3 ms·
I'm not sure how this kills scraping. (a) an automated UA doing the scraping can implement DBSC. (b) a semi-automated UA can implement DBSC, and allow the use
by jasonjayr 3y ago
I'm not sure how this kills scraping.
(a) an automated UA doing the scraping can implement DBSC.
(b) a semi-automated UA can implement DBSC, and allow the user to step in to interact when needed.
This proposal suggests that TPM is the right/correct way to implement it, but unlike Passkeys, doesn't seem to specify any way to mandate TPM via attestation.
IMHO, I think that if DBSC can be confined to short lifetimes (24h or a browser process lifetime), it's a net gain in security, without changing the privacy threat.