Hacker News Reader

Comment by mrtksn | Hacker News Reader

The next step is device attestation. IIRC Safari already does this, so you should not see captcha on places that support it.

Something that can work on any browser can be like this: Scan the QR code in your iPhone or Android device that supports attestation. Will ask you if you approve login, then will attest for you. If you turn out to be a bad actor, the website can ban this device - so no flooding with a single device.

View on HN

The day this is used widely across browsers is the day devices you own can no longer be flashed with anything other than what the OEM puts on it--even if that is outdated or buggy.

There are over a billion Idevices out there. Malware on just 1% of them can make and control 10 million spam accounts on every site using device attestation, and they're indistinguishable from real users.

Attestation covers much more than the device itself. The whole point is that it establishes there's a chain of trust from the hardware itself to the software being executed. Your average malicious flashlight app might be able to generate valid attestation tokens, but it'll be differentiable from attestation tokens from safari. If you can somehow break this chain of trust, there's way better ways of monetizing this (eg. selling spyware to nation states) than creating a bunch of fake accounts.

Captcha or Attestation doesn't remove the need of moderation. In case of a botnet, an elevated complaints of user device engaging in fraudulent activity can lead to disabling attestation and trigger an investigation. Every iDevice being a member of your site can happen only if you are Google, other than that what you'll see is that some users will engage in shady stuff and blocking them will be enough to keep them out since they wouldn't be able to just sign in with a new account.

These things are always cat and mouse games.

Sounds terrible.

Reply on news.ycombinator.com