Stephen Downes

Websites have good reasons to block bots, spam, and the rest, clearly. And so they have been asking readers to prove that they are human using methods that have become more and more intrusive. And, equally obviously, readers have good reasons for not wanting to be identified by websites; if nothing else, once they know who you are, a deluge of advertising usually follows. So, what, then? Apple and Google both tried, but with solutions that locked the reader into the corporate ecosystem. Cloudflare does things like rate limiting and tests 'of your humanity' (try not to act like a robot for a moment). Here, Mozilla returns to the Privacy Pass protocol, originally developed in 2018. But they need a trusted starting point, which in this scheme is called an 'Anchor'. Anchors are endorsed by other entities (let's just call it a federation, though you won't see that word in this article). In turn, they vouch for browser sessions to moderators, who manage things like access and rate flow. The token you receive from the moderator contains no information about who you are. The system is called Private Access Control Tokens (PACT).