Don't make humans prove they are human Friction
Finding
A lot of websites still ask users to solve CAPTCHAs like:
Select all the traffic lights
Select all the bicycles
It adds friction, especially when the user is just trying to log in, sign up, or continue.
Idea
Instead of showing a CAPTCHA to everyone, the system can first look at different signals to estimate whether the interaction looks normal.
For example:
- Mouse movement and cursor behavior
- How the user moves between elements
- Typing patterns
- Click timing and interaction speed
- Scrolling behavior
- Touch interactions on mobile
- How the page is being navigated
- Unusual request or interaction patterns
If the system has high confidence that the user is genuine, don't show the CAPTCHA at all.
If the behavior looks suspicious, then show an additional verification step.
- Pointer path curved, human speed +26
- Typing rhythm uneven gaps +24
- Click timing 340 ms after focus +22
- Navigation came from the home page +16
- Touch and scroll consistent with the device +12
Why I like it
Most users should not have to solve a security problem that they didn't create.
Security can happen in the background, and the user only needs to be involved when the system is unsure.
Good security should be invisible when possible, and interruptive only when necessary.