Gesture Dynamics CAPTCHA Emerges as Privacy-Focused Drop-in Alternative to reCAPTCHA
A new open-source project introduces a gesture-dynamics CAPTCHA designed as a drop-in replacement for reCAPTCHA. Instead of forcing users to identify buses or traffic lights, the system asks visitors to draw an arbitrary gesture lasting roughly ten seconds.
The core idea is to classify motor behavior rather than visual content. Eight statistical features, including velocity variance, pause entropy, rhythm irregularity, and correction count, are extracted from the gesture. A local gradient-boosting model handles clear cases in milliseconds, while an LLM is invoked only for uncertain borderline decisions.
The widget is delivered inside an iframe served from the vendor origin. This architecture avoids CORS restrictions and Origin-based bot filters that would arise if the client page called the API directly. Each integration uses a public key bound to an allow-list of domains and a secret key kept on the customer server for token verification.
Privacy protections are explicit: raw coordinates never leave the browser, no image datasets are collected, and no biometric templates are stored. The resulting token carries no user identity and expires after 120 seconds. Because no Google services are involved, sites avoid both data-transfer concerns under GDPR and the need for additional cookie banners.
Integration requires two lines on the client side and a single server-side verification call modeled after reCAPTCHA. On success the loader injects a hidden field named aptogon-response; the backend then posts the token to the verification endpoint using the secret key.
The project acknowledges its limitations. A motivated attacker could eventually imitate human dynamics, and the widget alone does not stop distributed floods through residential proxies. Accessibility accommodations for motor impairments are included, with ongoing collection of feedback to refine the models.
In the Russian market the solution positions itself against Yandex SmartCaptcha, targeting developers who need self-serve privacy controls and cannot rely on reCAPTCHA due to availability or regulatory constraints. Source code, documentation, and live demos are available under the AGPL-3.0 license with a free tier of one thousand verifications per month.
Related articles
PII-Guard: Open-Source Detector for Personal Data in Russian Text
Andrey Ivanov, an NLP researcher at red_mad_robot, has released PII-Guard, an open-source system that detects and masks personal data in Russian text before it reaches language models. The tool combines rule-based checks with a fine-tuned ruBert-base NER model to handle names, addresses, phones, passports, INN, SNILS, bank cards and other entities. It replaces detected PII with structured XML-like tags that preserve grammatical information such as gender and entity ID, allowing models to generate coherent responses that are later restored with real values. The hybrid pipeline first applies normalization, pattern matching, Luhn and weighted checksum validation, and context windows with positive and negative keywords, then merges results with model predictions via an arbitration module. Evaluation on four public datasets, including Hivetrace, alexen2 and alrosait, shows PII-Guard outperforming other open solutions on both strict span matching and type-overlap micro-F1 metrics. The project, including datasets and code, is available on GitHub and aims to reduce leakage risks while maintaining downstream model utility.
Google to Add Explicit Content Warnings in Android System Photo Picker
Google is preparing a new safety feature for the system photo picker in Android that will scan images and videos for explicit or nude content. The tool is designed to warn users before they share intimate photographs, whether accidentally or due to a momentary lapse in judgment. This functionality will operate at the system level, meaning it applies across multiple apps that use the built-in photo selector. The feature aims to reduce the risk of unintended distribution of private images that could lead to embarrassment or privacy violations. By integrating the check directly into Android, Google seeks to provide a consistent layer of protection without requiring third-party applications to implement similar logic themselves.
LG Smart TVs Record Audio in Standby Mode and Scan Home Networks for Advertising Data
Researchers from the Gamers Nexus YouTube channel analyzed multiple LG OLED television models, including the LG G5 series, and discovered that the devices continue to capture audio through built-in microphones even when the screen is off and the television is in standby. The TVs scan local networks to identify smartphones and smartwatches, collect internal IP addresses, available Wi-Fi network names, and location data. When internet connectivity is removed, audio recordings are stored locally and transmitted once the connection is restored. The devices also employ Automatic Content Recognition (ACR) technology to generate digital fingerprints of viewed content, with the resulting data reportedly sent to LG Ad Solutions for targeted advertising. Additional vulnerabilities were identified in webOS that could potentially allow remote code execution. LG has not yet commented on the findings, and experts recommend disconnecting the televisions from the internet and using external streaming devices until official clarification is provided.
Engineer Details Six Weeks Spent Training and Testing Signature Redaction Models for Closed-Loop Document Anonymization
A detailed case study describes attempts to automatically redact handwritten signatures from scanned and text-based PDFs containing personal data such as names, phones, addresses and signatures. The work was performed inside an air-gapped environment on a single GPU machine with no internet access. Multiple approaches including color-based ink gates, pre-trained YOLO detectors, custom-trained YOLO11s models, Tesseract OCR heuristics and various vision-language OCR engines were evaluated on 492 real pages plus synthetic augmentations. Key findings include rotation handling bugs, line-assembly failures in Tesseract, the necessity of using apply_redactions instead of draw_rect for true removal, and the limited value of vision models once rule-based pipelines are mature. The final pipeline reduced expensive vision-model calls from 50 pages to 18 pages while achieving zero leaks across thousands of redactions. The author also measured twelve OCR engines and demonstrated that combining PaddleOCR detection with Tesseract recognition yields the best accuracy-to-speed trade-off.