Inertial measurement · challenge–response
Is a hand
holding this?
Six channels of accelerometer and gyroscope data, sampled while you complete a randomized tilt task. Nine tests look for the physics a real hand and a real MEMS chip can't help producing.
■ X■ Y■ Z
Linear acceleration, gravity removed · ±2 m/s² full scale
Environment
Result
Read this before you ship it
The readout above is scored on the server. The page only collects samples and a nonce; the server re-runs every test and mints a token bound to that nonce. A client that computed its own verdict could just POST {"human":true}.
This check silently excludes most laptops and desktops, which have no IMU. Use it as one weighted input alongside device attestation, not as a gate on its own.
Against simulated attackers these nine tests score a headless client at 0, a synthetic sensor stream at 18, and a looped replay of a genuine capture at 18, versus 100 for real handheld motion. But an emulator running an honest rigid-body model — integrating gravity through ω × g, adding a plausible noise floor and an 8–12 Hz tremor tone — also scores 100. There is no client-side signal that survives an attacker willing to do the physics properly. What this buys you is cost: it moves the cheapest attacks off the table and forces the rest to build a simulator.