Human Interaction Signature (HIS)
Human Interaction Signature (HIS) is Sentinel's interaction-based detection layer. Instead of relying only on computational cost, HIS observes how a visitor interacts with the page and turns that into a signal estimating whether the session is human or automated — an additional protection layer on top of proof-of-work.
How it works
Automation probability. HIS analyzes interaction signals — pointer and touch movement, page scrolling, element focus and navigation — against patterns that are algorithmically difficult for automated agents to replicate convincingly.
Interaction signature. HIS also derives a hash of interaction characteristics (timing, sequence, movement patterns) unique to that session. This is what prevents a recorded or replayed interaction from being reused across separate verification attempts — a captured signature from one session doesn't transfer to another.
Both outputs feed into the overall risk score alongside Threat Intelligence and other detection signals, driving Adaptive Captcha's difficulty decisions and your Security Group's enforcement policy.
Requirements
- Sentinel version 1.25.0 or later
- Proof-of-Work v2
- ALTCHA Widget v3
The HIS collector is enabled by default in the ALTCHA widget (humanInteractionSignature). See Widget Integration for the client-side option.
Protection modes
Set the mode in your Security Group's HIS settings:
| Mode | Blocks on automation | Adjusts difficulty | Signature reuse |
|---|---|---|---|
| Monitor | No | No | Yes |
| Relaxed | No | Yes | Up to once, with a low penalty |
| Strict | Yes, at/above hisBlockThreshold (default 80%) | Yes | No |
- Monitor — for testing and baseline traffic analysis, without affecting real requests.
- Relaxed — general-purpose default; prioritizes user experience over strict enforcement.
- Strict — for high-risk endpoints (authentication, abuse-prone flows) where you're willing to trade some friction for stronger enforcement.
Configuration
Set via the his, hisBlockThreshold, and hisHashTTL fields in a Security Group rule's set action:
hisBlockThreshold— the automation-probability threshold (0–1) at which Strict mode blocks a request. Default0.8.hisHashTTL— how long an interaction signature is retained to detect reuse. Default12h, minimum10m; the effective TTL is also adjusted based on the automation score.
Limitations
- HIS needs roughly 3 seconds of interaction before verification triggers, and needs interactive elements on the page beyond the widget itself to observe — a bare, static page gives it little to work with.
- It's incompatible with
auto="onload", since no interaction data has been collected yet at load time. - HIS supports assistive technology and keyboard navigation, but these interaction patterns can register a higher automation probability than mouse/touch use. Prefer Relaxed or Monitor mode where accessibility is a priority, rather than Strict.
Related
- Adaptive Captcha
- Autopilot
- Security Groups — the
his,hisBlockThreshold,hisHashTTLrule fields. - Privacy Protection — what interaction data is collected and how it's handled.