> We take privacy seriously at Cloudflare, and want to avoid learning any information that could identify you. While there are a lot of technical details I cou

> We take privacy seriously at Cloudflare, and want to avoid learning any information that could identify you. While there are a lot of technical details I could go into about designing security protocols like this, and many security protocols I have evaluated really just reduced to a core proof wrapped in a bunch of adjacent shell game obfuscations, the only thing worth trusting is the incentives. Why does Cloudflare want to avoid identifying you? While it's very cool that Cloudflare is so enthusiastic about new protocols and sharing the details, the technical description in the article describes everything except a protocol that someone with domain competence could reason about directly, while providing exposition on things like curves, external standards, and the ZK protocol it hinges on is buried. Is there a version of this article with a sequence diagram of the protocol, or a BAN logic spec? Having read the article, I am finding it difficult to ascertain what I should find trustworthy, new, or different about the proposal. I tell developers and architects all the time, if they can't express their security protocol in terms and syntax of a protocol like these, I'm going to assert they are full of it: http://www.lsv.fr/Software/spore/table.html http://www.lsv.fr/Software/spore/table.html I am pretty sure cloudflare and the author are not full of it, but some effort to give a nod to convention and demonstrate it would go a long way. Admittedly I'm talking my book here because writing stuff like this has been a big part of my consulting work over the years, but the better developers and even non-experts can reason about proofs and security protocols, the better and more successful they're going to be.