Every field your browser hands over does double duty. Advertisers pay to fill each blank so they can bid on you. Criminals pay to fill the same blanks so they can transact as you. Here is what each one is, and what it does on both sides.
Any web page can read your graphics chip through the browser — no prompt, no notice.
Read as a wealth signal (an Apple M-series says premium device) and as an anchor that re-finds you seconds after you clear cookies.
An attacker sets the same chip in a spoofing browser, and the fraud model sees “same kind of machine” and relaxes.
“Am I on the same kind of machine I always use?”
narrows the crowd 100–1,000×
A short code for how your exact hardware and fonts draw a hidden test image. Two identical MacBooks draw it differently.
The cookie-loss recovery trick — clear your cookies and this stitches you back together.
Replay the stolen code and fraud models that weight it heavily drop their guard.
“Is this the same physical machine as last time?”
often unique among 100,000+ browsers
Worked out from your internet address, sometimes cross-checked with GPS or nearby WiFi.
The bridge from a device to a household — brokers join your block to income, home value, and your neighbors’ profiles. Their income becomes your inferred income.
Route the attack through a hacked home connection in your ZIP so there’s no “impossible travel” flag.
“Is this happening where the real person lives?”
at street-block resolution, nearly one household
The company that owns the block of internet addresses you’re on.
A home broadband provider means a real household — worth more to advertisers than a VPN or a datacenter.
The hardest field to fake, which is why criminals rent networks that route through real hacked home routers in your area.
“Is this a home connection, not a datacenter or a VPN?”
low alone, but the difference between flagged and not even looked at
Your browser reports it with no prompt.
Advertisers bid more to reach you during your active hours.
Set the attacker’s clock to match. A time zone that disagrees with the location is a top fraud trigger.
“Is the machine set up like the real person’s?”
tiny alone, decisive as a coherence check
Your browser and system language.
Splits en-US from en-GB or es-US for targeting — different segments, different bids.
A two-click match: catches sloppy criminals, not organized ones.
“Does this visit speak the real person’s language?”
low, but required for coherence
The wall-clock time, joined with your time zone.
“Late-evening desktop” is a high-intent, high-bid segment for shopping, streaming, and finance.
Time the attack for your normal hours — 9:37 PM from your ZIP looks like you on the couch; 4 AM looks like fraud.
“Is this happening when the real person is awake?”
zero as a value; your hourly pattern is nearly unique
One code made from all of the above and dozens more — fonts, screen size, audio, and more.
The key that joins every signal into one household record: “identity resolution” to advertisers, “device intelligence” to fraud teams. Same math, opposite purpose.
The whole point of the kit — replay it and every system that trusted it now trusts the attacker.
“Is this the same person we’ve seen before?”
enough to pick one person out of the whole internet
The whole industry (advertising, fraud detection, and the criminal market) is built on one assumption: that coherence across these fields is identity. And nothing in any of it says the person answering these questions actually authorized this.
Every field above can be read, bought, and worn. The instrument in your pocket measures what can’t be: not what a machine claims, but what a body does.
The step counter and activity engine read walks, runs, and rides as they happen.
A body carrying the phone, with a gait and rhythm that unfold in real time.
The barometer feels weather move through and floors climbed.
A phone that exists somewhere real, where the air actually changes.
Charging anchors the day: plugged in at night, unplugged in the morning.
The resting rhythm of a phone that lives with a person.
The networks a phone joins and leaves, and the places where it settles.
The homes, routes, and habits of a real life, not a datacenter.
The watch on a wrist, the car’s own audio, the accessories that travel with you.
Independent witnesses that corroborate the phone’s story.
How the phone is held, unlocked, and touched, every time it is picked up.
The same hands, day after day.
Raw readings become evidence the way chapters form: where independent sensors agree. A night of rest is not a sleep tracker’s guess; it is a phone left charging, still, off the road, through the night’s hours. A drive is motion the car itself corroborates when the audio connects. A walk carries its own steps and cadence. The morning begins with a first unlock only a face could give.
And the record binds itself to honesty. These are the actual rules every event must pass before it may exist:
All of it is read and fused on the device. What leaves is the signed claim. How Pulse proves a person →
One signal, authorized by you, that says these fields are me, right now: provable to a bank or a retailer without showing them a single field, switched off by you whenever you want, and out of reach of a rented connection and a spoofing browser, because it’s bound to a live yes, not a recording.
Every field on this page is a problem. Pulse is the answer to all of them at once.