Private Access Tokens: eliminating CAPTCHAs on iPhones and Macs with open standards
Jun 8, 2022Reid Tatoris, Maxime Guerreiro
Summary
Introduced Private Access Tokens (PATs) as a new method for validating human users without CAPTCHAs. PATs leverage an open standard (extension of Privacy Pass protocol) and involve collaboration between device vendors (Attesters) and token issuers (like Cloudflare) to generate anonymous, unforgeable tokens. This significantly improves privacy by validating device authenticity without collecting or storing sensitive user data, and enhances the user experience by removing CAPTCHAs, especially on mobile and API contexts.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack