Dispatch 010
Why Ironwall stopped watching how people move
Early Ironwall research told people from bots by how they move, and scored an AUC of 0.9982 on synthetic data. Grideōs set it aside for cryptographic attestation. This is why.
Before Ironwall used cryptography, it tried physics. Early research fused five behavioural signals to tell people from automated agents: the path of a pointer, the timing between actions, a phone's accelerometer, pointer metadata and the way a page is scrolled. A synthetic data generator produced labelled sessions for people and for three grades of bot.
It worked on paper
On that synthetic data, the classifier reached an AUC of 0.9982 and passed 99.6 percent of simulated people. Those are Grideōs' own figures, on data Grideōs generated. They were never tested against real traffic, and that gap matters.
Why we set it aside
- Motion can be imitated. The fine tremor of a human hand, around 8 to 12 Hz, can be injected as noise by capable automation. Watching behaviour raises the cost of pretending to be human; it does not remove it.
- Watching is a liability. Collecting behavioural telemetry continuously creates exposure under privacy laws such as PIPEDA and the GDPR, and the organizations Ironwall is built for would rightly refuse it.
- It excludes people. A system that judges how someone moves disadvantages people with motor impairments, which is an accessibility failure before it is a compliance risk.
What replaced it
Ironwall now asks a different question: not whether a request moves like a person, but whether it is backed by real, attested hardware. The device's Secure Enclave or TPM signs a one-time challenge through WebAuthn, the biometric unlock stays on the device, and the result is compressed into a zero-knowledge proof that a verifier at the network edge checks in 8.6 ms. In that design the biometric check stays on the device and no motion data is collected. The edge check is live; the attestation and proving steps are published architecture. How Ironwall works.
Why publish a dead end
Because the reasons are the useful part. The research and its synthetic data generator remain public under the MIT licence at kinematic-signal-research, with what was never validated listed plainly. A verification company should show what it rejected and why, not only what it kept.
All dispatches · Facts ledger · Markdown
Bring us a problem.
Tell us about the work, where it gets stuck, and who has to trust the record afterwards. Grideōs reads every brief and replies by email within two business days. You can also write to info@grideos.com. How we handle what you send: privacy notice.