The press-and-hold challenge, in a single call

signup.live.com guards its account creation with HUMAN Security's press-and-hold challenge: a button you must hold down until it turns green. It is a behavioural test, not a puzzle — there is nothing to read and nothing to click correctly. Either the press looks like a hand or it does not.

We ran it three times against the live site on 4 August 2026, driving only the agent tools a customer gets. It cleared on each run, in one press_and_hold call.

What the call actually does

The challenge is not one press. It asks for two, and it says so on screen — but the wording is easy to read past, and a single long press is simply ignored while the challenge is still asleep.

So the gesture has three parts:

1. A wake press of about 230 ms. This is what tells the widget a hand has arrived. Without it, everything after is discarded.
2. A pause of roughly 480 ms — the gap a person leaves between realising what is being asked and doing it.
3. The hold itself, 10.1 s, one continuous press.

From challenge to finished account: about eleven seconds.

Why the naive attempt fails

The obvious implementation is one long mousedown, wait, mouseup. That fails, and it fails silently: no error, no rejection message, the button simply never turns green. Nothing in the page tells you the first press was needed.

That is the general shape of behavioural challenges. They rarely reject you. They just do not advance, and you are left assuming your timing was wrong when the problem was the structure of the gesture.

What this does and does not prove

It proves one challenge, on one site, with two independent runs plus a third. It does not prove that every hold challenge everywhere behaves this way, and we do not claim it.

We keep a list of which verification challenges we have provably solved, which ones we fail, and which ones were simply never measured. An entry only moves to "solved" when it cleared end-to-end against the live site, using the agent tools alone, with the next step of the flow actually reached, on at least two runs.

Press-and-hold on signup.live.com is currently the one entry that meets all four conditions. When another does, it will show up there — and if one ever stops working, it drops off there first.