A great day for non-robots: iOS 16 will bypass CAPTCHAs
- Reference: 1655811911
- News link: https://www.theregister.co.uk/2022/06/21/believe_it_or_not_apple/
- Source link:
The feature does exactly what its name alludes to: automatically verifies devices and Apple ID accounts without any action from the user. When iOS 16 ships later this year, it will eliminate the frustrating requirement to select all the stops signs in a photo or decipher a string of characters.
The news was mentioned at Apple's 33rd annual [1]Worldwide Developer Conference (WWDC) along with the usual slew of features designed to enhance the functionality of iPhones.
[2]
In a corresponding developer video, software engineer Tommy Pauly, who works on the networking stack for Apple's client operating systems, [3]cited user experience, privacy and accessibility as reasons to move away from the old school CAPTCHA verification system.
[4]
[5]
"This kind of tracking is at odds with the direction of internet privacy being taken by Safari, Mail Privacy Protection, and iCloud Private Relay," said Pauly, who noted that someone interacting with a website through an app or browser has already performed actions that are hard for a bot to imitate.
"First, they have an iPhone, iPad, or Mac, and they've unlocked the device with their password, Touch ID, or Face ID. They're almost always signed into the device with their Apple ID. And they've launched a code-signed app," argued the Apple-ite.
[6]To CAPTCHA or not to CAPTCHA? Gartner analyst says OK — but don’t be robotic about it
[7]We sat through Apple's product launch disguised as a dev event so you don't have to
[8]Telegram criticizes Apple for 'intentionally crippling' web app features on iOS
[9]IETF publishes HTTP/3 RFC to take the web from TCP to UDP
To achieve this CAPTCHA-free utopia, available in both iOS 16 and macOS, Apple relies on Private Access Tokens, which use technology in the process of being standardized by industry organization [10]Internet Engineering Task Force (IETF).
Servers request tokens using a HTTP authentication method called PrivateToken. The tokens use RSA Blind Signatures to cryptographically sign off on an attestation check, confirmed via certificates stored in the device without giving away user identities.
[11]
The attester also performs rate-limiting, so abnormal patterns – such as multiple repeat requests – are recognized as such.
Developers can use content delivery networks [12]Fastly and [13]Cloudflare to sign tokens validated by their servers as they've already invested in developing in the standards and made the CAPTCHA eliminating services available – but they won't be the only options. However Pauly noted that any token issuer would have to be a large service that works with, at minimum, hundreds of servers to protect privacy.
The Automatic Verification comes as an option in settings that is enabled by default – meaning authentication on a developer's site shouldn't block the main page load, but instead be treated as a secondary option for CAPTCHA lovers and legacy users alike.
[14]
After all, a very scientific [15]Reg poll last year did determine that 32 percent of readers found them a necessary tool to inflict on users, while only 46 percent chose to nuke them from orbit. ®
Get our [16]Tech Resources
[1] https://www.theregister.com/2022/06/06/apple_wwdc_2022_the_m2/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YrHrJRT9Rm-hnFBHN2kBrwAAAJI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://developer.apple.com/videos/play/wwdc2022/10077/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YrHrJRT9Rm-hnFBHN2kBrwAAAJI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YrHrJRT9Rm-hnFBHN2kBrwAAAJI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2021/06/22/to_use_captcha_or_not/
[7] https://www.theregister.com/2022/06/06/apple_wwdc_2022_the_m2/
[8] https://www.theregister.com/2022/06/14/telegram_safari/
[9] https://www.theregister.com/2022/06/07/http3_rfc_9114_published/
[10] https://datatracker.ietf.org/doc/charter-ietf-privacypass/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YrHrJRT9Rm-hnFBHN2kBrwAAAJI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://www.fastly.com/blog/private-access-tokens-stepping-into-the-privacy-respecting-captcha-less
[13] https://blog.cloudflare.com/eliminating-captchas-on-iphones-and-macs-using-new-standard/
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YrHrJRT9Rm-hnFBHN2kBrwAAAJI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[15] https://www.theregister.com/2021/06/22/to_use_captcha_or_not/
[16] https://whitepapers.theregister.com/
Re: So ...
Merely that they are not robots, I suppose:
- Are you a robot?
- No, there's an app for it!
" First, they have an iPhone, iPad, or Mac, and they've unlocked the device with their password " etc etc.
Yes, but the website that is asking for verification does not know this . There's absolutely nothing in a bog standard HTTP request (which is all the server sees) that indicates any of this. No, not even the misspelled referrer, because that can be easily faked.
"the website that is asking for verification does not know this. There's absolutely nothing in a bog standard HTTP request (which is all the server sees) that indicates any of this."
Yes, hence the complicated encrypted-token-mechanism-thingy referred to in the article
Correct, but all the prelude is bigging up something that isn't really relevant.
For example... I have a device. The filesystem is encrypted. I have to give a password to start it up. Then unlock the SIM. Then turn it on using biometrics or password. Choose the browser, go to a website... lots of manipulations, and it's not a fruity device. So, really, all those steps taken (by the user) are pretty much par for the course these days, aren't they?
>Yes, but the website that is asking for verification does not know this.
I assume this is like a Tesla/BMW.
How do you identify an Apple user? You don't need to - they will tell you
I’m an Apple user :-)
I'm an Apple User - and so's my wife
that also works with Vegans
That's lovely, but...
When will they give me a way to block cookies without having to click on "Reject All" on practically every single website I go on?
Re: That's lovely, but...
Try [1]Consent-o-matic* . Not perfect, but it gets rid of most of them!
Other, similar plugins are also available.
* Link is to the Apple App Store version, but it is available for most common browsers / platforms.
[1] https://apps.apple.com/gb/app/consent-o-matic/id1606897889
Re: That's lovely, but...
AIUI, the UK government is going to do it for everybody
I For One
Am heartily sick of trying to squint to see the number letter combination or if there is a bus, bicycle, car train, bridge, traffic light in some far distant part of a picture & if it overlaps into a adjacent square(s) & if I should click on it as its part of the item being asked to identify.
On a side note, while attempting to communicate with a friend in the UK some years back I was asked to verify & type in the two random words displayed next to her picture. It rather unflatteringly chose the first name of our former pub (Icon) & then called her a minger.
Re: I For One
Please click on 3 the same pictures of hills that were selected as hills by somebody working in a minimum wage click farm in S.E. Asia
> "First, they have an iPhone, iPad, or Mac, and they've unlocked the device with their password, Touch ID, or Face ID. They're almost always signed into the device with their Apple ID. And they've launched a code-signed app," argued the Apple-ite.
Erm no that proves nothing. Lets imagine you have an iPhone, iPad, or Mac, you're signed into the device with your Apple ID and you've unlocked the the device. Now imagine your device has been infected with a virus. This Apple person would consider that virus to be you and allow it to empty your bank account, encrypt your data or whatever it wanted to do on any site the device can access.
And this is what Apple call security.
So ...
They are claiming that iPhone users are mere humans like the rest of us?