Apple Could Kill CAPTCHAs with Private Access Tokens
I posted a comment a few days ago here (<a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=31670689#31671551" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=31670689#31671551</a>) about my views about this “feature”, which I’ll repeat verbatim here. Needless to say, it’s something I don’t like.<p>Original comment follows:<p>In my view, this would just DRM-ize everything on the web. Of course, Cloudflare and Fastly don&#x27;t talk about this much, and Cloudflare keeps assuring you&#x27;ll still get captchas if device attestation fails or is unsupported. But realistically, once all Microsoft, Google and Apple implement it in their devices, there isn&#x27;t much of a reason to keep accepting non-attested devices.
You can already see where this is starting to go - if you&#x27;re using Linux&#x2F;BSD or another niche OS, congratulations, you can&#x27;t submit forms any more. And since device verification would become extremely cheap to perform this way, you&#x27;d also see websites protected entirely by this tech, effectively locking out Linux&#x2F;BSD users.
The Cloudflare article also talks about how, at least in the case of Apple, they&#x27;d run something like a posture assessment to confirm that your device components are genuine. I can also see this new tech locking out users of non-OEM repairs.
This is a much bigger deal than what it seems like on the surface, and I&#x27;m genuinely scared about how this one simple move dwarfs all of the &quot;evil&quot; things that big tech has done so far.