The problem that I feel with this is that Cloudflare is attempting to do what Google did with the mass promotion of Chrome over Firefox and IE from way back in the day: market capture. In this instance, CF's implementation for user v. bot is likely going to only work between browsers that support it and cloudflares' network. If it's made fully open source, so that developers can integrate it on their own self-hosted hardware/networks, it could likely catch on and become a hit. However, i'm left with more doubts on the idea.
https://github.com/antifraudcg/proposals/issues/22 - I'm iffy on the whole idea.
The downside of this proposal, IMO, is that it shifts the burden onto the user to already have some kind of accepted “trust relationship” with the web.
Not necessarily money, although paid subscriptions are one obvious example, but some scarce signal: accounts in good standing, phone numbers, email addresses, subscriptions, long-lived relationships with services, etc. In other words, your ability to move around the web with less friction starts to depend on whether you can present credentials from issuers that other sites are willing to trust.
That feels future-blind to me, because AI agents and scrapers can also operate through real browsers, real accounts, real sessions, and real paid infrastructure. So we are not really proving “human”. We are proving “this traffic is backed by a scarce credential and is currently under a rate limit.”
That may help with volumetric abuse, sure. But it also creates a class problem. A user with paid services, old accounts, phone-verified identities, and mainstream browsers will naturally look more trustworthy than a user who avoids those things. Privacy-focused users, users with fresh accounts, people using niche browsers, VPNs, Tor, self-hosted tools, or independent agents may end up looking suspicious by default.
The proposal says it wants open participation, and that any organisation could theoretically provide credentials. But in practice, sites and Moderators will choose which Anchors they trust. That is where the gatekeeping risk lives. Big platforms, browser vendors, telcos, payment providers, Cloudflare-style anti-abuse networks, and major account providers become credible trust sources. A startup, a small forum, or a random XenForo community probably does not.
So the web slowly becomes: “bring a credential from an issuer we like.”
That is the part I dislike. It feels like lazy solution design: make the victim/user jump through legitimacy hoops, rather than forcing the bot/abuser to prove itself through behaviour, intent, cost, or consequence at the point of abuse.
This is basically the opposite direction to how I think bot defence should work. I would rather assess behaviour and risk at the edge of the actual request than build a web-wide trust economy where the already-established players get to define who starts from a position of trust.
The crypto may be clever. The incentives are the problem.
www.theregister.com
