News for hackers. Stuff that matters.

A comment on Replace CAPTCHAs with Private Access Tokens. Parent comment

Re:Replace CAPTCHAs with Private Access Tokens by nekoashide on Monday June 20, 2022 @11:57PM (#31819672)
I can't upvote this enough, there's money in that and whoever owns the infrastructure stands to make money off the data.
[ Parent | on HN ]
Re:Replace CAPTCHAs with Private Access Tokens by Dylan16807 on Tuesday June 21, 2022 @12:08AM (#31819746)
"can't upvote this enough" because you think the cryptography is wrong, or because you didn't read the description?
[ Parent | on HN ]
Re:Replace CAPTCHAs with Private Access Tokens by feet on Tuesday June 21, 2022 @09:00AM (#31823378)
Or because they think tracking is bad....?
[ Parent | on HN ]
Re:Replace CAPTCHAs with Private Access Tokens by Dylan16807 on Tuesday June 21, 2022 @02:10PM (#31827162)
The cryptography says tracking a token is not possible. So would you like to elaborate on that point?

I see you made a different comment about correlating connections but you can get a bunch of tokens at once and slowly go through the pile over several hours, as far as I know.

[ Parent | on HN ]
Re:Replace CAPTCHAs with Private Access Tokens by feet on Tuesday June 21, 2022 @02:33PM (#31827388)
Why would it not be possible? Is the code available for inspection?
[ Parent | on HN ]
Re:Replace CAPTCHAs with Private Access Tokens by Dylan16807 on Tuesday June 21, 2022 @02:53PM (#31827625)
Basically, the client picks some numbers, gets one derivative of those numbers signed, and presents a different derivative of its numbers to be verified.

With the right math, there's no way to connect the two transactions.

https://www.ietf.org/id/draft-ietf-privacypass-protocol-04.h...

https://privacypass.github.io/protocol/

[ Parent | on HN ]