Home Trade And business Cloudflare says it’s time to end the word “crazy” on CAPTCHA, and...

Cloudflare says it’s time to end the word “crazy” on CAPTCHA, and launches a new replacement process based on security keys.


We are thrilled to have you on our site. If you enjoy the post you have just found kindly Share it with friends.

Cloudflare, who you may know as a DNS provider or as a company explaining why the website you clicked on won’t load, wants to replace the CAPTCHA web “madness” with an entirely new system.

CAPTCHA tests are those tests that you have to pass, often when trying to log into a service, that require you to click pictures of things like buses, footpaths, or bicycles to prove that you are human. (CAPTCHA, if you don’t know, stands for “Fully Automated General Turing to Separate Computers from Humans.”) The problem is that it adds a lot of friction to web use and it can sometimes be difficult to solve. I’m sure I’m not the only one who disappointingly failed a CAPTCHA because I didn’t see this corner of the pedestrian walkway in one frame.

In a blog, Cloudflare says it aims to “Get rid of CAPTCHA completelyBy replacing it with a new way to prove that you are a human being by touching or looking at a device using a system called “Certificate of Encryption of Personality”. For now, it only supports a limited number USB Security Keys Like YubiKeys, but you can test the Cloudflare system yourself now On the company’s website.

I tried it and it worked great. All I had to do was click on the prominent “I am human (experimental)” button on the site, then follow some prompts to specify my passkey, then click on it, then authorize the site to access the key make and model. When I did, the system re-branded me (even though it just brought me back to the blog).

The whole process took a few seconds, and I have to admit it was really nice not to wonder about the adorable photos of the buses and the bus-like things. On top of how fast it all is, this new method could have a huge access advantage, as people with visual impairments may not be able to complete CAPTCHA exams in their current form.

Here is the company’s “promotion” about what’s going on behind the scenes to prove you’re human in its new way:

The short version is that your device has a built-in secure module that contains a unique manufacturer sealed secret. The protection unit is able to prove that it has such a secret without revealing it. Cloudflare asks for proof and verifies manufacturer legitimacy.

You can read a more detailed explanation at Company Blog.

While that’s an interesting idea, it might not be the end of CAPTCHA as we know it at the moment. For one thing, you probably won’t see the claim in many places, Cloudflare says it’s just an experiment at the moment, available “on a limited basis in English-speaking areas.” And in its current state, it only works with a limited set of devices: YubiKeys, HyperFIDO keys, and Thetis FIDO U2F keys.

Cloudflare pledges that it will “consider adding more validators as soon as possible.” This might extend to your phone: Cloudflare suggests that you can put a phone on your computer to wirelessly send a signature using NFC. Google can process now Both iPhones And Android phones As physical safety keys; If Google and Apple adhere to Cloudflare’s method, it may drastically lower the barrier to entry for their use, as smartphones are more common than security keys.

However, the Cloudflare system might actually be a worst The solution, according to a reviewer. As Ackerman Yuri (CEO of consulting firm Webauthn Works) pointing to, “The certification does not prove anything other than the device model,” which means it does not actually prove whether someone using an authentication device is, in fact, a human.

Cloudflare basically admits this himself on his blog, claiming that a bird drinks (these Playing birds that frequently dip their beaks in the water) The touch sensor pressed the safety key, thus passing the authentication test. If the purpose of CAPTCHA tests is to prevent robotic farms from crowding websites, we might have to ask whether robotic farms with jury forged security key hardware (or worse) would benefit.

Cloudflare It does not always correlate positively With captcha; In a recent example, the company switched from Google’s reCAPTCHA service to hCaptcha In April 2020And some people They were not fans:

CAPTCHAs also assume that website owners want to allow relatively anonymous traffic, but anonymous identity may not be relevant if the website has your true identity thanks to the login information you provided. And with the recent push against ad targeting, paid in large part by Apple A huge new privacy feature in iOS 14.5 Which asks users if they want to allow each app to track it across the web, it is possible that website providers are turning more toward logins anyway.

Although it definitely appears to be a problem that needs to be managed Even more Links (It is much easier to work with a Excellent password manager!), This change could have the potential benefit of nudging us early on into a future without a password. If you pay more services to get direct connections, that could lead to more of them supporting security keys instead of passwords. And more and more sites that support security keys may press others to support them as well, such as the trend we’re seeing toward two-factor authentication with phones.

Although we didn’t get to that future without a password, the potential Cloudflare replacement for CAPTCHA could be a first step in this direction.

Disclaimer: The opinions expressed within this article are the personal opinions of the author. The facts and opinions appearing in the article do not reflect the views of Algulf.net and Algulf.net does not assume any responsibility or liability for the same.


Please enter your comment!
Please enter your name here