zlacker

Apple Could Kill CAPTCHAs with Private Access Tokens

submitted by matthe+(OP) on 2022-06-15 10:46:29 | 134 points 112 comments
[view article] [source] [go to bottom]

NOTE: showing posts with links only show all posts
3. dewell+m1[view] [source] 2022-06-15 11:01:43
>>matthe+(OP)
See https://blog.cloudflare.com/eliminating-captchas-on-iphones-... for some details.
11. stevew+e3[view] [source] 2022-06-15 11:19:37
>>matthe+(OP)
I posted a comment a few days ago here (https://news.ycombinator.com/item?id=31670689#31671551) about my views about this “feature”, which I’ll repeat verbatim here. Needless to say, it’s something I don’t like.

Original comment follows:

In my view, this would just DRM-ize everything on the web. Of course, Cloudflare and Fastly don't talk about this much, and Cloudflare keeps assuring you'll still get captchas if device attestation fails or is unsupported. But realistically, once all Microsoft, Google and Apple implement it in their devices, there isn't much of a reason to keep accepting non-attested devices. You can already see where this is starting to go - if you're using Linux/BSD or another niche OS, congratulations, you can't submit forms any more. And since device verification would become extremely cheap to perform this way, you'd also see websites protected entirely by this tech, effectively locking out Linux/BSD users. The Cloudflare article also talks about how, at least in the case of Apple, they'd run something like a posture assessment to confirm that your device components are genuine. I can also see this new tech locking out users of non-OEM repairs. This is a much bigger deal than what it seems like on the surface, and I'm genuinely scared about how this one simple move dwarfs all of the "evil" things that big tech has done so far.

◧◩
20. nojito+a7[view] [source] [discussion] 2022-06-15 11:55:06
>>stevew+e3
This isn't DRM. A party is verifying your actions as legitimate and not a bot. There is nothing stopping the Linux/BSD community from implementing something similar.

https://www.ietf.org/archive/id/draft-private-access-tokens-...

◧◩
21. jsnell+c7[view] [source] [discussion] 2022-06-15 11:55:19
>>throwo+j5
There's a (draft) RFC with contributions from four companies. It's not, despite what this dumpster fire of an article implies, some kind of Apple-specific innovation.

https://www.ietf.org/archive/id/draft-private-access-tokens-...

◧◩◪◨
41. comboy+hi[view] [source] [discussion] 2022-06-15 13:08:30
>>dingle+9d
It won't stop bots. Have you seen phone farms [1]? Attackers are getting clever (and lazy maybe). They use physical devices. Old ones are cheap, can have broken screens etc. And you can't lock out users with old devices.

We shouldn't fight bots. We should use trust instead. Not global trust, it must be subjective. I trust A, B, C. B trusts D, E. E trusts F. It should be weighted. There's small world effect [2]. There's just a few hops between any two people in the world. It solves SPAM, it solves reviews, scam, news and maybe politics. Somebody please get it done already.

1. https://duckduckgo.com/?q=phone+farm+bots&t=ffab&iar=images&...

2. https://en.wikipedia.org/wiki/Small-world_experiment

◧◩◪◨⬒
52. alexmi+Go[view] [source] [discussion] 2022-06-15 13:41:10
>>comboy+hi
This is known as https://en.wikipedia.org/wiki/Web_of_trust
◧◩◪◨⬒⬓
55. nojito+Up[view] [source] [discussion] 2022-06-15 13:47:02
>>Zak+09
Which is a good thing.

Besides it's an open standard. https://www.ietf.org/archive/id/draft-private-access-tokens-...

◧◩◪◨⬒⬓
63. comboy+Dw[view] [source] [discussion] 2022-06-15 14:14:55
>>alexmi+Go
I'm sorry for not inventing a different name but what I have in mind is very different. Main difference is that it queries recursively automatically, and it is weighted. Weights are very important. This is old version where I had put my ideas [1]. I have no chance touching it anytime soon - it requires focus and solving hard problems (some of which sound lame like usability and bootstrapping). I write these comments hoping that maybe somebody decides to try it. Chances of bootstrapping it are slim (but could start in some niches), but the payout (I mean positive change in society, there's no money to be made here) is huge enough that I think it's worth trying.

Since I wrote it I became confident that algorithm which is used for cumulative trust computation should be up to each node (instead of using zk-SNARks for example). If you trust somebody, you trust them to compute it as they wish. And I would drop dimensionality at least in the beginning. Probably using multiple identities in place of it.

1. http://comboy.pl/wot.html

64. danShu+8x[view] [source] 2022-06-15 14:16:31
>>matthe+(OP)
I'm looking through the official draft for this more (https://www.ietf.org/archive/id/draft-private-access-tokens-...)

The thing that strikes me is that they bring up Privacy Pass (https://privacypass.github.io/) as related work, and while I've never been completely, totally on board with Privacy Pass, I also feel like the reliance on hardware/OS verification checks here is strictly worse than what Privacy Pass is offering?

Forget the user experience for a second and privacy implications (Privacy Pass at least seems to be mostly hardware independent and can work on any device/browser that implements an extension, which has comparatively fewer negative implications for a competitive indie web ecosystem) -- speaking purely as a website operator, hardware checks seem strictly easier to game than a CAPTCHA. So even if I'm not a user trying to use a device that doesn't have these attestation schemes built into it, if I'm an operator wouldn't I prefer to have a protection that's harder to bypass by a click farm?

I'm not saying I would be completely thrilled with Privacy Pass either (CAPTCHAs in general are accessibility problems). But should I be thrilled about a version of Privacy Pass that (as far as I can tell) inherently must be more invasive to my hardware, and that isn't guaranteed to work on every device/browser that I use?

◧◩◪
66. Kaiser+ny[view] [source] [discussion] 2022-06-15 14:22:47
>>kayode+Vd
> Apple doesn’t know what domain or url you’re going to.

I mean the metadata kinda indicates otherwise: https://developer.apple.com/news/?id=huqjyh7k

◧◩◪◨
107. FateOf+id3[view] [source] [discussion] 2022-06-16 08:01:56
>>throwo+Iz
This is related to the Privacy Pass protocol that Cloudflare has been working on for a while. Their current implementation uses a browser extension. https://blog.cloudflare.com/privacy-pass-v3/
[go to top]