Only humans get in: what actually stops a script

When an event sells out in ninety seconds and reappears on a resale site at four times face value, the tickets did not go to fans who were quick. They went to software, and every genuine person in that queue lost to a script.

Why not a CAPTCHA

A CAPTCHA on a sign-up form protects the form. A script that skips the form and calls the underlying service directly never sees it. The usual answer is a commercial attestation product, which needs a console key, bills above its free tier, and — the part that matters — has to actually be switched on.

We use proof-of-work instead. The browser solves a small cryptographic puzzle while somebody is typing their email: about a tenth of a second on a phone, unnoticed. The challenge is signed by us, single-use, and expires — so it cannot be farmed, replayed, or solved once and reused. Ten thousand sign-up attempts cost hours of CPU instead of seconds.

It is honest about its reach: it guards our own routes, not the data layer underneath them. A product like App Check verifies at the database itself, which is genuinely stronger, and it stays the documented upgrade. What it is not is switched on and pretending — which is the state the alternative was actually in.

Six signals, scored on the server

Alongside the puzzle: whether a hidden field intended for automated form-fillers was completed, how long the form took, whether there was ever a keystroke or a focus event, whether the address is disposable or a role account like admin@, and whether the attestation checked out. The browser gathers hints; the server reaches the verdict, because a client that judged its own humanity would always acquit itself.

A wrong refusal is a real person told they are not one, and they do not come back. A wrong allow is one account somebody suspends in a click. So no single signal refuses on its own — the honeypot is strong evidence, not proof, because password managers fill hidden fields too — and taking a long time over a form counts as human, which is what it is.

A VPN scores zero

A deliberate choice against the industry default. Plenty of platforms treat a VPN as suspicious, which punishes people on a work network, anyone in a country where a VPN is how you reach an ordinary website, and everybody who simply cares about privacy. It also barely inconveniences an actual attacker, who has residential proxies. So it carries no weight at all.

What this covers, and what it does not

It runs at account creation. That is the choke point worth defending, because everything else — buying, presales, partner links — needs an account behind it. Browsing stays open to everyone: locking the public catalogue to stop a scraper breaks the thing the site is for.

What it is not is a queue defence for an on-sale. Inventory holds, per-tier limits and server-side presale gating do that work, and they are separate mechanisms described elsewhere. Anybody selling you one box that does both is selling you a diagram.

Why this is a fairness feature

Every ticket a bot does not get is a ticket available at face value to somebody who wanted to go. That is the entire argument. It is not framed as security because the person it protects is not thinking about security — they are thinking about whether they got in.