people. It is exactly that - a silly machine that can only combine and repeat, and thus make people even sillier because they refuse to use their own brain to learn and understand.
And now the Whonix dev who’s a specialist in anonymity and mouse movement fingerprinting is also saying that Kloak is better than the default qubes delays you’re talking about.
I would like to read what YOU say AFTER you have learned enough. There is zero point in a conversation in which you quote others to infinity, then ask AI to combine what you quoted with more quotations and provide that as an “argument”.
You have a lot of experts and data stacked up against you, and you just make a joke of it?
Believe it or not, some people here have a background of full-stack development, deployment, security and administration of e-commerce websites. And you know what? - That includes mouse movement tracking, heatmaps and what not. Some of the projects were early testers of systems like HotJar many years ago (since its very start).
Why not discuss in detail the specifics instead? Like scientists are supposed to.
Because:
You don’t have the technical knowledge do discuss specifics
You are not a scientist
This forum is not about “teach me how the web works, because I have read a few articles that made me scared and promised me perfect anonymity is possible through a particular tool”
Now you’re being ambiguous. What do you think qubist is right - not completely right, but right about? That there exists other ways to fingerprint someone than just mouse movement fingerprinting?
At least read what your AI said above, instead of flooding us with it.
Why do you call that the main issue? This topic is clearly about mouse movement fingerprinting. Behavior fingerprinting is something else/broader. Mouse movement is specifically about the mouse movement. Mouse movement is not about if you always click on the hamburger button within 10 seconds or something else. So I don’t know what you are talking about other things like keyboard typing fingerprinting. Kloak handles that too but this topic is about mouse movement fingerprinting.
No, Kloak does not handle behaviour fingerprinting, and without addressing the latter, focusing on mouse movements alone has practically zero meaning. It is like hoping that changing your shoes makes your walk unrecognizable and nobody can track where you go with the new shoes.
Kloak is what makes it possible to use a mouse device and not be identified by mouse movement fingerprinting when JS is enabled.
You must understand that this does not matter. The goal of online anonymity is not to anonymize the device but the person. Kloak may add noise to your mouse path but it cannot change your behaviour.
Please don’t paste what you have read in a random article or what AI says.
That’s a lot of words where you said absolutely nothing.
In short, what you said is “you are wrong but I don’t want to tell anyone in qubes os community why. Everyone has to trust me. You shouldn’t post here again. How dare you question my claims which use broken reasoning and no evidence or explanations”
If you are qualified like you claim, then prove it. Show us your resume. What have you done? What’s your work experience? What certifications do you have? Can you prove anything at all what you say?
Because that’s what you say is supporting everything you say. It’s all about trusting your qualifications. You are the authority which tells people what is wrong and right without explanations. But you can’t even prove you’re qualified.
Infighting is not going to get anywhere productive. I would suggest following what @arraybolt3 contributed in this topic, then start working towards a technical solution and see if the implementation holds up. If I had to tackle this project myself, I would start formulating an adversarial suite to attempt to extract mouse movement fingerprinting data from any sources, not just Qubes OS, then laser focus in Qubes OS topography to bring out a reproducible CI/CD testbed for others to benchmark against.
The problem with that approach is its unethical and in many areas illegal to collect mouse movement data of people without consent and legitimate use case. And in this specific case, you want the data to be open for everyone (Shared to entire world). Who will be responsible? (legally) for collecting, processing and storing the data?
The other option is to make it proprietary. And that doesn’t work because that makes it all about trusting the results.
It’s not impossible to do this, but it’s very challenging. I don’t know how it would be done practically and effectively. I’m just highlighting where the challenge is so those who want to work towards this solution, know where to begin.
That’s probably why the vmonaco test uses only current session and is a basic test.
And that’s why the usefulness of obfuscation techniques are mostly theoretical. We know theoretically how they fingerprint mouse movements (deep learning. There are academic papers on this.). And we can therefore create specific noise which theoretically defeats that mouse movement fingeprinting.
The multiple proofs that you are incapable to understand what your interlocutors are saying and your disrespectful attitude are public. Enjoy your public fingerprint.
I appreciate the highlighting of the issues, but, despite being interested in finding solutions, this conversation doesn’t entice me to want to allocate limited time to digging further. What would be enticing is someone making a serious effort to specify (in gritty detail) the technical constraints, lay the groundwork for a solution, and then get to work implementing it. In that situation I’d be able to assess if my technical skills had some bearing on the problem and be willing to jump in. With vibe coding available, the most motivated person should take the lead and just create the prototype they want to see. If the prototype looks promising, all the more likely others will contribute. Which is all to say, FranklyFlawless is spot on. Just make it happen.
You obviously do not understand how such data can be collected, and the
way in which databases are shared across the research community.
Nor do you seem to be aware of any literature in the field regarding
real world applications, and the difficulty of working at scale. If
there were any interest from the community in gathering such metrics it
could be done, and we would then have some raw data to work with. But I
suspect that wont be the case.
(I have not yet seen any comments from other users with experience of
commercial applications.)
I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.
Unman, you and Qubist have a very similar approach to making claims without giving any evidence or explanation. Just relying entirely on your qualification/authority. I’ll admit you do have some qualification unlike Qubist. But this topic has also shown you overestimate your suggestions, which became clear thanks to arraybolt’s scientific explanations. Arraybolt shows he’s a true professional because he is able to explain advanced technology.
I really shouldn’t even bother to reply to you since your post is actually meaningless without any evidence or explanation. You expect people to just trust you, in a community where we’re supposed to verify, not trust.
But since it’s simple to just have an AI provide the explanation I did it anyway. So now there if proof of you being wrong again. I don’t expect you to give a proper counter-argument because that would require an explanation and evidence. Maybe you’ll have qubist step in again.
Unman is almost certainly wrong. The claim that GDPR does not make it illegal to collect and share mouse movement data for "research" without explicit consent is a legal misunderstanding. While the situation involves nuances, the prevailing legal interpretation and regulatory guidance strongly suggest that such activity violates the GDPR.
Here is the breakdown of why:
1. Mouse movement data is "personal data" Under the GDPR, "personal data" is any information relating to an identified or identifiable natural person.
Uniqueness: Mouse movement patterns (speed, curvature, acceleration, hesitation) are increasingly recognized as unique behavioral biometrics. When combined with other standard browser data (screen resolution, OS, installed fonts), they create a highly unique "fingerprint" that can identify a specific individual or device .
Identifiability: Even if the data is initially "anonymized" or pseudonymized, if it can be re-identified (which is often possible with behavioral data) or linked back to a user via other means, it remains personal data under GDPR .
Conclusion: The data in question is not "anonymous statistical noise"; it is personal data.
2. The "research" purpose is not a free pass The claim that "research purposes" exempt organizations from GDPR compliance is a common misconception.
Legal Basis Required: Any processing of personal data requires a valid legal basis under Article 6. For research, organizations often try to rely on "Legitimate Interests" or "Public Interest/Scientific Research."
Balancing Test: Even if "research" is the goal, the organization must pass a balancing test. The user's fundamental rights and freedoms (specifically the right to privacy) must not override the organization's interest. Collecting granular behavioral data like mouse movements is considered highly invasive surveillance .
Proportionality: The principle of data minimization (Article 5) requires that data collection be limited to what is strictly necessary. Collecting raw mouse coordinates for "fingerprinting research" is generally viewed as excessive if the actual research goal could be met with aggregated or less granular data .
3. Sharing with "other research communities" Sharing data with third parties (other research communities) constitutes a new processing activity.
Transparency: The organization must inform users specifically about this sharing in their privacy policy. Vague terms in a Terms of Service document are insufficient for valid consent or legitimate interest claims regarding such invasive tracking .
Purpose Limitation: Data collected for one purpose (e.g., "improving website UX") cannot be repurposed for "sharing with research communities" without a new legal basis and usually fresh consent, especially if the original collection was not explicitly for that specific research .
Consent Requirement: Because mouse movement tracking is often used for profiling and fingerprinting (which bypasses standard cookie consent), regulators generally require explicit, informed consent (opt-in) rather than relying on "legitimate interest." If the user has not explicitly opted in, the collection and sharing are likely illegal .
4. Regulatory precedents Recent enforcement trends and guidance indicate:
Fingerprinting is high risk: The European Data Protection Board (EDPB) and various national regulators view browser fingerprinting as a privacy-invasive technique. Using it often requires a Data Protection Impact Assessment (DPIA) and, in many cases, explicit consent .
Bypassing consent: Research has shown that fingerprinting is frequently used to bypass GDPR cookie consent mechanisms. Regulators have taken action against sites that track users via fingerprinting without consent .
Anonymization failure: True anonymization of behavioral biometrics is extremely difficult. If the data can theoretically be re-identified, the GDPR applies in full force .
Summary Unmans's claim is likely incorrect because:
1. Mouse movement data is personal data, not anonymous data.
"Research" is not an automatic exemption from the need for a legal basis (consent or legitimate interest).
2. Collecting such granular data usually requires explicit consent due to its invasive nature, which cannot be bypassed by "terms and conditions" or "legitimate interest" alone.
3. Sharing this data with third parties requires specific transparency and a valid legal basis for that specific sharing.
4. Unless the organization can prove the data is truly and irreversibly anonymized (which is very hard for behavioral biometrics) and the research serves a distinct public interest that overrides individual rights (which is a high bar), the collection and sharing described would likely be a violation of the GDPR.
Sources (URLs):
https://law.stackexchange.com/questions/42660/under-gdpr-are-service-operators-allowed-to-record-all-clicks-of-logged-in-user
https://www.jentis.com/blog/digital-fingerprinting-explained
https://pipeline.zoominfo.com/sales/privacy-laws-sensitive-personal-data
https://secureprivacy.ai/blog/gdpr-compliance-2026 https://arxiv.org/html/2409.15656v2 https://complydog.com/blog/gdpr-data-classification
That’s fair. Both approaches are valid ways to begin the project.
You aren’t motivated until the algorithm is created.
I am not motivated until I know it’s even possible to legally collect such data and share it the whole world.
And don’t forget that even if there is some loop hole, you should still act ethically.
Not quite what I meant. I think most technically inclined people are motivated by others who display their motivation through action and when they can imagine making a real contribution to a real problem. All other considerations are just constraints, not impediments to action, especially legal considerations because there is always some legal action that will create headway.
If you cite “AI”, the least you could do is say which AI model you
are using and provide the prompt and transcript. I’m not inclined to
accept the authority of some text attributed to AI.
I suspect that your prompt was inappropriate - either that, or your
model did not understand the issue. I’m opting for the former. I said that
you obviously do not understand how such data can be collected, and the
way in which databases are shared across the research community. You
have just proved it.
rant about evidence
One might hope that “AI” would provide relevant sources, and that some
one who quotes AI might take the time to read any references.
Let’s see -
Question from Law stack exchange! It’s safe to say that the answers and comments are varied, but in the specific question, users have consented.
The blog post from Jentis contains no reference to GDPR.
The article from Secure Privacy provides a “complete guide to GDPR compliance” but makes no reference to keystroke or mouse biometrics, and is focussed primarily on cookies and processing issues.
FPTrace is an interesting project that confirms that Browser fingerprinting impacts ad tracking, and provides a framework for future analysis. It has no connection to keystroke or mouse biometrics.
The blog post from Complydog is concerned with data protection under the GDPR, but although it references biometric data it does not specifically reference keystroke or mouse biometrics, but instantiates what one might call “normal” biometrics - Fingerprints and palm prints;Facial recognition data;Voice patterns;DNA
So none of the cited sources support conclusions about behavioral
biometrics and GDPR.
What did catch my eye was this:
the prevailing legal interpretation and regulatory guidance strongly
suggest that such activity violates the GDPR
There is a good deal of interpretation, but there is no regulatory
guidance on whether key or mouse biometrics is personal data. . No
EDPB guidance, no EU wide sources, no CJEU rulings on the issue. There
is guidance from Belgium, which strangely your AI did not reference.
That state guidance does give as examples of behavioral biometric data
“the way the keyboard, touchscreen and mouse are used, as well as the
habits of navigation and workplace behavior in order to authenticate
individuals”, but this is subject to this caveat - “it will always be
necessary to verify, using concrete evidence, whether or not it
constitutes data processing behavioral factors that allow for the unique
identification of individuals”.
And there’s the rub.
This is an irrelevance. If we were to gather behavioral biometrics then
it would be done under fully informed consent. I know a data controller
who would be happy to process and store such data.
Whether there is sufficient interest from users is a separate matter.
I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.
Everyone who knows about GDPR knows fingerprinting users is illegal without consent.
It says in GDPR’s “DEFINITION OF PERSONAL DATA” that anything which can be used to identify a person is personal data.
And other articles in GDPR say that it requires consent. You don’t have to trust me. Go look it up yourself. It’s a law.
Just link us all to at least one organisation which fingerprints european users without getting their consent and isn’t getting fined for it.
Just a little bit of evidence, can you give us that? Because you’re making a lot of claims but nothing to support them.
I’m making it easy for you now to save your reputation because I’m willing to look away from all the other claims you’ve made without anything to support it. All you have to do is show there are orgs/businesses doing mouse movement fingerprinting of EU users without consent and without getting fined for it.
Then your “problem” is solved - nobody can fingerprint you legally without your explicit informed consent. If they do, you can sue them and make of money from that. You can also sue everyone who uses security cameras and records you on video without your consent. You can also visit The Ministry of Silly Walks to teach some advanced walk-kloaking techniques too. You can also sue anyone who photographs you with their personal smartphone. They also have many apps installed that can record your voice while you talk nearby. - Lot’s of money waiting for you! Don’t waste your time on this forum but make money.
The point of an adversarial suite is that you test your implementation against various criterias first and make it freely available to anyone to use, similar to the various browser fingerprinting implementations already publicly available. If you cannot hold that data, than the EFF easily can, they already have lawyers backing their entire organization up, just give them a heads up first.
Did AI produce that for you? It’s on a par with the last piece of AI you
cited.
If you refer to the GDPR you should at least try to read and
understand it.
Painful review of GDPR
No, it doesnt.
Article 4(1):
“personal data” means any information relating to an identified or identifiable natural person (data subject);
No, they dont. Article 6 identifies the lawfulness of processing of personal data.
Consent is only one option.(my emphasis)
Article 6(1).
Processing shall be lawful only if and to the extent that AT LEAST
ONE OF THE FOLLOWING applies:
(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
(c) processing is necessary for compliance with a legal obligation to which the controller is subject;
(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person
(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
You may argue that processing of biometric data falls under Article 9,
which deals with special categories of personal data. This is
prohibited, except where ONE OF THE FOLLOWING applies:
(a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;
(b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law…
(c) processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent;
(d) processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members …
(e) processing relates to personal data which are manifestly made public by the data subject;
(f) processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity
(g) processing is necessary for reasons of substantial public interest…
(h) processing is necessary for the purposes of preventive or occupational medicine…,
(i) processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care…
(j) processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purpose…
But does Article 9 apply? It applies to inter alia “the processing
of biometric data for the purpose of uniquely identifying a natural
person”. This is a purpose based limitation, and there are existing
cases where companies argue that their processing of biometric data is
outwith 9(1), as identification is not the purpose.
I dont trust you. This seems to be an area where you have limited
knowledge, but fixed opinions.
Difficult. It’s possible that Cloudflare processes biometric data
under Turnstile, as an ant-bot measure. Exemption could be claimed under
grounds of Legitimate interest and technical necessity. That’s a possible
case. Apparently you want me to do work that the regulators have failed
to do.
But, as I said:
If you are genuinely interested in assessing this specific issue -
biometric gathering in Qubes - focus on that project, not these attempts
at point scoring.
I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.