Replace CAPTCHAs with Private Access Tokens | Hacker News Reader

Replace CAPTCHAs with Private Access Tokens

developer.apple.com

18 pointsnojito18 comments

This sounds like a great way to track people

Then I guess its widespread adoption is inevitable, because if there's one thing corporations seem to be incapable of resisting is a more effective way of tracking people.

I can't upvote this enough, there's money in that and whoever owns the infrastructure stands to make money off the data.

"can't upvote this enough" because you think the cryptography is wrong, or because you didn't read the description?

Or because they think tracking is bad....?

The cryptography says tracking a token is not possible. So would you like to elaborate on that point?

I see you made a different comment about correlating connections but you can get a bunch of tokens at once and slowly go through the pile over several hours, as far as I know.

Why would it not be possible? Is the code available for inspection?

Basically, the client picks some numbers, gets one derivative of those numbers signed, and presents a different derivative of its numbers to be verified.

With the right math, there's no way to connect the two transactions.

https://www.ietf.org/id/draft-ietf-privacypass-protocol-04.h...

https://privacypass.github.io/protocol/

Not enough info to track. The website only sees the url you’re going to and the fact you have a token.

So the token doesn't get recorded anywhere? I find that hard to believe

https://blog.cloudflare.com/eliminating-captchas-on-iphones-...

>The website knows only your URL and IP, which it has to know to make a connection.

>The device manufacturer (attester) knows only the device data required to attest your device, but can't tell what website you visited, and doesn’t know your IP.

>Cloudflare knows the site you visited, but doesn’t know any of your device or interaction information.

With how much data cloudflare has access to and how the market for data is, I don't believe it for a second that they can't correlate connections even if what you say is true

Hard to do if they just know the destination url!

And why would they not know anything else? Is everyone on their network using tor?

Uses https://www.ietf.org/id/draft-ietf-privacypass-protocol-04.h... I believe

In what situation does a proof-I-have-a-free-account (token) replace a proof-a-human-initiated-this-action (captcha)? Don't they have completely unrelated goals?

Related text-based explanation of Private Access Tokens.

Privacy Pass: Protocol Design Explanation

https://news.ycombinator.com/item?id=31818700

mTLS and apple/google/other-idp signed short-lived client certs would acheive the same thing in my opinion. Bypass captcha if the client has a cert issued by a trusted idp.

Reply on news.ycombinator.com