First, decide the question
"Is this a bot?" is usually the wrong question. Channels need to know one of three things:
- Presence: was a real person involved in this specific action?
- Uniqueness: is this one person acting once, not one operator acting a thousand times?
- Intent: did someone decide this particular contact was worth their effort?
The comparison
| Approach | Answers | Strengths | Weaknesses |
|---|---|---|---|
| 1. Puzzles (CAPTCHA) | Nothing reliable | Familiar, cheap | Solved by public models, burdens people, harms accessibility |
| 2. Behavioural and fingerprint detection | Presence, probabilistically | Invisible, works without cooperation from the sender | An arms race, false positives, can't flag an agent acting for a real person |
| 3. Device attestation and passkeys | Presence | Cryptographic, privacy-preserving, a real gesture per action | Proves one device, not one person. Cheap hardware scales it without uniqueness limits |
| 4. Proof of personhood | Uniqueness | Stops one operator posing as thousands | Enrolment friction, privacy concerns, limited adoption |
| 5. Economic cost | Intent | No identity needed, the recipient can impose it alone, agents can comply legitimately | Doesn't prove a person. Payment friction for humans |
1. Puzzles
Covered in detail in CAPTCHA is over. Retire them where you can.
2. Behavioural and fingerprint detection
Scores sessions by how they behave: typing cadence, mouse movement, browser characteristics, network reputation, timing. For email, the equivalents are sending cadence, infrastructure fingerprints and whether a sender has any history. It needs no cooperation from the other side, which is its great advantage. But it is a statistical judgment, attackers adapt to it, and it has no answer to automation acting legitimately for a person.
3. Device attestation and passkeys
A passkey (WebAuthn) can require a fingerprint, face or PIN for each action, so each message or submission carries proof that a person touched a real device. Privacy-preserving tokens, standardised as Privacy Pass, let a device prove it passed a check without revealing who it is. The gap is scale: attestation bounds actions per device, not per operator, and devices can be bought. Paired with anonymous rate limits it becomes much stronger.
4. Proof of personhood
Systems that establish that each credential belongs to exactly one human, through biometrics or in-person verification, answer the uniqueness question directly. They also require people to enrol, raise legitimate privacy concerns, and only work once widely adopted. Right for high-stakes, one-person-one-action settings. Heavy for a contact form.
5. Economic cost
A small refundable deposit on first contact doesn't care whether a person or a program sent the message. It makes each message cost something, which is invisible to one person writing one message and prohibitive for a campaign writing thousands. It needs no identity, no sender adoption and no guessing. Its weakness is payment friction for humans, which prepaid credit and machine payments reduce. The economics.
Combining them
The strongest designs layer methods: invisible detection as a baseline, cost for unknown parties, and attestation as a way to earn a discount or skip the cost. Franked's roadmap follows this shape. See how.