11 ms·

Apple Could Kill CAPTCHAs with Private Access Tokens

iLoveOncall 4y ago
It will kill captchas the same way it killed non USB-C USB ports when apple forced them on Mac. ReCaptcha already doesn't require entering a captcha in 90% of the cases. Adding a man-in-the-middle to avoid captchas is not the solution, improving captcha technology is.
- oefrha 4y ago
  ReCaptcha is already a man-in-the-middle for any non-Google property. This is just switching to another “man” that is less annoying.
  - iLoveOncall 4y ago
    It's adding rather than switching. I doubt Apple has services present on most website, but Google definitely does even without ReCaptcha, such as Analytics, Adsence, etc.
    - chaosbolt 4y ago
      >It's adding rather than switching. I doubt Google has a device present in most peoples' pockets, but Apple definitely does even without iCaptcha, such as the iPhone 13, iPad Air 5th gen, etc.
      - iLoveOncall 4y ago
        Hum, Android has a 71.45% market share for mobile devices, versus only 27.83% for iOS...
        deleted 4y ago
        [deleted]
        stjohnswarts 4y ago
        "only"
        iLoveOncall 4y ago
        In the context of the argument that chaosbolt was making.
  - marmarama 4y ago
    No, it is fundamentally different, because firstly, it requires the client device to be locked down enough - and to monitor your activity enough - that it can provide attestation that the user is human, and secondly, it ties that attestation to an Apple ID so Apple knows exactly which Apple ID accessed which website at what time. ReCaptcha requires neither of these privacy-invading or gatekeeping things. If this becomes standard, this is the end of the open web as we know it, because you will only be able to access many websites if you are using an approved, locked-down browser in a locked-down computing environment, backed by a tech giant who can provide the attestation and ID service. If you care at all about the open web, this must be resisted at all costs.
    - matthias509 4y ago
      It is not true that Apple will know what web sites were visited. The article states “the device manufacturer or attester only knows the minimum amount of device data required for attestation. It doesn't know the destination URL or the user's IP address.”
      - nybble41 4y ago
        That's assuming that the issuer, mediator, and destination are all distinct entities who don't communicate with each other except as described in the protocol. If they are the same entity, or they collaborate, all those nice privacy guarantees disappear. And the destination—not the user—decides which issuers & mediators they accept.
kgwxd 4y ago
Terrible idea. No matter how much time it would save me, I do not want “my” computer doing any work designed to snitch on me.
- theshrike79 4y ago
  It already does. That's what browser profiling is for.
  - xtanx 4y ago
    So lets start by NOT adding more things that snitch.
    - Spivak 4y ago
      Reframe it and it’s not so bad. It’s presenting a tamper evident ID card to a website that’s minted by the manufacturer of your device. Your fake drivers license isn’t snitching on you when the bouncer looks at it. It’s only snitching if you’re trying to get away with something and pretend you’re running unmodified Windows/macOS when you’re not.
      - userbinator 4y ago
        Reframe it again, I'm running a modified OS that is free of spyware and respects my freedom, but the corporate bastards don't want that.
- simonh 4y ago
  >The server doesn't know anything about the device or the person accessing it. What sort of snitching?
  - Zak 4y ago
    It snitches regarding what kind of device and operating system you're using. It currently seems to be limited to Apple devices, but this is the sort of thing I could see Microsoft and Google going for. Put another way, if everyone running unmodified corporate operating systems proves it as a matter of course, it effectively snitches on anyone who isn't. Running Linux? Rooted Android? Anything else weird? If this gets popular, you might not be able to access most of the web with it, at least not without constantly filling in CAPTCHAs.
deweller 4y ago
See https://blog.cloudflare.com/eliminating-captchas-on-iphones-and-macs-using-new-standard/ https://blog.cloudflare.com/eliminating-captchas-on-iphones-... for some details.
amelius 4y ago
So we'll get robots operating iPhones.
- oefrha 4y ago
  Click farms with humans operating fleets of phones has been a thing for years. I’m sure industrial automation will happen to that industry at some point.
- hgazx 4y ago
  That has existed since forever, for example, with the purpose of selling App Store reviews.
  - fmajid 4y ago
    Or Ad fraud.
- stjohnswarts 4y ago
  lol old iPhones will hold their value for much longer.
stevewatson301 4y ago
I posted a comment a few days ago here (https://news.ycombinator.com/item?id=31670689#31671551 https://news.ycombinator.com/item?id=31670689#31671551) about my views about this “feature”, which I’ll repeat verbatim here. Needless to say, it’s something I don’t like. Original comment follows: In my view, this would just DRM-ize everything on the web. Of course, Cloudflare and Fastly don't talk about this much, and Cloudflare keeps assuring you'll still get captchas if device attestation fails or is unsupported. But realistically, once all Microsoft, Google and Apple implement it in their devices, there isn't much of a reason to keep accepting non-attested devices. You can already see where this is starting to go - if you're using Linux/BSD or another niche OS, congratulations, you can't submit forms any more. And since device verification would become extremely cheap to perform this way, you'd also see websites protected entirely by this tech, effectively locking out Linux/BSD users. The Cloudflare article also talks about how, at least in the case of Apple, they'd run something like a posture assessment to confirm that your device components are genuine. I can also see this new tech locking out users of non-OEM repairs. This is a much bigger deal than what it seems like on the surface, and I'm genuinely scared about how this one simple move dwarfs all of the "evil" things that big tech has done so far.
- deleted 4y ago
  [deleted]
- nojito 4y ago
  This isn't DRM. A party is verifying your actions as legitimate and not a bot. There is nothing stopping the Linux/BSD community from implementing something similar. https://www.ietf.org/archive/id/draft-private-access-tokens-01.html https://www.ietf.org/archive/id/draft-private-access-tokens-...
  - giancarlostoro 4y ago
    > There is nothing stopping the Linux/BSD community from implementing something similar. I don't meant to sound negative but wouldn't bots just be able to abuse any FLOSS implementation since they can then fake certain interactions with CloudFlare in the background?
throwoutway 4y ago
Why does this need iCloud and not just use the client? I have three issues with that design: 1) privacy, 2) Apple banning your iCloud account for some reason without recourse, 3) and this further gives BigTech more control to wall off part of the web. And it looks like they went and did this with CloudFlare and Fastly without requests for comments like most web standards?
- jsnell 4y ago
  There's a (draft) RFC with contributions from four companies. It's not, despite what this dumpster fire of an article implies, some kind of Apple-specific innovation. https://www.ietf.org/archive/id/draft-private-access-tokens-01.html https://www.ietf.org/archive/id/draft-private-access-tokens-...
  - throwoutway 4y ago
    Yet Fasty and Cloudlfare are using this while it’s still in Draft?
    - FateOfNations 4y ago
      This is related to the Privacy Pass protocol that Cloudflare has been working on for a while. Their current implementation uses a browser extension. https://blog.cloudflare.com/privacy-pass-v3/ https://blog.cloudflare.com/privacy-pass-v3/
tmikaeld 4y ago
How would this work if it's open source hardware? Then it's not bound to any authority that can prove that you're a human with a real device.
Reason077 4y ago
CAPTCHAs are really getting out of control. While some uses are understandable (want to edit this wiki? prove you're not a robot!), they seem to be popping up on even the most mundane of websites (want to see the results of this google search? prove you're not a robot!) They're bad enough for able-bodied users, and I can only imagine how annoying and discriminatory they are for users of assistive technologies. There really ought to be some sort of law to get rid of them, or at least significantly restrict their use.
- kayodelycaon 4y ago
  Cloudflare uses captchas for proving you’re not a bot under certain circumstances. Like when someone from your IP trips DDoS protection. Google does the same to block scrapping of search results.
  - stjohnswarts 4y ago
    Don't they only do that if you've clicked the box for it though? I don't blame this on cloudflare any more than I would blame them for allowing open text ftp connections. This is on the websites who are the end point.
  - easrng 4y ago
    Somewhat ironically Google doesn't use recaptcha on the Google Account signup page, it's some other internal captcha (the warped-text kinda).
  - Reason077 4y ago
    > "Google does the same to block scrapping of search results." Google, of all companies, should be capable of coming up with a better way to detect and prevent web scraping. Broadly-targeted CAPTCHAs are extremely lazy.
KaiserPro 4y ago
Its basically the same as "sign in with google" IF you've noticed that if you are signed into google with an account in good standing (or even if you're not signed in, but have spent time being signed in) the captcha is pre-filled. this is the same thing, but with apple. they will be harvesting your every web move. That's great assuming they actively invest and look after privacy. However given their history, that can't be assumed.
- kayodelycaon 4y ago
  Did you read how this works? They authenticate a token. Apple doesn’t know what domain or url you’re going to.
  - imwillofficial 4y ago
    But then He couldn’t spread His anti Apple FUD, and that’s no fun
    - KaiserPro 4y ago
      Its not anti apple. I have an iPhone and mac. What I'm against is the breathless "APPLE SAVES THE OPEN INTERNET WITH PRIVACY" which has never been the case. Apple is riddled with trackers, and collects huge amounts of private information. The difference between apple and google is that apple has a better PR system.
      - stjohnswarts 4y ago
        Also google sells it to everyone. Apple uses it for their company sure, but they aren't selling it. The day they do I'm selling all my apple stuff, just like I got off the google train.
      - imwillofficial 4y ago
        This is objectively not true whatsoever. The amount and quality of data that Google and Apple collect are vastly different. This has been measured and confirmed on several occasions. The differences are far different than PR spin. You owning a Mac does not mean your comment isn’t FUD. It is.
Terry_Roll 4y ago
Well at least I wont have to spend hours trying to pass Google's I'm not a Robot test in an attempt to get a passport and out of the UK.
danShumway 4y ago
Whenever I look into attestation, there seems to be an equal mix of people saying that it will kill CAPTCHAs and an equal mix of people saying, "you know that it's not hard to automate a Yubikey, right?" The same goes for privacy. Attestation requires hardware batches be made large enough to provide some privacy protection, and different people seem to interpret the implications of that differently. A couple of people have pointed out, this effectively means you can't revoke a single attestation token without blocking every single person from that hardware batch. It also means that using attestation signals still reveals what batch you're a part of, which is absolutely a fingerprint vector. There's a lot of conflicting information I see about how this is supposed to be helpful, and I'm constantly wondering if I don't understand it, but I'm also constantly wondering if the push for attestation isn't fueled by a little bit of wishful thinking and willful ignorance of the downsides. In this very comment section I'm seeing people claim that this could be easily implemented in Linux, but... how? If the point of an attestation token is that it verifies a human is involved in the process, then it kind seems like it defeats the point to have it in an Open Source implementation that any ROM/OS can be built around. Most other systems I've seen that work this way in the wild don't work in community-run codebases; indie browsers don't get to implement EME in a way that lets them stream Netflix shows. Maybe I'm misunderstanding something, but I've never had attestation explained to me in a way where the claims around what it's capable of and why it can't be abused actually make sense. It feels like a really flawed DRM scheme -- okay, I'll log into a website and the website author will know I'm on an unmodified iOS client from one of X batches of iPhones. That's DRM, how is it not DRM? It's a system for verifying that a local client is unmodified, based on the faulty premise that bots/automation can't be used to send the request from the client.
- Schroedingersat 4y ago
  The answer to that is easy. Any claims about stopping bots or preserving privacy are bald faced lies. It's middlemen rolling out DRM (which has always been about control and killing competition and not about piracy) to permanently force themselves into every online transaction or interaction. With a side benefit of completely eliminating any sort of privacy you might still have.
- userbinator 4y ago
fartcannon 4y ago
AOL was ahead of its time, I see.
AndrianV 4y ago
I'm all for anything that gets rid of those annoying "Click all of the..." CAPTCHAs.
- stjohnswarts 4y ago
  Even if it means you have to register with one of the big 5 tech companies to verify who you are for every single internet connection so they can track your internet behavior and history?
stinkytaco 4y ago
I'm nervous about how these technologies impact public computing like public libraries or other shared networks. We still occasionally run into sites flagging our network as spam and requiring additional attestation (something your average public library user can't really understand or even sometimes cope with) and further barriers make it harder to work around at point of need and more challenging for administrators. I completely understand how this happens, but it's also another way we widen the digital gap with good intentions.
danShumway 4y ago
I'm looking through the official draft for this more (https://www.ietf.org/archive/id/draft-private-access-tokens-01.html https://www.ietf.org/archive/id/draft-private-access-tokens-...) The thing that strikes me is that they bring up Privacy Pass (https://privacypass.github.io/ https://privacypass.github.io/) as related work, and while I've never been completely, totally on board with Privacy Pass, I also feel like the reliance on hardware/OS verification checks here is strictly worse than what Privacy Pass is offering? Forget the user experience for a second and privacy implications (Privacy Pass at least seems to be mostly hardware independent and can work on any device/browser that implements an extension, which has comparatively fewer negative implications for a competitive indie web ecosystem) -- speaking purely as a website operator, hardware checks seem strictly easier to game than a CAPTCHA. So even if I'm not a user trying to use a device that doesn't have these attestation schemes built into it, if I'm an operator wouldn't I prefer to have a protection that's harder to bypass by a click farm? I'm not saying I would be completely thrilled with Privacy Pass either (CAPTCHAs in general are accessibility problems). But should I be thrilled about a version of Privacy Pass that (as far as I can tell) inherently must be more invasive to my hardware, and that isn't guaranteed to work on every device/browser that I use?
sly010 4y ago
Is it just me, or is this a move towards pay per visit in the future?
- dev_tty01 4y ago
  If I could trade making micro payments per visit and have NO advertising and NO tracking and NO cookie config popups, I would take that deal. When I click on some obscure site to read one story, a site I may never visit again, I would much rather toss a tip in the jar to support their efforts than to fill out forms and be prompted to turn off an ad blocker, etc....
  - vetinari 4y ago
    In reality, there would be no such trade. You would have micro payments per visit AND advertising AND tracking AND tracking popups. Because they can and what are you going to do about it anyway?
    - dev_tty01 4y ago
      True enough. Perhaps a standard or a reg could require no ads or tracking if a site accepts micro payments. Maybe the browser could enforce the reg or standard.
traveler01 4y ago
Coming from Apple it only could be bad. One more thing to keep people glued to Apple products.
- PaulDavisThe1st 4y ago
  It's not "from Apple". They just appear to be the first to actually implement the proposal from IETF.
0daystock 4y ago
The only thing this will kill is privacy, as Apple and the rest of the tech gang are only battling over the right to own your identity online, not over your dignity - the basis of privacy.
t_mann 4y ago
Yay, let's put even greater parts of the www behind doors controlled by a handful of megacorps.
stuart78 4y ago
I don't know why I've never been curious about what CAPTCHA stands for, but now that I know I regret those many years of ignorance.
Stevvo 4y ago
Captcha is an integral part of Google's business, I don't see them giving it up easily. They get free labor from significant chunk of the world's population with all that image tagging.
wdb 4y ago
Interesting idea. I am wondering if it can be used to provide 'proof' that a person accessing a site is really whom they they are. Potentially that would avoid the need to ask the person to install custom client certificates in the browser
- easrng 4y ago
  Webauthn is what you're looking for.
shabble 4y ago
and purely by coincidence, it provides a solution to the ever-increasing use of VPNs for sidestepping geofenced services like TV Streaming. I'm sure it's definitely just to weed out those bad actors and their dirty DDoS ways though.
cesarb 4y ago
This is not killing CAPTCHA at all. This is instead using DRM to silently run a CAPTCHA in the background all the time ("[...] can recognize if the client device is following typical user patterns [...]").
pleb_nz 4y ago
And so it begins, The start of another arms race.
DrJosiah 4y ago
Used to work for hCaptcha.com, my thoughts: hCaptcha.com has a "privacy pass", where if you create a user at hCaptcha.com, you can get passes to bypass the captcha itself (because you've already verified through other methods). This is not often used, because guess what? Not many people were bothered by captchas enough to create a user, because no one wants to create another user and be tracked (via privacy pass, across captcha-protected sites) through their user. This was mostly used by disabled users who couldn't pass hCaptcha's offerings. Personally, I'm not interested in "logging in" or passing my "realness" via API from my device(s), as that's just another token to track an individual and their behaviors. Which is also why I haven't created any user for privacy pass myself, and would generally recommend that you not do so in any Apple, Google, etc., related system (not even hCaptcha, unless you're disabled and can't do the captcha itself). I don't know what hCaptcha is doing nowadays. But unless you're disabled, I wouldn't sign up or agree to pass this information from Apple, Google, etc.

It will kill captchas the same way it killed non USB-C USB ports when apple forced them on Mac. ReCaptcha already doesn't require entering a captcha in 90% of the cases. Adding a man-in-the-middle to avoid captchas is not the solution, improving captcha technology is.

oefrha 4y ago
ReCaptcha is already a man-in-the-middle for any non-Google property. This is just switching to another “man” that is less annoying.
- iLoveOncall 4y ago
  It's adding rather than switching. I doubt Apple has services present on most website, but Google definitely does even without ReCaptcha, such as Analytics, Adsence, etc.
  - chaosbolt 4y ago
    >It's adding rather than switching. I doubt Google has a device present in most peoples' pockets, but Apple definitely does even without iCaptcha, such as the iPhone 13, iPad Air 5th gen, etc.
    - iLoveOncall 4y ago
      Hum, Android has a 71.45% market share for mobile devices, versus only 27.83% for iOS...
      - deleted 4y ago
        [deleted]
      - stjohnswarts 4y ago
        "only"
        iLoveOncall 4y ago
        In the context of the argument that chaosbolt was making.
- marmarama 4y ago
  No, it is fundamentally different, because firstly, it requires the client device to be locked down enough - and to monitor your activity enough - that it can provide attestation that the user is human, and secondly, it ties that attestation to an Apple ID so Apple knows exactly which Apple ID accessed which website at what time. ReCaptcha requires neither of these privacy-invading or gatekeeping things. If this becomes standard, this is the end of the open web as we know it, because you will only be able to access many websites if you are using an approved, locked-down browser in a locked-down computing environment, backed by a tech giant who can provide the attestation and ID service. If you care at all about the open web, this must be resisted at all costs.
  - matthias509 4y ago
    It is not true that Apple will know what web sites were visited. The article states “the device manufacturer or attester only knows the minimum amount of device data required for attestation. It doesn't know the destination URL or the user's IP address.”
    - nybble41 4y ago
      That's assuming that the issuer, mediator, and destination are all distinct entities who don't communicate with each other except as described in the protocol. If they are the same entity, or they collaborate, all those nice privacy guarantees disappear. And the destination—not the user—decides which issuers & mediators they accept.

kgwxd 4y ago

Terrible idea. No matter how much time it would save me, I do not want “my” computer doing any work designed to snitch on me.

theshrike79 4y ago
It already does. That's what browser profiling is for.
- xtanx 4y ago
  So lets start by NOT adding more things that snitch.
  - Spivak 4y ago
    Reframe it and it’s not so bad. It’s presenting a tamper evident ID card to a website that’s minted by the manufacturer of your device. Your fake drivers license isn’t snitching on you when the bouncer looks at it. It’s only snitching if you’re trying to get away with something and pretend you’re running unmodified Windows/macOS when you’re not.
    - userbinator 4y ago
      Reframe it again, I'm running a modified OS that is free of spyware and respects my freedom, but the corporate bastards don't want that.
simonh 4y ago
>The server doesn't know anything about the device or the person accessing it. What sort of snitching?
- Zak 4y ago
  It snitches regarding what kind of device and operating system you're using. It currently seems to be limited to Apple devices, but this is the sort of thing I could see Microsoft and Google going for. Put another way, if everyone running unmodified corporate operating systems proves it as a matter of course, it effectively snitches on anyone who isn't. Running Linux? Rooted Android? Anything else weird? If this gets popular, you might not be able to access most of the web with it, at least not without constantly filling in CAPTCHAs.

deweller 4y ago

See https://blog.cloudflare.com/eliminating-captchas-on-iphones-and-macs-using-new-standard/ https://blog.cloudflare.com/eliminating-captchas-on-iphones-... for some details.

amelius 4y ago

So we'll get robots operating iPhones.

oefrha 4y ago
Click farms with humans operating fleets of phones has been a thing for years. I’m sure industrial automation will happen to that industry at some point.
hgazx 4y ago
That has existed since forever, for example, with the purpose of selling App Store reviews.
- fmajid 4y ago
  Or Ad fraud.
stjohnswarts 4y ago
lol old iPhones will hold their value for much longer.

stevewatson301 4y ago

I posted a comment a few days ago here (https://news.ycombinator.com/item?id=31670689#31671551 https://news.ycombinator.com/item?id=31670689#31671551) about my views about this “feature”, which I’ll repeat verbatim here. Needless to say, it’s something I don’t like. Original comment follows: In my view, this would just DRM-ize everything on the web. Of course, Cloudflare and Fastly don't talk about this much, and Cloudflare keeps assuring you'll still get captchas if device attestation fails or is unsupported. But realistically, once all Microsoft, Google and Apple implement it in their devices, there isn't much of a reason to keep accepting non-attested devices. You can already see where this is starting to go - if you're using Linux/BSD or another niche OS, congratulations, you can't submit forms any more. And since device verification would become extremely cheap to perform this way, you'd also see websites protected entirely by this tech, effectively locking out Linux/BSD users. The Cloudflare article also talks about how, at least in the case of Apple, they'd run something like a posture assessment to confirm that your device components are genuine. I can also see this new tech locking out users of non-OEM repairs. This is a much bigger deal than what it seems like on the surface, and I'm genuinely scared about how this one simple move dwarfs all of the "evil" things that big tech has done so far.

deleted 4y ago
[deleted]
nojito 4y ago
This isn't DRM. A party is verifying your actions as legitimate and not a bot. There is nothing stopping the Linux/BSD community from implementing something similar. https://www.ietf.org/archive/id/draft-private-access-tokens-01.html https://www.ietf.org/archive/id/draft-private-access-tokens-...
- giancarlostoro 4y ago
  > There is nothing stopping the Linux/BSD community from implementing something similar. I don't meant to sound negative but wouldn't bots just be able to abuse any FLOSS implementation since they can then fake certain interactions with CloudFlare in the background?

throwoutway 4y ago

Why does this need iCloud and not just use the client? I have three issues with that design: 1) privacy, 2) Apple banning your iCloud account for some reason without recourse, 3) and this further gives BigTech more control to wall off part of the web. And it looks like they went and did this with CloudFlare and Fastly without requests for comments like most web standards?

jsnell 4y ago
There's a (draft) RFC with contributions from four companies. It's not, despite what this dumpster fire of an article implies, some kind of Apple-specific innovation. https://www.ietf.org/archive/id/draft-private-access-tokens-01.html https://www.ietf.org/archive/id/draft-private-access-tokens-...
- throwoutway 4y ago
  Yet Fasty and Cloudlfare are using this while it’s still in Draft?
  - FateOfNations 4y ago
    This is related to the Privacy Pass protocol that Cloudflare has been working on for a while. Their current implementation uses a browser extension. https://blog.cloudflare.com/privacy-pass-v3/ https://blog.cloudflare.com/privacy-pass-v3/

tmikaeld 4y ago

How would this work if it's open source hardware? Then it's not bound to any authority that can prove that you're a human with a real device.

Reason077 4y ago

CAPTCHAs are really getting out of control. While some uses are understandable (want to edit this wiki? prove you're not a robot!), they seem to be popping up on even the most mundane of websites (want to see the results of this google search? prove you're not a robot!) They're bad enough for able-bodied users, and I can only imagine how annoying and discriminatory they are for users of assistive technologies. There really ought to be some sort of law to get rid of them, or at least significantly restrict their use.

kayodelycaon 4y ago
Cloudflare uses captchas for proving you’re not a bot under certain circumstances. Like when someone from your IP trips DDoS protection. Google does the same to block scrapping of search results.
- stjohnswarts 4y ago
  Don't they only do that if you've clicked the box for it though? I don't blame this on cloudflare any more than I would blame them for allowing open text ftp connections. This is on the websites who are the end point.
- easrng 4y ago
  Somewhat ironically Google doesn't use recaptcha on the Google Account signup page, it's some other internal captcha (the warped-text kinda).
- Reason077 4y ago
  > "Google does the same to block scrapping of search results." Google, of all companies, should be capable of coming up with a better way to detect and prevent web scraping. Broadly-targeted CAPTCHAs are extremely lazy.

KaiserPro 4y ago

Its basically the same as "sign in with google" IF you've noticed that if you are signed into google with an account in good standing (or even if you're not signed in, but have spent time being signed in) the captcha is pre-filled. this is the same thing, but with apple. they will be harvesting your every web move. That's great assuming they actively invest and look after privacy. However given their history, that can't be assumed.

kayodelycaon 4y ago
Did you read how this works? They authenticate a token. Apple doesn’t know what domain or url you’re going to.
- imwillofficial 4y ago
  But then He couldn’t spread His anti Apple FUD, and that’s no fun
  - KaiserPro 4y ago
    Its not anti apple. I have an iPhone and mac. What I'm against is the breathless "APPLE SAVES THE OPEN INTERNET WITH PRIVACY" which has never been the case. Apple is riddled with trackers, and collects huge amounts of private information. The difference between apple and google is that apple has a better PR system.
    - stjohnswarts 4y ago
      Also google sells it to everyone. Apple uses it for their company sure, but they aren't selling it. The day they do I'm selling all my apple stuff, just like I got off the google train.
    - imwillofficial 4y ago
      This is objectively not true whatsoever. The amount and quality of data that Google and Apple collect are vastly different. This has been measured and confirmed on several occasions. The differences are far different than PR spin. You owning a Mac does not mean your comment isn’t FUD. It is.

Terry_Roll 4y ago

Well at least I wont have to spend hours trying to pass Google's I'm not a Robot test in an attempt to get a passport and out of the UK.

danShumway 4y ago

Whenever I look into attestation, there seems to be an equal mix of people saying that it will kill CAPTCHAs and an equal mix of people saying, "you know that it's not hard to automate a Yubikey, right?" The same goes for privacy. Attestation requires hardware batches be made large enough to provide some privacy protection, and different people seem to interpret the implications of that differently. A couple of people have pointed out, this effectively means you can't revoke a single attestation token without blocking every single person from that hardware batch. It also means that using attestation signals still reveals what batch you're a part of, which is absolutely a fingerprint vector. There's a lot of conflicting information I see about how this is supposed to be helpful, and I'm constantly wondering if I don't understand it, but I'm also constantly wondering if the push for attestation isn't fueled by a little bit of wishful thinking and willful ignorance of the downsides. In this very comment section I'm seeing people claim that this could be easily implemented in Linux, but... how? If the point of an attestation token is that it verifies a human is involved in the process, then it kind seems like it defeats the point to have it in an Open Source implementation that any ROM/OS can be built around. Most other systems I've seen that work this way in the wild don't work in community-run codebases; indie browsers don't get to implement EME in a way that lets them stream Netflix shows. Maybe I'm misunderstanding something, but I've never had attestation explained to me in a way where the claims around what it's capable of and why it can't be abused actually make sense. It feels like a really flawed DRM scheme -- okay, I'll log into a website and the website author will know I'm on an unmodified iOS client from one of X batches of iPhones. That's DRM, how is it not DRM? It's a system for verifying that a local client is unmodified, based on the faulty premise that bots/automation can't be used to send the request from the client.

Schroedingersat 4y ago
The answer to that is easy. Any claims about stopping bots or preserving privacy are bald faced lies. It's middlemen rolling out DRM (which has always been about control and killing competition and not about piracy) to permanently force themselves into every online transaction or interaction. With a side benefit of completely eliminating any sort of privacy you might still have.
userbinator 4y ago

fartcannon 4y ago

AOL was ahead of its time, I see.

AndrianV 4y ago

I'm all for anything that gets rid of those annoying "Click all of the..." CAPTCHAs.

stjohnswarts 4y ago
Even if it means you have to register with one of the big 5 tech companies to verify who you are for every single internet connection so they can track your internet behavior and history?

stinkytaco 4y ago

I'm nervous about how these technologies impact public computing like public libraries or other shared networks. We still occasionally run into sites flagging our network as spam and requiring additional attestation (something your average public library user can't really understand or even sometimes cope with) and further barriers make it harder to work around at point of need and more challenging for administrators. I completely understand how this happens, but it's also another way we widen the digital gap with good intentions.

danShumway 4y ago

I'm looking through the official draft for this more (https://www.ietf.org/archive/id/draft-private-access-tokens-01.html https://www.ietf.org/archive/id/draft-private-access-tokens-...) The thing that strikes me is that they bring up Privacy Pass (https://privacypass.github.io/ https://privacypass.github.io/) as related work, and while I've never been completely, totally on board with Privacy Pass, I also feel like the reliance on hardware/OS verification checks here is strictly worse than what Privacy Pass is offering? Forget the user experience for a second and privacy implications (Privacy Pass at least seems to be mostly hardware independent and can work on any device/browser that implements an extension, which has comparatively fewer negative implications for a competitive indie web ecosystem) -- speaking purely as a website operator, hardware checks seem strictly easier to game than a CAPTCHA. So even if I'm not a user trying to use a device that doesn't have these attestation schemes built into it, if I'm an operator wouldn't I prefer to have a protection that's harder to bypass by a click farm? I'm not saying I would be completely thrilled with Privacy Pass either (CAPTCHAs in general are accessibility problems). But should I be thrilled about a version of Privacy Pass that (as far as I can tell) inherently must be more invasive to my hardware, and that isn't guaranteed to work on every device/browser that I use?

sly010 4y ago

Is it just me, or is this a move towards pay per visit in the future?

dev_tty01 4y ago
If I could trade making micro payments per visit and have NO advertising and NO tracking and NO cookie config popups, I would take that deal. When I click on some obscure site to read one story, a site I may never visit again, I would much rather toss a tip in the jar to support their efforts than to fill out forms and be prompted to turn off an ad blocker, etc....
- vetinari 4y ago
  In reality, there would be no such trade. You would have micro payments per visit AND advertising AND tracking AND tracking popups. Because they can and what are you going to do about it anyway?
  - dev_tty01 4y ago
    True enough. Perhaps a standard or a reg could require no ads or tracking if a site accepts micro payments. Maybe the browser could enforce the reg or standard.

traveler01 4y ago

Coming from Apple it only could be bad. One more thing to keep people glued to Apple products.

PaulDavisThe1st 4y ago
It's not "from Apple". They just appear to be the first to actually implement the proposal from IETF.

0daystock 4y ago

The only thing this will kill is privacy, as Apple and the rest of the tech gang are only battling over the right to own your identity online, not over your dignity - the basis of privacy.

t_mann 4y ago

Yay, let's put even greater parts of the www behind doors controlled by a handful of megacorps.

stuart78 4y ago

I don't know why I've never been curious about what CAPTCHA stands for, but now that I know I regret those many years of ignorance.

Stevvo 4y ago

Captcha is an integral part of Google's business, I don't see them giving it up easily. They get free labor from significant chunk of the world's population with all that image tagging.

wdb 4y ago

Interesting idea. I am wondering if it can be used to provide 'proof' that a person accessing a site is really whom they they are. Potentially that would avoid the need to ask the person to install custom client certificates in the browser

easrng 4y ago
Webauthn is what you're looking for.

shabble 4y ago

and purely by coincidence, it provides a solution to the ever-increasing use of VPNs for sidestepping geofenced services like TV Streaming. I'm sure it's definitely just to weed out those bad actors and their dirty DDoS ways though.

cesarb 4y ago

This is not killing CAPTCHA at all. This is instead using DRM to silently run a CAPTCHA in the background all the time ("[...] can recognize if the client device is following typical user patterns [...]").

pleb_nz 4y ago

And so it begins, The start of another arms race.

DrJosiah 4y ago

Used to work for hCaptcha.com, my thoughts: hCaptcha.com has a "privacy pass", where if you create a user at hCaptcha.com, you can get passes to bypass the captcha itself (because you've already verified through other methods). This is not often used, because guess what? Not many people were bothered by captchas enough to create a user, because no one wants to create another user and be tracked (via privacy pass, across captcha-protected sites) through their user. This was mostly used by disabled users who couldn't pass hCaptcha's offerings. Personally, I'm not interested in "logging in" or passing my "realness" via API from my device(s), as that's just another token to track an individual and their behaviors. Which is also why I haven't created any user for privacy pass myself, and would generally recommend that you not do so in any Apple, Google, etc., related system (not even hCaptcha, unless you're disabled and can't do the captcha itself). I don't know what hCaptcha is doing nowadays. But unless you're disabled, I wouldn't sign up or agree to pass this information from Apple, Google, etc.