What makes Nocaptcha different: - Uses WebAuthn standard instead of puzzle-solving - No need for users to remember passwords or solve puzzles - Open source
Current limitation: Working with W3C WebAuthn Community Group on true passkey disposal for this use case.
Looking for feedback particularly on: 1. Integration experience 2. User experience compared to traditional CAPTCHAs
The benefit of this approach is that a bot doesn't have the private key.
Of course you want to be sure that webauthn on boarding can't be botted.
I understand if you say bots are currently not programmed to, but is that why this will temporarily work or is there something more fundamental?
If I had to choose between two evils, I'd rather upload my passport to cloudflare and be able to get anonymous tokens from their API (RSA blind signatures or whatever) to prove I'm a real person and browse the web with Firefox and no closed source components, than be forced into hardware attestation and a locked-down device. But uploading government IDs to a (few) central point(s) of trust will create outcry about privacy whereas hidden cryptography baked into normal people's devices with Google Play Services and Apple Something and just working in the background goes unnoticed until everyone (the 99% who aren't on a custom ROM) already experienced the benefits
For webauthn I know it can be all software, I've used virtual devices for testing a server implementation's security, but I vaguely remember there also being a mode that requires having keys signed by a hardware vendor. Just not sure anymore if that was webauthn or something else related to authentication
Webauthn is not an integrity attestation; it doesn't tell you anything about how trustworthy the client is. Nor is it a uniqueness attestation; an attacker can mint an arbitrary number of different identities at basically no cost. It's a primitive for building account security systems, not one for building abuse prevention ones.
Some relevant HN threads:
https://news.ycombinator.com/item?id=27141593
so you can tell that a token was signed by an official yubikey, apple secure enclave, tpm, etc
for yubikeys the attestation signing certificate is shared between devices, but this number is limited
so you could rate limit... just it would be a horrible experience when you are limited
I’m sure there are a few contenders in the space but one I’m aware of is [worldcoin](https://world.org/)
https://d1sr9z1pdl3mb7.cloudfront.net/wp-content/uploads/202...
He’s done enough damage, let’s not make the creator of the problem in charge of the “solution” that benefits him too.
https://www.buzzfeednews.com/article/richardnieva/worldcoin-...
https://www.technologyreview.com/2022/04/06/1048981/worldcoi...
I know the concerns.
I no longer care. The benefits outweight the costs, imho. I want to be able to tell a site "yes I'm Martin here's proof either ban me or let me in but stop making me jump through hoops to prove ID.
And so that social sites I use will no longer have to deal with undesired non-unique accounts for bot swarms and sockpuppets and the like.
The political usefulness of swarms of bots and sockpuppets is why I have conspiracy theories about the conspiracy theories about digital ID.
Here are two of my own, just to join in:
1. Social credit score system. We should all be able to point our phone at antisocial behavior and damage their score. Until then there's pretty much zero recourse against people who have hostile social behaviors that don't commit a crime (like arguing with the McDonalds employee or causing a scene when someone asks them to turn down their music on the bus). People hate on "Karens" but they're actually our last remaining line of defense against these people.
2. As soon as you get on a public road, the government should have dystopian-level control over your car. You can't speed. You can't run a red light (or it will be video recorded and you'll be insta-billed). When there's a wreck, the camera feed in all nearby vehicles is auto-uploaded to the net so all parties can see what happened, no fuss. Break the rules a few times? That's fine, you get your government issued tiny zip car for a year and we'll see if you can respect the shared roads after that. And, of course, alcohol breath analysis to drive.
I don't think you'll actually want to live in a society that works like this. It's called a panopticon. Like some experimental prisons or the DDR which was basically a nation-prison. Everyone will be living a fake life trying to look good while hiding their real wants and needs. This is not natural for people.
And those things are not crimes for a reason. We can't possibly criminalise every little thing that might annoy someone. Some people are jerks or have a bad day, yes. That's no reason to obliterate the concept of privacy.
Also, something that annoys some people will be loved by others. Opinions are like assholes. Everyone's got one.
> As soon as you get on a public road, the government should have dystopian-level control over your car. You can't speed. You can't run a red light (or it will be video recorded and you'll be insta-billed). When there's a wreck, the camera feed in all nearby vehicles is auto-uploaded to the net so all parties can see what happened, no fuss. Break the rules a few times? That's fine, you get your government issued tiny zip car for a year and we'll see if you can respect the shared roads after that. And, of course, alcohol breath analysis to drive
Just get the self driving cars already. Then there is no more need for traffic policing. And we can just spend our time in the car as we wish. No need to go all Draconian and from a tech difficulty point of view it's similarly heavy.
wow! That's going to work well. Groups never gang up to bully people they disagree with.
https://github.com/openpassport-org/openpassport
I don't have any strong view either way on the government ID verification for online services. At least in theory though, the concept of partial/selective disclosure of passport data seems to be a good middle ground between proving humanity and maintaining privacy.
I do wonder what the macOS workflow looks like, especially if you don't have a fingerprint reader on your keyboard.
But, also.. A hardcoded “what’s 7\1=“ would also achieve the same outcome.
Barrier to beat is “can the attacker put together a webauthn emulator”. Low, but will work for many organisations for a long time.
