Let The Right One In: Attestation as a Usable CAPTCHA Alternative

Abstract

CAPTCHAs are necessary to protect websites from bots and malicious crawlers, yet are increasingly solvable by automated systems. This has led to more challenging tests that require greater human effort and cultural knowledge; they may prevent bots effectively but sacrifice usability and discourage the human users they are meant to admit. We propose a new class of challenge: a Cryptographic Attestation of Personhood (CAP) as the foundation of a usable, pro-privacy alternative. Our challenge is constructed using the open Web Authentication API (WebAuthn) that is supported in most browsers. We evaluated the CAP challenge through a public demo, with an accompanying user survey. Our evaluation indicates that CAP has a strong likelihood of adoption by users who possess the necessary hardware, showing good results for effectiveness and efficiency as well as a strong expressed preference for using CAP over traditional CAPTCHA solutions. In addition to demonstrating a mechanism for more usable challenge tests, we identify some areas for improvement for the WebAuthn user experience, and reflect on the difficult usable privacy problems in this domain and how they might be mitigated.

Citation

@inproceedings{whalen_soups2022,
  author = {Tara Whalen and
            Thibault Meunier and
            Mrudula Kodali and
            Alex Davidson and
            Marwan Fayed and
            Armando Faz-Hernández and
            Watson Ladd and
            Deepak Maram and
            Nick Sullivan and
            Benedikt Wolters and
            Maxime Guerreiro and
            Andrew Galloni},
  title = {Let The Right One In: Attestation as a Usable CAPTCHA Alternative},
  booktitle = {Eighteenth Symposium on Usable Privacy and Security (SOUPS 2022)},
  publisher = {USENIX Association},
  pages = {599--612},
  isbn = {978-1-939133-30-4},
  address = {Boston, MA},
  year = {2022},
  month = {aug}
}