Posted June 21, 2022 Summary When iOS 16 comes out later this fall, you may notice that you don’t have to deal with as many annoying CAPTCHAs asking you to slide a puzzle piece or distinguish between a hill and a mountain. That’s because Apple’s introducing a feature for its iPhones and Macs called Automatic Verification, which let some sites know that you’re not a bot without you actually having to do anything Quotes Quote Apple has worked with two major content delivery networks, Fastly and Cloudflare, to develop the system. When it launches with iOS 16 and macOS Ventura, sites that use either of the services to defend against spam should be able to take advantage of the system and stop showing you so many CAPTCHAs. If you’re attentive to how many sites go down when either Fastly or Cloudflare start to have issues, you’ll know that’s a solid chunk of the internet that may become significantly less annoying (especially to those who see CAPTCHAs more often than average because they use a VPN or clear their cookies frequently). The underlying system, which Apple calls Private Access Tokens, is vaguely reminiscent of its system to replace passwords. Here's a very simplified idea of how it works: your device looks at a variety of factors to determine whether you’re a human. When you go to a website that would normally ask you to fill out a CAPTCHA, that site can ask your phone or computer if a human is using it. If your device says yes, you’ll be let right on through. Thankfully for Android and Windows users, Apple isn’t the only one working on this tech. According to Fastly, Google also helped develop it, and the concept of having a trusted party vouch that you’re a human is being built into internet standards My thoughts There's a deeper dive into how this works in the WWDC video linked if that interestest you. Also, FINALLY. This is honestly something I really am looking forward to. No more extential dread resulting from failing an "Are you a robot?" Question for the 100th time. Apple claims this isn't privacy invasive, and while I am mildly skeptical about that claim, I'm inclined to believe them. Well, Hopefully with apple's scale, this tech actually takes off. Also lemme leave you with this gem: Sources TheVerge (Quote) WWDC Fastly Macrumors AppleInsider "The most important step a man can take. It’s not the first one, is it? It’s the next one. Always the next step, Dalinar." –Chapter 118, Oathbringer, Stormlight Archive #3 by Brandon Sanderson Older stuff: Spoiler "A high ideal missed by a little, is far better than low ideal that is achievable, yet far less effective" If you think I'm wrong, correct me. If I've offended you in some way tell me what it is and how I can correct it. I want to learn, and along the way one can make mistakes; Being wrong helps you learn what's right. Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted June 21, 2022 Can this be spoofed? Specs: Motherboard: Asus X470-PLUS TUF gaming (Yes I know it's poor but I wasn't informed) RAM: Corsair VENGEANCE® LPX DDR4 3200Mhz CL16-18-18-36 2x8GB CPU: Ryzen 9 5900X Case: Antec P8 PSU: Corsair RM850x Cooler: Antec K240 with two Noctura Industrial PPC 3000 PWM Drives: Samsung 970 EVO plus 250GB, Micron 1100 2TB, Seagate ST4000DM000/1F2168 GPU: EVGA RTX 2080 ti Black edition Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted June 21, 2022 36 minutes ago, J-from-Nucleon said: According to Fastly, Google also helped develop it Doesn't Google own/run one of the major captcha services? Motherboard: MSI A320M PRO-VH PLUS ** Processor: AMD Ryzen 2600 3.4 GHz ** Video Card: Nvidia GeForce 1070 TI 8GB Zotac 1070ti Memory: 32GB DDR4 2400 ** Power Supply: 650 Watts Power Supply Thermaltake +80 Bronze Thermaltake PSU 2012 iMac i7 27"; 2007 MBP 2.2 GHZ; Power Mac G5 Dual 2GHZ; B&W G3; Quadra 650; Mac SE iPad Air2; iPhone SE 2020; iPhone 5s; AppleTV 4k Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted June 21, 2022 Me: Was hoping Apple developed a good enough AI to simply trick the Captchas. My eyes see the past… My camera lens sees the present… Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted June 21, 2022 5 hours ago, J-from-Nucleon said: Summary When iOS 16 comes out later this fall, you may notice that you don’t have to deal with as many annoying CAPTCHAs asking you to slide a puzzle piece or distinguish between a hill and a mountain. That’s because Apple’s introducing a feature for its iPhones and Macs called Automatic Verification, which let some sites know that you’re not a bot without you actually having to do anything Quotes My thoughts There's a deeper dive into how this works in the WWDC video linked if that interestest you. Also, FINALLY. This is honestly something I really am looking forward to. No more extential dread resulting from failing an "Are you a robot?" Question for the 100th time. Apple claims this isn't privacy invasive, and while I am mildly skeptical about that claim, I'm inclined to believe them. Well, Hopefully with apple's scale, this tech actually takes off. Also lemme leave you with this gem: Sources TheVerge (Quote) WWDC Fastly Macrumors AppleInsider Wouldn't this mean that a robot is telling the computer that it's user isn't a robot? Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted June 21, 2022 2 hours ago, wamred said: Wouldn't this mean that a robot is telling the computer that it's user isn't a robot? Yup, the trusted robot sees if the user is a robot and tells to the other robot that the user isn't a robot, if indeed the user isnt a robot of course Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted June 21, 2022 so what if I build a robotic arm that taps things on a screen in a repeating manner, wouldn't that get around this? It probably just goes off the fact that software isn't manipulating the device and since the screen is a human interface device, all things touching the screen are considered "human". "If a Lobster is a fish because it moves by jumping, then a kangaroo is a bird" - Admiral Paulo de Castro Moreira da Silva "There is nothing more difficult than fixing something that isn't all the way broken yet." - Author Unknown Spoiler Intel Core i7-3960X @ 4.6 GHz - Asus P9X79WS/IPMI - 12GB DDR3-1600 quad-channel - EVGA GTX 1080ti SC - Fractal Design Define R5 - 500GB Crucial MX200 - NH-D15 - Logitech G710+ - Mionix Naos 7000 - Sennheiser PC350 w/Topping VX-1 Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted June 22, 2022 I solve maybe one of those a month maybe even less. So is captcha even used that much anymore? Also it's probably just a matter of days after the feature gets implemented until people add that functionality to bots to circumvent the whole captcha thing. Which in return means the functionality gets ignored by captcha and you still have to solve it. So what exactly is that feature accomplishing? Desktop: i9-10850K [Noctua NH-D15 Chromax.Black] | Asus ROG Strix Z490-E | G.Skill Trident Z 2x16GB 3600Mhz 16-16-16-36 | Asus ROG Strix RTX 3080Ti OC | SeaSonic PRIME Ultra Gold 1000W | Samsung 970 Evo Plus 1TB | Samsung 860 Evo 2TB | CoolerMaster MasterCase H500 ARGB | Win 10 Display: Samsung Odyssey G7A (28" 4K 144Hz) Laptop: Lenovo ThinkBook 16p Gen 4 | i7-13700H | 2x8GB 5200Mhz | RTX 4060 | Linux Mint 21.2 Cinnamon Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted June 22, 2022 1 hour ago, Montana One-Six said: I solve maybe one of those a month maybe even less. So is captcha even used that much anymore? More likely using a VPN...since a shared IP and a lot more traffic going through it...and specifically a bit of that traffic will malicious traffic which triggers captchas. The thing I wonder about is what mechanism are they using to try avoiding ID'ing an user. I'm assuming there will be communication with a secondary server that does the actual verification. With that said though, you then would have some company knowing the sites you are accessing...which for some would defeat the point of a VPN (as now they have your device fingerprint) 3735928559 - Beware of the dead beef Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted June 22, 2022 On 6/21/2022 at 9:11 PM, williamcll said: Can this be spoofed? If you get hold of apples private keys yes but if you can do that then there are a load of other issues, spoofing a real user is not going to be top of your list I expect selling these keys to some Govs might make a little more money than creating a few bot accounts. Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
Posted June 22, 2022 7 hours ago, wanderingfool2 said: The thing I wonder about is what mechanism are they using to try avoiding ID'ing an user. I'm assuming there will be communication with a secondary server that does the actual verification. I expect they are using the same infra that devs on the platform can use to validate the app is running on an modern apple device and has not been modifed (used by game devs so they don't need nasty kernel drivers for anti cheat) its a cryptographic handshake between the secure enclave of the device, the application hash that you can then validate server side is from a valid apple device and is for a binary signature that you trust. This does not leak any info about the user just that the user is using a modern apple devices and the app talking to you has not been tampered with, I expect they could build ontop of this api to provide a web api with a signed signature providing the same prof. Link to comment Share on other sites More sharing options... Link to post Share on other sites More sharing options...
.thumb.jpg.e4dafad042de9d17285599f16e47b236.jpg)
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now