Replace CAPTCHAs with Private Access Tokens

Re:Replace CAPTCHAs with Private Access Tokens by feet on Monday June 20, 2022 @07:56PM (#31817882)

This sounds like a great way to track people

[ Parent | on HN ]

Re:Replace CAPTCHAs with Private Access Tokens by pmoriarty on Monday June 20, 2022 @09:08PM (#31818502)

Then I guess its widespread adoption is inevitable, because if there's one thing corporations seem to be incapable of resisting is a more effective way of tracking people.

[ Parent | on HN ]

Re:Replace CAPTCHAs with Private Access Tokens by nekoashide on Monday June 20, 2022 @11:57PM (#31819672)

I can't upvote this enough, there's money in that and whoever owns the infrastructure stands to make money off the data.

[ Parent | on HN ]

Re:Replace CAPTCHAs with Private Access Tokens by Dylan16807 on Tuesday June 21, 2022 @12:08AM (#31819746)

"can't upvote this enough" because you think the cryptography is wrong, or because you didn't read the description?

[ Parent | on HN ]

Re:Replace CAPTCHAs with Private Access Tokens by feet on Tuesday June 21, 2022 @09:00AM (#31823378)

Or because they think tracking is bad....?

[ Parent | on HN ]

Re:Replace CAPTCHAs with Private Access Tokens by Dylan16807 on Tuesday June 21, 2022 @02:10PM (#31827162)

The cryptography says tracking a token is not possible. So would you like to elaborate on that point?

I see you made a different comment about correlating connections but you can get a bunch of tokens at once and slowly go through the pile over several hours, as far as I know.

[ Parent | on HN ]

Re:Replace CAPTCHAs with Private Access Tokens by feet on Tuesday June 21, 2022 @02:33PM (#31827388)

Why would it not be possible? Is the code available for inspection?

[ Parent | on HN ]

Re:Replace CAPTCHAs with Private Access Tokens by Dylan16807 on Tuesday June 21, 2022 @02:53PM (#31827625)

Basically, the client picks some numbers, gets one derivative of those numbers signed, and presents a different derivative of its numbers to be verified.

With the right math, there's no way to connect the two transactions.

https://www.ietf.org/id/draft-ietf-privacypass-protocol-04.h...

https://privacypass.github.io/protocol/

[ Parent | on HN ]

Re:Replace CAPTCHAs with Private Access Tokens by nojito on Tuesday June 21, 2022 @08:54AM (#31823298)

Not enough info to track. The website only sees the url you’re going to and the fact you have a token.

[ Parent | on HN ]

Re:Replace CAPTCHAs with Private Access Tokens by feet on Tuesday June 21, 2022 @09:01AM (#31823382)

So the token doesn't get recorded anywhere? I find that hard to believe

[ Parent | on HN ]

Re:Replace CAPTCHAs with Private Access Tokens by nojito on Tuesday June 21, 2022 @12:22PM (#31825738)

https://blog.cloudflare.com/eliminating-captchas-on-iphones-...

>The website knows only your URL and IP, which it has to know to make a connection.

>The device manufacturer (attester) knows only the device data required to attest your device, but can't tell what website you visited, and doesn’t know your IP.

>Cloudflare knows the site you visited, but doesn’t know any of your device or interaction information.

[ Parent | on HN ]

Re:Replace CAPTCHAs with Private Access Tokens by feet on Tuesday June 21, 2022 @02:04PM (#31827105)

With how much data cloudflare has access to and how the market for data is, I don't believe it for a second that they can't correlate connections even if what you say is true

[ Parent | on HN ]

Re:Replace CAPTCHAs with Private Access Tokens by nojito on Tuesday June 21, 2022 @03:58PM (#31828427)

Hard to do if they just know the destination url!

[ Parent | on HN ]

Re:Replace CAPTCHAs with Private Access Tokens by feet on Tuesday June 21, 2022 @04:37PM (#31828833)

And why would they not know anything else? Is everyone on their network using tor?

[ Parent | on HN ]

Re:Replace CAPTCHAs with Private Access Tokens by nukemandan on Monday June 20, 2022 @09:21PM (#31818598)

Uses https://www.ietf.org/id/draft-ietf-privacypass-protocol-04.h... I believe

[ Parent | on HN ]

Re:Replace CAPTCHAs with Private Access Tokens by remram on Monday June 20, 2022 @11:45PM (#31819599)

In what situation does a proof-I-have-a-free-account (token) replace a proof-a-human-initiated-this-action (captcha)? Don't they have completely unrelated goals?

[ Parent | on HN ]

Re:Replace CAPTCHAs with Private Access Tokens by O__________O on Monday June 20, 2022 @09:36PM (#31818735)

Related text-based explanation of Private Access Tokens.

Privacy Pass: Protocol Design Explanation

https://news.ycombinator.com/item?id=31818700

[ Parent | on HN ]

Re:Replace CAPTCHAs with Private Access Tokens by badrabbit on Monday June 20, 2022 @09:01PM (#31818442)

mTLS and apple/google/other-idp signed short-lived client certs would acheive the same thing in my opinion. Bypass captcha if the client has a cert issued by a trusted idp.

[ Parent | on HN ]