Top
Best
New

Posted by eleye 4 days ago

Anonymous credentials: rate-limit bots and agents without compromising privacy(blog.cloudflare.com)
103 points | 64 commentspage 2
notorious_pgb 3 days ago|
This blog post is offensive to me on three levels:

1. It is clearly not written with a desire to actually convey information in a concise, helpful way.

2. It is riddled with advertisements for Cloudflare services which bear absolutely no relevance to the topic at hand

3. The actual point of the article (anonymous rate limiting tokens) is pointlessly obscured by an irrelevant use case (AI agents for some reason)

Of course, the second two points seem to be heavily related to the first.

This is barely any better -- in terms of respect for the reader's intelligence and savviness -- than those "Apple just gave ten million users a reason to THROW AWAY THEIR IPHONES" trash articles. Just slop meant to get you to click on links to Cloudflare services and vaguely associate Cloudflare with the "Agentic AI future", with no actual intention whatsoever of creating a quality article.

Thorrez 3 days ago|
Cloudflare already does rate limiting. They explain in the article why their existing rate limiting solutions (IP, fingerprinting) don't work well with AI. That explains why they need a new solution.
notorious_pgb 3 days ago||
Well, not really. They've explained why their existing solutions don't work well for proxies / gateways, which cloud-based AI agents are an example of.
Thorrez 2 days ago||
With normal proxies / gateways, the users have different browsers, so those can be fingerprinted. With the type of AIs under discussion in the post, the AIs all use the same exact browser version and environment, so fingerprinting cannot distinguish them.
andreapaiola 3 days ago||
Probably not the best example... Without a credit card involvement the case is much much stronger.
edm0nd 4 days ago||
CF = no thanks.

They have the nickname Crimeflare for a reason. They allow hundreds of thousands of criminals to use their services maliciously and its a huge hassle to report them only to be met with their stance of "we are only routing traffic not hosting it" and they wont remove the most blatant phishing and malicious pages.

IlikeKitties 4 days ago||
That makes them almost trustworthy. Ultimately you either have a free internet or an internet free of scams phishing and malware. I'd chose the free internet every time
harshreality 4 days ago||
https://blog.cloudflare.com/how-cloudflare-is-using-automati...

Are you confusing their comments about (paraphrased) "horrible but legal" (up to a point) sites like dailystormer, 8chan, and kiwifarms, with actual blatant phishing sites?

I find it very difficult to believe they won't remove sites involved in clear phishing or malware delivery campaigns, if they can verify it themselves or in cooperation with a security team at a company they trust. That's different from sites that are morally repugnant and whose members spew vitriol, but aren't making any particular threats (and even in cases where there are clear and present threats, CF usually seems to prefer to notify law enforcement, and then follow court orders, rather than inject themselves as a 3rd party judge into the proceedings).

galaxy_gas 1 day ago|||
Lot of phish malware and ddos (booter's) use CF with options WAF=enabled. So tool like urlscan, abuse.ch cannot connect to check for phish or run scan.
edm0nd 3 days ago||||
>I find it very difficult to believe they won't remove sites involved in clear phishing or malware delivery campaigns, if they can verify it themselves or in cooperation with a security team at a company they trust.

You may find it difficult to believe buts its true. Tons of phishing and malicious websites use CF nameservers to prevent ddos attacks and etc and Crimeflare will not terminate their access or accounts when reported for the reason I stated above. Even if it's something obvious like coinbase-account-login.com or etc. they do not give a fuck.

Y-bar 3 days ago|||
> but aren't making any particular threats

This isn’t true about Daily S. They have been actively working towards and expressively proposing a new holocaust for decades now. In what way are they not an existential threat for Jews, or LGBTQ?

decremental 3 days ago||
[dead]
anothernewdude 4 days ago||
Wild future that Cloudflare is making their own crypto to shill.
hedora 4 days ago||
I don’t understand the problem they are trying to solve, and this article is long, so apologies if they actually get around to explaining.

I have a credit card, and an agent. I want a pizza.

These credentials do what, exactly? Prevent the pizza place from taking my money? Allow me to order anonymously so they don’t know where to deliver it?

Also, they are security professionals, so when they say anonymous, they don’t mean pseudonymous, so my agent can produce an unlimited number of identities, right? How do they keep the website from correlating time and IP addresses to link my anonymous requests to a pseudonym?

My cynical take is that the pizzeria has to pay cloudflare a few pennies to process the transaction. What am I missing?

TheColorYellow 4 days ago||
Although this is clearly the equivalent of Cloudflare propaganda, they are trying to address the issue of connecting a user and an agent in a way that respects the users privacy.

They effectively use credentials and cryptography to link the two together in a zero-knowledge type of way. Real issue, although no one is clearly dying for this yet.

Real solution too, but blind credentials and Chaumian signing is equally naive to think it addresses the root issue. Something like Apple will step in to cast a liability shield over all parties and just continue to trap users into the Apple data ecosystem.

The right way to do this is to give the user sovereignty over their identity and usage such that platforms cater to users rather than the middle-men in-between. Harder than what Cloudflare probably wants to truly solve for.

Still, cool article even if a bit lengthy.

hedora 4 days ago||
But, why do we want to tie the agent to the user’s identity?

The interface the user wants is “I pay for and obtain pizza”. The interface the pizzaria wants is “I obtain payment via credit card, and send a pizza to some physical location”.

It doesn’t matter who the agent that orders the pizza is acting on behalf of, or if there is an agent, or if some third party indexed the pizzaria menu, then some anarcho-crypto syndicate based in the White House decided to run an auction, and buy this particular pizza for this particular person.

stubish 3 days ago||
If a malicious user is attacking a site via an agent, the current solution is to block the agent and everyone else using that agent, because the valid requests are indistinguishable from the malicious requests. If the agent passes on a token identifying the users, you can just block agent requests using the malicious user's token.
tennysont 4 days ago|||
I think the idea would be that you ask your credit card to convert $10 into 10 untraceable tokens, and then spend them one at a time. You do a handshake dance with the credit card company so you walk away with tokens that only you know, and you have assurance that the tokens are in the same pool as everyone else who asked for untraceable tokens from that credit card company.

Then you can go and spend them freely. The credit card company (and maybe ever third parties?) can verify that the tokens are valid, but they can't associate them with a user. Assuming that the credit card company keeps a log, they can also verify that a token has never been used before.

In some sense, it's a light-weight and anonymous block chain.

shakir_amarri 4 days ago||
The attempt appears to be to rate limit. The acquisition of access tokens is meant to be rate limited.

Similar logic to SMS verification, but actually private.

donperignon 4 days ago||
I dont get this…
JNz4mapL6XO 3 days ago||
[dead]
donald6 3 days ago|
[flagged]