I Built a CAPTCHA Killer Using Behavioral Micro-Signals — Here's the Math Behind It

The Problem
CAPTCHAs are the worst UX on the internet. And now they don't even work.
GPT-4V solves image CAPTCHAs with >99% accuracy. Google's reCAPTCHA is essentially a surveillance tool that tracks users across the web in exchange for "free" bot detection. And the $4.1B CAPTCHA industry has no answer.
I decided to build something fundamentally different.
The Insight
When you interact with a device, your body produces involuntary micro-signals. Your hand trembles slightly (3-12Hz physiological tremor). Your scroll speed varies with attention. Your typing rhythm reflects cognitive load. And critically — these signals are correlated because they share physiological drivers.
Your heartbeat creates micro-vibrations in your hand. Your breathing modulates your grip. Your neural oscillations affect your motor planning. This interconnection creates a coherence signature unique to living biological systems.
The 5 Signal Channels

1. Pointer Dynamics typescriptfunction pointerJitter(samples: {x: number, y: number, t: number}[]): number { const displacements = samples.map((s, i) => i > 0 ? Math.sqrt((s.x - samples[i-1].x)2 + (s.y - samples[i-1].y)2) : 0 ).filter(d => d > 0); const mean = displacements.reduce((a, b) => a + b, 0) / displacements.length; const variance = displacements.reduce((a, d) => a + (d - mean)**2, 0) / displacements.length; return Math.min(Math.sqrt(variance) / 5, 1); }
2. Scroll Entropy — Shannon entropy of scroll velocity distribution
3. Keystroke Rhythm — Coefficient of variation of inter-key intervals
4. Micro-Tremor — Power spectral density in the 3-12Hz band
5. Cross-Channel Coherence — Pearson correlation across all channel pairs Why Bots Can't Beat It A bot can fake one channel. For 5 channels, an attacker must satisfy:

10 pairwise coherence constraints
5 marginal distributions
All evolving naturally over time

This is equivalent to real-time neuromuscular simulation.
Try It
bashnpm install @areyouhuman/sdk
jsximport { AreYouHuman } from '@areyouhuman/sdk/react';

siteKey="your_key"
onVerify={(token) => console.log('Human!', token)}
/>
Demo: areyouhuman-io.vercel.app
Full SDK docs: areyouhuman-io.vercel.app/sdk
Technical whitepaper available on request.