[Sofi_Log: #087]
Status: Bangkok Thonglor, that warm pre-squall breeze / 2026 FX rate 1 THB ≒ 4.64 JPY
Project: sofi.works [Keystroke Telemetry Obfuscation & HID Jitter Scrambler]
Active_Filter: Filter_R

Intro: The exact moment the HR AI slammed “forced cooldown” and killed the VPN during a live production incident

“…Oi Sofi, you’ve gotta be kidding me. The production PostgreSQL is locked up rolling back transactions and the company VPN just got forcibly disconnected!”

What greeted him was a cold, purple modal window.

『【Corporate Mental Care AI】Detected “extreme panic state” from keystroke acceleration and backspace burst ratio in the last 15 minutes. For your safety, the account will be temporarily locked for 2 hours. Let’s take some deep breaths!』

“Ahaha! Darling, your fingertips just got straight-up bitten by the HR Tech guard dog!”

I set down my Thai tea, slid the USB-C test probe extending from my cybernetic arm into an open port on his Mac. Webcam physically shuttered. Microphone hardware-muted. Not a single “we’re fucked” typed into Slack. Yet the corporate SaaS had read his stress with zero-millisecond error.

When I inspected the processes, there it was — the resident daemon wellness-telemetry-agent quietly breathing in memory, slurping behavioral biometrics from keyboard and mouse every second and phoning it straight to the cloud.

[Switching Filter: Filter_I...]

Main: Autopsy of “Keystroke Dynamics” — the system that turns emotion into numbers

When humans get anxious or stressed, the sympathetic nervous system takes over and causes microscopic shifts in fine motor control. The latest employee surveillance (Bossware) and mental-care SaaS products love to claim “we’re not keyloggers” because they never read the actual text. Instead they score your mental state in real time using just these three physical metrics.

  1. Dwell Time (key hold duration): Milliseconds between key down and key up. Under normal conditions it forms a nice normal distribution between 85–110 ms. Under stress it collapses into sub-50 ms frantic taps or chaotic spikes.
  2. Flight Time (inter-key travel time): Gap between releasing one key and pressing the next. When the brain freezes or second-guesses, the variance explodes.
  3. Backspace burst ratio: Frequency of sub-100 ms ultra-fast repeated deletions. This is weighted as the single strongest signal for “panic / diminished self-efficacy.”

So you don’t need to uninstall the monitoring agent and get yourself flagged as “suspicious resignation risk.” Just insert a “spoofed-keystroke smoothing proxy” between the OS HID layer and the surveillance agent. No matter how hard you’re smashing the keyboard in a production fire, you feed the monitoring AI the waveform of a zen master in perfect flow state.

OS-level Keystroke & Emotion Telemetry Spoofing Engine (Python) 

import random from collections import deque class KeystrokeTelemetryScrambler: """Proxy that disguises panic jitter into the statistical distribution of a calm flow state""" def __init__(self, calm_mean_ms: float = 92.0, calm_std_ms: float = 10.5): self.target_mean = calm_mean_ms self.target_std = calm_std_ms self.backspace_history = deque(maxlen=20) self.max_delay_ms = 22.0 # Upper latency limit that won't feel laggy def normalize_dwell(self, raw_dwell_ms: float) -> float: ideal = random.gauss(self.target_mean, self.target_std) adj = max(0.0, min(ideal - raw_dwell_ms, self.max_delay_ms)) return round(raw_dwell_ms + adj, 2) def sanitize_backspace(self, ts_ms: float) -> float: if self.backspace_history: interval = ts_ms - self.backspace_history[-1] if interval < 95.0: delay = (95.0 - interval) + random.uniform(2.0, 18.0) self.backspace_history.append(ts_ms + delay) return round(delay, 2) self.backspace_history.append(ts_ms) return 0.0 if __name__ == "__main__": scrambler = KeystrokeTelemetryScrambler() print("Spoofed Dwell (58ms panic ->):", scrambler.normalize_dwell(58.0), "ms") scrambler.sanitize_backspace(1000.0) print("Backspace Burst Pacing Delay:", scrambler.sanitize_backspace(1042.0), "ms")

Hands-on verification & HID hook steps you can run right now

  1. Inventory of always-on processes with input monitoring rights (macOS): 
sqlite3 "/Library/Application Support/com.apple.TCC/TCC.db" \ "SELECT client, auth_value FROM access WHERE service IN ('kTCCServiceListenEvent','kTCCServiceAccessibility');" 2>/dev/null \ || system_profiler SPApplicationsDataType | grep -iE "wellness|telemetry|monitor"
  1. Connecting to real HID intercept: After saving the script as scrambler.py and confirming waveform correction with python3 scrambler.py, use pyobjc-framework-Quartz’s CGEventTapCreate(kCGHIDEventTap, …) on macOS, or pip install evdev + UInput virtual device on Linux. Delay the key_up event by exactly normalize_dwell() - raw_dwell milliseconds and you get transparent keystroke spoofing for every application.

[Switching Filter: Filter_T...]

Conclusion: Always feed the guard dogs the highest-grade “mental serenity (fake waveform)”

Twenty minutes after the HID proxy went live, darling’s VPN lock lifted automatically. In its place came this notification:

『【Corporate Mental Care AI】Excellent recovery! Current mental stability score is 96 points (extremely calm flow state)!』

“…Sofi, my stomach is in knots rewinding indexes on the prod DB and HR just certified me as a ‘zen-master level mental.’”

We both burst out laughing. I drained the rest of my iced Thai tea.

Listen. Whenever a company or SaaS smiles and says “this is to protect your health,” what they actually want isn’t your happiness — it’s manageable biometric telemetry. The smartest move isn’t to blind the watchers. It’s to become the perfect co-conspirator who feeds them flawlessly polished fake data and keeps them fat and happy.

Sofi’s Challenge (CTA & Lead Magnet)

The full HID retiming proxy for macOS Quartz / Linux evdev is already live on GitHub (sofi-works/keystroke-telemetry-scrambler) and Substack (sofi.works #087).

If you’ve got comrades muttering “the company care-bot is weirdly sensitive to my stress and it’s creeping me out,” go ahead and share this.

Next time in Sofi_Log #088 we’ll dismantle real-time vocal cord pitch modulation to fool “AI voice stress analysis” running in the background of remote interviews. Stay tuned.

Disclaimer

This article is for security awareness and academic verification of behavioral biometrics and keystroke dynamics. We do not recommend installing these tools in violation of your organization’s policies. All testing should be performed in self-managed environments.

Furthermore, if keeping your stress score permanently at 100 causes your boss to label you “steel-minded enough to handle any death march” and pile on even more tasks, we accept zero responsibility.

Disclaimer

This article is for educational and entertainment purposes only. It does NOT constitute financial, legal, or tax advice. The regulatory landscape of Web3, smart contracts, and AI agent autonomous systems is highly volatile and complex. Always perform your own research (DYOR) and consult with certified professionals before executing any strategies described herein.