this post was submitted on 23 Jun 2026
177 points (98.4% liked)

Technology

87515 readers
2811 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 3 years ago
MODERATORS
L3s@lemmy.world
enu@lemmy.world
technopagan@lemmy.world
L4s@lemmy.world
L3s@hackingne.ws
177
Cloudflare teams up with Chrome, Edge, and Firefox to tackle bot traffic without CAPTCHAs (www.techspot.com)
submitted 2 months ago* (last edited 2 months ago) by FTonsilStones@lemmy.ca to c/technology@lemmy.world
32 comments fedilink hide all child comments
 

Cloudflare is working with the makers of Chrome, Edge, and Firefox on a new way for websites to tell whether incoming traffic is legitimate – without resorting to the usual mix of CAPTCHAs, logins, and extra tracking.

The system is called Private Access Control Tokens, or PACT, and it arrives at a time when bots have surpassed human traffic online.

all 33 comments
sorted by: hot top controversial new old
[–] treadful@lemmy.zip 98 points 2 months ago (3 children)

The basic idea is that sites with strong knowledge of "personhood" can issue anonymous tokens. A user's browser can then present those tokens elsewhere as proof that a human is involved, or that an automated agent is acting on behalf of one, without revealing the person's identity or browsing history.

These issuers will 100% sell these identifiers to be matched up with other databases.

[–] Prove_your_argument@piefed.social 16 points 2 months ago

There's what companies admit to publicly, and then there's what they're working on behind closed doors.

Most EULA have vague lines like "We will use your data to improve our services" which translates to something like: Your data is used in the services we sell.

Perhaps there would be a legal argument against shit like this, but how do you prove it in court? Even if you get discovery the odds of them offering up database tables they've hidden away that key up users to the data is never gonna happen. You'd have to report it as an insider.

Maybe we should be offering up $10m+ whistleblower bounties for stuff like this, because short of giving someone a golden parachute they're sure as shit not going to lose their careers over it.

[–] timestatic@feddit.org 6 points 2 months ago (1 children)

It really depends on the implementation tho. Since Firefox is foss i hope this wont be a proprietary blob so we can actually hold them accountable

[–] 01189998819991197253@infosec.pub 1 points 2 months ago

It's cloudflare. Of course it'll be a proprietary blob.

[–] floquant@lemmy.dbzer0.com 1 points 2 months ago* (last edited 2 months ago) (1 children)

Why do you assume it's one static unchanging token? That's not how cryptography works, you can issue virtually unlimited signatures or challenges/responses without the other party knowing your private key

[–] LodeMike@lemmy.today 0 points 2 months ago (1 children)

It's cryptographically impossible to ensure that kind of security.

[–] floquant@lemmy.dbzer0.com 1 points 2 months ago* (last edited 2 months ago)

Are you saying asymmetric cryptography doesn't exist or is not secure? You may want to collect your research prize and/or bring down the global banking system

[–] shortwavesurfer@lemmy.zip 26 points 2 months ago* (last edited 2 months ago) (1 children)

Clearly, they haven't heard of proof of work.

Ask tor, it helps tremendously.

Hidden services went from being absolutely horribly unreliable to being very reliable.

[–] FG_3479@lemmy.world 2 points 2 months ago (1 children)

It only slows down bots. If a bot is willing to do the PoW then it can get right through.

[–] shortwavesurfer@lemmy.zip 4 points 2 months ago (1 children)

That's true, but I don't really truly think bots need to be entirely stopped. I think they need to be more limited so that they can't just overwhelm a website. And proof of work will do that.

[–] FG_3479@lemmy.world 1 points 2 months ago (2 children)

It depends on the site. For a blog PoW is perfect, however if someone like Facebook or YouTube switched to only PoW then the spam would entirely dominate and make the site unusable.

[–] shortwavesurfer@lemmy.zip 2 points 2 months ago

I think that would depend a lot on the amount of servers serving that service.

If you've only got one server, then the proof of work is going to ramp up quite quickly because of the fact that it can only serve so many requests at a time. If you have 10,000 servers serving the same website, then the proof of work would ramp up pretty slowly because then you can serve a ton more requests at once before needing to kick the proof of work up. Tor currently has a zero proof of work if the service is not under load at all, and then ramps the proof of work up as the service comes under more requests. My thought would be to not have any point where there's a zero proof of work and have a minimum proof of work required of one.

[–] NewNewAugustEast@lemmy.zip 1 points 2 months ago

You make it sound like thats a bad thing.

[–] plz1@sh.itjust.works 25 points 2 months ago (1 children)

This sounds a lot like fingerprinting under the false flag of making user experience better.

[–] tixnou@feddit.cl 7 points 2 months ago

Waiter!!!! Waiter!!!!!! More fingerprinting vectors please!!!

[–] gapa@feddit.nu 21 points 2 months ago (4 children)

I had to solve two captchas last time I tried ordering groceries online.

[–] pinball_wizard@lemmy.zip 7 points 2 months ago* (last edited 2 months ago)

Same here. I'm just going back to cash.

All of this "artificial intelligence security" just gets in the way of basic legal transactions, but all the yes men running it are too spineless to tell their bosses and shareholders how much money they're losing.

[–] Zarobi@aussie.zone 2 points 2 months ago

I keep getting fraud alerts and having to sooth my bank account into permitting my groceries. You'd think after the 20th time on the same day with the same price they'd stop flagging my groceries.

[–] neclimdul@lemmy.world 1 points 2 months ago (1 children)

Why would a grocery... wait... people are having agents order groceries and its causing problems aren't they?

[–] gapa@feddit.nu 2 points 2 months ago

I think it was ddos protection. I have bookmarks for stuff I order regularly and I open a bunch at the same time.

[–] TheDeadInternet@lemmy.world 1 points 2 months ago

The future is great isn't it.

[–] Feyd@programming.dev 19 points 2 months ago (2 children)

I don't see any details here that make me understand how sites couldn't just save the PACT and collude to build profiles.

[–] pinball_wizard@lemmy.zip 2 points 2 months ago* (last edited 2 months ago)

Yes. I would be quite surprised if that detail were present, since these folks seem to just want another way to track people and sell a higher quality profile.

[–] floquant@lemmy.dbzer0.com 1 points 2 months ago (1 children)

I assume it would be something like a key that gets used to generate disposable signatures, not transmitted directly. But I've also been unable to find actual technical details, the article mentions a "GitHub proposal" without linking to it but i couldn't find anything in their repos. Their blog has nothing either

[–] Feyd@programming.dev 1 points 2 months ago

Yeah I'm assuming the goal is some kind of cryptographic process that meets the stated goals. Publishing this news before actually having anything is obviously going to lead to nothing but skepticism though.

[–] Pure_Psykosis@lemmy.ca 16 points 2 months ago

MOZILLA WAS THE CHOSEN ONE. You were supposed to bring balance!

[–] pHr34kY@lemmy.world 8 points 2 months ago* (last edited 2 months ago) (1 children)

This sounds a bit like a passport-stamping scheme. But the passport doesn't have your name and photo on it. Hopefully it only stores verifiable stamps, but not who stamped it.

I hope they use this to tackle age verification. I'd like to just have a token to prove my age without handing over an actual ID to questionable companies.

[–] coolmojo@lemmy.world 10 points 2 months ago

I hope they use this to tackle age verification. I'd like to just have a token to prove my age without handing over an actual ID to questionable companies.

Nope, because what they want is not age verification. They want identity verification.

[–] Fizz@lemmy.nz 6 points 2 months ago (1 children)

Do not lump autonomous agents in with humans wtf

[–] boonhet@sopuli.xyz 11 points 2 months ago

If you do, what's even the point of bot detection?

[–] Zwuzelmaus@feddit.org 2 points 2 months ago

"DO WE LOOK LIKE BOTS?"

No, but you look like bicycles 😁