News for hackers. Stuff that matters.

A comment on Replace CAPTCHAs with Private Access Tokens. Parent comment

Re:Replace CAPTCHAs with Private Access Tokens by Dylan16807 on Tuesday June 21, 2022 @02:10PM (#31827162)
The cryptography says tracking a token is not possible. So would you like to elaborate on that point?

I see you made a different comment about correlating connections but you can get a bunch of tokens at once and slowly go through the pile over several hours, as far as I know.

[ Parent | on HN ]
Re:Replace CAPTCHAs with Private Access Tokens by feet on Tuesday June 21, 2022 @02:33PM (#31827388)
Why would it not be possible? Is the code available for inspection?
[ Parent | on HN ]
Re:Replace CAPTCHAs with Private Access Tokens by Dylan16807 on Tuesday June 21, 2022 @02:53PM (#31827625)
Basically, the client picks some numbers, gets one derivative of those numbers signed, and presents a different derivative of its numbers to be verified.

With the right math, there's no way to connect the two transactions.

https://www.ietf.org/id/draft-ietf-privacypass-protocol-04.h...

https://privacypass.github.io/protocol/

[ Parent | on HN ]