Let The Right One In: Attestation as a Usable CAPTCHA Alternative
summary
The project implements a Cryptographic Attestation of Personhood built on the WebAuthn standard using commercial secure keys and phone biometrics to produce attestation certificates that are shared across at least 100,000 devices. A public demo logs 1896 sessions showing median successful verification at 10.6 seconds versus 24.5 seconds for an image CAPTCHA, a 48.5% session success rate, and 93 survey responses where 75% say they would use it if they have the hardware. Hardware availability, browser compatibility, and attestation communication are the main failure modes.
AI-written summary · about
chapters (13)
- 0:00Intro
- 0:54Design goals for better CAPTCHA
- 2:13Web Authentication: high-level overview
- 2:53Cryptographic attestation in brief
- 3:33What cryptographic attestation provides
- 4:50Evaluation of CAP usability
- 5:19Logged data: verification attempts on public demo
- 7:40User feedback: CAP strengths
- 8:04User feedback: ability to use CAP
- 8:44User feedback: communication
- 9:20Summary of CAP usability findings
- 9:44Security considerations
- 10:18Next steps for CAP
related talks
42mChallenges in User Authentication: Balancing Security & User Experience
31mWeb Authentication - Imagine a World Without Passwords
01mCAPTCHA defeat
07mNot Quite Yourself Today: Behaviour-Based Continuous Authentication in IoT Environments
34mThe Web Authentication API - Imagine a World Without Passwords
22mComplementing Passkeys with Strong Identity Assurance for High-Risk Actions and Account Recovery
28mI'm Not a Human: Breaking the Google Recaptcha
05mSenCAPTCHA: A Mobile-First CAPTCHA Using Orientation Sensors