Private Access Control Tokens (PACT) are designed to allow sites with strong knowledge of “personhood” to issue anonymous tokens.
A centralization of authorization. So that’s why Google and Microsoft are interested.
If it’s open enough, could still be a net-positive.
Depends on the mechanism though. Too weak and it can be automated and misused, losing “it’s a human”. Too strong and there’s more concerns about privacy, control, and centralization of the selected auth providers and browsers making the selection.
Maybe hosters could use their own trust lists, like Firefox does for certs. But most will just go with the big and common default set.
I’d prefer skipping the anti-ai guards. But having to give a passwort to Google for it? I don’t know. They’d have enough data on me to know I’m a human without it.
This is a press release. Is there more technical or concise information?
Isn’t that a fingerpriting goldmine? I haven’t given it a lot of thought, but most of the mechanicms I can think of will lead to it being somewhat trackable, especially if paired with IP.
Depends on the spec/implementation. If it’s random generated tokens then I imagine they’re not [necessarily] one per user. You could generate an arbitrary number and get new ones arbitrarily, regularly.
Without some technical information, with only this press release, we can’t tell.
Uh, right… Cloudflare??
Yeah the CIA funded project.
