4 ms·
Replace CAPTCHAs with Private Access Tokens
- feet 4y agoThis sounds like a great way to track people
- pmoriarty 4y agoThen I guess its widespread adoption is inevitable, because if there's one thing corporations seem to be incapable of resisting is a more effective way of tracking people.
- nekoashide 4y agoI can't upvote this enough, there's money in that and whoever owns the infrastructure stands to make money off the data.
- Dylan16807 4y ago"can't upvote this enough" because you think the cryptography is wrong, or because you didn't read the description?
- feet 4y agoOr because they think tracking is bad....?
- Dylan16807 4y agoThe cryptography says tracking a token is not possible. So would you like to elaborate on that point? I see you made a different comment about correlating connections but you can get a bunch of tokens at once and slowly go through the pile over several hours, as far as I know.
- feet 4y agoWhy would it not be possible? Is the code available for inspection?
- Dylan16807 4y agoBasically, the client picks some numbers, gets one derivative of those numbers signed, and presents a different derivative of its numbers to be verified. With the right math, there's no way to connect the two transactions. https://www.ietf.org/id/draft-ietf-privacypass-protocol-04.html https://www.ietf.org/id/draft-ietf-privacypass-protocol-04.h... https://privacypass.github.io/protocol/ https://privacypass.github.io/protocol/
- nojito 4y agoNot enough info to track. The website only sees the url you’re going to and the fact you have a token.
- feet 4y agoSo the token doesn't get recorded anywhere? I find that hard to believe
- nojito 4y agohttps://blog.cloudflare.com/eliminating-captchas-on-iphones-and-macs-using-new-standard/ https://blog.cloudflare.com/eliminating-captchas-on-iphones-... >The website knows only your URL and IP, which it has to know to make a connection. >The device manufacturer (attester) knows only the device data required to attest your device, but can't tell what website you visited, and doesn’t know your IP. >Cloudflare knows the site you visited, but doesn’t know any of your device or interaction information.
- feet 4y agoWith how much data cloudflare has access to and how the market for data is, I don't believe it for a second that they can't correlate connections even if what you say is true
- _8j50 4y agomTLS and apple/google/other-idp signed short-lived client certs would acheive the same thing in my opinion. Bypass captcha if the client has a cert issued by a trusted idp.
- nukemandan 4y agoUses https://www.ietf.org/id/draft-ietf-privacypass-protocol-04.html https://www.ietf.org/id/draft-ietf-privacypass-protocol-04.h... I believe
- O__________O 4y agoRelated text-based explanation of Private Access Tokens. Privacy Pass: Protocol Design Explanation https://news.ycombinator.com/item?id=31818700 https://news.ycombinator.com/item?id=31818700
- remram 4y agoIn what situation does a proof-I-have-a-free-account (token) replace a proof-a-human-initiated-this-action (captcha)? Don't they have completely unrelated goals?