Podcast
Root Causes 334: What Is Attestation on the Web?


Hosted by
Tim Callan
Chief Compliance Officer
Jason Soroko
Fellow
Original broadcast date
September 27, 2023
Most people hate dealing with CAPTCHA, but it offers great benefits for web site operators. In this episode we discuss alternatives to CAPTCHA, how they work, and their pros and cons. Plus, the Get-Off-My-Lawn! browser returns.
Podcast Transcript
Lightly edited for flow and brevity.
And it's interesting, isn't it? Because you and I've talked about AI and isn't attestation becoming more fuzzy when we in terms of the human voice and ways that we express ourselves to each other now. Am I really me, Tim? Or am I artificial intelligence me? Who knows?
A CAPTCHA is a way of saying, hey, I'm a legitimate user. I'm not some kind of bot, or some kind of an entity that is doing something either malicious or unintended, or automated, or something like that.
Well, there are other alternatives to CAPTCHAs. And that is, what happens if you could provide to me some sort of an attestation token, Tim, that I could recognize? If I'm that server who has content that I don't want to have screen scraped, and I want to know that you're a legit human being and not a bot, well, you could provide to me one of these access tokens, it just happens automatically inside your browser. And it's essentially the computer's way of, you know, it's the equivalent to doing the CAPTCHA.
If you think about Apple, Apple has an entire ecosystem of MacBooks and iPhones and iPads and well they know that the browser that they installed in those things is legit. They're the ones that installed it and so therefore I'm looking back here at a website on Apple – developer.apple.com. You search this called challenge: private access tokens. This is from June 9, 2022. And it talks about this very thing about actually being able to possess these tokens, these private access tokens for the exact purpose of having a replacement to CAPTCHAs.
Now why is this coming up? Why this is coming up is because there have been other proposals. We're talking about Cloudflare, Fastly. CDNs. You can imagine how CDNs would have a real interest in being able to have CAPTCHA replacements, because they're the ones offering the access.
And so we're now also talking about Google themselves, with private access tokens. And, so I think, Tim, these kinds of CAPTCHA replacements have been around, but it didn't get to be like, whoa, whoa, hang on, what's going on here, until somebody with as gigantic of a market share as Chrome is trying to decide, alright, is Chrome gonna go to the way of these private access tokens and determine who can get to the web. Because if that happens, then we've got Chrome, we've got Safari and the whole Apple world, and then the CDNs all doing this. And then all of a sudden, wow, that's a whole lot of the world doing private access tokens, essentially, to do CAPTCHA replacements.
So yeah, so just to give that little last piece of information. So what are the downsides? We all hate CAPTCHA. Why wouldn't we all just throw up our hands ago, this is fine. Get rid of CAPTCHA. Fantastic. We're good to go.
Let's talk about people who have legitimate needs to be able to browse around the internet and not have to deal with either CAPTCHAs or these web access tokens, these attestation schemes that we're talking about. What that means is essentially what Google and Apple could do here, right, it's not a stated mission of theirs but you can see one of the gigantic advantages to them is not just getting rid of CAPTCHAs, but it's actually really, really harming competition from other potential browsers.
Fogy browser. Get off our lawn browser. Get off my lawn browser. What's to prevent get off my lawn browser from doing the exact same thing?
So, on the other hand, you could imagine I'm thinking about - now I'm going back a little longer in time, but I'm going back to we had an episode called What is Apple Passkey? I'm looking at 230. Our episode 230. What is Apple Passkey? And we're talking about, of course, it's a different technology but it's the same idea, which is to make the online browsing experience smooth and seamless and roadblock free for our users while keeping them safe.
You can imagine a product manager at Apple sitting here thinking, absolutely, I want this for my iPhone user, or my MacBook user. Of course I do. This feels like this is all kind of part of the same area of interest for these consumer facing technology manufacturers.
Like think about what it takes to get Apple and Google and others to say, yes. That takes a lot. I think what you got to give and take in return is, if you want to be a new player in the browser world, for example, you're probably gonna have to support your own form of WebAuthn within. Otherwise, your users might go, hey, I can't log into websites the way that I used to with Chrome or Safari.
And so I'm not going to sit here and call WebAuthn a potential anti-competitive tool but you can see how Google and Apple employing it, they're raising the bar for other browsers competition. I mean that's the spirit of what you were saying, and I agree with that.
So imagine now, it's not even just you using an obscure browser, potentially. You could be using one of the privacy browsers, and protect - - You see where I'm going with that, right?
What if I'm deciding very explicitly that I would like to have a higher privacy profile and as a result, I get boxed out of all of these either boxed out of these better experiences - - And I think to some degree, you could say, look, if I know that if I'm going to use a privacy browser, I'm going to have to deal with CAPTCHAs, and that's the price I pay, right? Or I know if I'm going to use a privacy browser, then I can't use a PKI based login, and therefore I'm gonna have to log in another way and that's the price I pay. I can make that decision. But to your point, if there are entire experiences or services or areas of what's offered to me that just plain aren't available, now the tradeoff has gotten much greater, and it may be a tradeoff, I'm not willing to make any more.
So not use it, which is what you're saying, but then it really comes down to what's going to be the level of discrimination when you are trying to not use that.
Then if you're going to open up the door to CAPTCHAs still, or, then what opportunity does that give then the bad guys who really are using these kinds of browsers to do bot activity as an example, or, or use user agents to look like that browser? I can just see that it's a bit of a war between the privacy world, the small browser community websites that want to discriminate against, and then what's the gap that's being left open for the actual bad guys that nobody likes to deal with? The people who are causing DDoS, the people who are causing screen scraping and doing bad things? It's gonna be an interesting world. This just another piece that's shaping this, this interesting ecosystem of browsers right now.

