A method, comprising: receiving, by a server computer system from a client system, a request to access a service provided by the server computer system, wherein the request specifies credentials for a user account associated with the service; determining, by the server computer system, information indicating reported technical features of the client system; selecting, by the server computer system, a particular one of a plurality of challenge problems to provide to the client system, wherein the selecting of the particular challenge problem is based on the reported technical features of the client system such that a particular level of difficulty of the particular challenge problem corresponds to the reported technical features of the client system; determining, by the server computer system, an expected response time of the particular challenge problem for the client system, wherein the determining is based on the information indicating the reported technical features of the client system and the particular level of difficulty of the particular challenge problem; sending, by the server computer system to the client system, an access response that indicates the particular challenge problem; receiving, by the server computer system, a challenge response generated by the client system that includes a proposed solution to the particular challenge problem, wherein the challenge response is received after a measured response time and corresponds to an actual completion time of the challenge problem by the client system; and determining, by the server computer system, whether to authorize the request based on the measured response time and the expected response time of the particular challenge problem for the client system. receiving, by a server computer system from a client system, a request to access a service provided by the server computer system, wherein the request specifies credentials for a user account associated with the service; determining, by the server computer system, information indicating reported technical features of the client system; selecting, by the server computer system, a particular one of a plurality of challenge problems to provide to the client system, wherein the selecting of the particular challenge problem is based on the reported technical features of the client system such that a particular level of difficulty of the particular challenge problem corresponds to the reported technical features of the client system; determining, by the server computer system, an expected response time of the particular challenge problem for the client system, wherein the determining is based on the information indicating the reported technical features of the client system and the particular level of difficulty of the particular challenge problem; sending, by the server computer system to the client system, an access response that indicates the particular challenge problem; receiving, by the server computer system, a challenge response generated by the client system that includes a proposed solution to the particular challenge problem, wherein the challenge response is received after a measured response time and corresponds to an actual completion time of the challenge problem by the client system; and determining, by the server computer system, whether to authorize the request based on the measured response time and the expected response time of the particular challenge problem for the client system.