Notes
What we measured, and what it cost us.
Every entry here started as a run against a live site. When a finding contradicted what we had shipped, the finding won — and the entry says so.
2 min readmeasurementcaptcha
The press-and-hold challenge, in a single call
Microsoft's signup runs HUMAN Security's hold challenge. Three runs against the live site, one agent call each — and one detail that makes a naive attempt fail.
Read3 min readmeasurementfingerprinting
Adding noise is the tell, not the disguise
We shipped fingerprint noise twice, on two unrelated axes, and had to take it back out both times. Here is what the numbers said.
Read