zlacker

This proposal does not affect bots producing web content, only (potentially) bots browsing web content.

>>webstr+(OP)
It does affect bots creating social media content.

>>pptr+t5
Not necessarily. Even with WEI, spammers could farm legit tokens and then set up their own api that hands one out to their bot when one is necessary.

>>helloj+sw
My understanding is that you can't reuse tokens, because the system uses challenge response.

>>pptr+m41
But can you get a token and then not send it and save it for later? That's more what I was thinking. Not replay attacks but gathering a bunch of tokens thst are valid but never submitted to the origin, and then provide them via api requests to those that need one to use unauthorized devices with that origin.