this seems like this could be used for abuse. the CAPTCHAs are specifically designed to stop botting on 3rd party websites.
or this will just be another cat and mouse game where the next level of CAPTCHAs get more annoying and invasive to verify we are human
You could get some token from the website. It could include encrypted service name and policies, like rate limit, that the authority should enforce. The client passes the token to the eId authority. The authority signs it and adds timestamp, but no user info. Client gives token to the service. Something like that. This is a bad top of mind example.
I think we'll need to rely a lot more on eID in the future. I think it can be done in a good way but then it needs to be thought through before it gets adopted. And we have to be able to trust the eId institutes.
Anti spams are about detecting whether activities are spam.
Binding an identity, is the naive mechanism that makes us think spam wouldn't happen. All it does is say ok we know it's pug35372 that teared the linens apart.
We can put all measures to authenticate users, won't makes them not potentially bots running havoc right after a manual authentication.
There are even farms, manually created accounts by gig seekers who would fill forms, email and phone number verification for less than a dollar.
The service could send ban or lockout requests to the eId authority so that a misbehaving real life user could be locked out from the service even though the service doesn't know who they are (irl).
I would guess it could even be designed so that the authority doesn't know which services a given user has been banned from either. And all the service would need to know is "This user has violated policy X at <timestamp>".
There are quite a few services that will solve them in a few seconds, costing less than a dollar per 1000 solved tokens for most common CAPTCHA's (e.g ReCAPTCHA v2 and v3).
I recently had to deal with an attacker doing credit card testing that was using one of these services.
Related, I came across this last week, bypassing ReCAPTCHA with Selenium/Python/OpenAI Whisper API:
humans have been training google's ai models for a decade or more each and every time they answered a captcha
at any rate, if someone wants to abuse your site, captcha, and even cloudflare won't help you
> the next level of CAPTCHAs get more annoying and invasive to verify we are human
like the solving puzzles ones? Or more advanced object identification, like selecting the correct orientation? Training more advanced AI now
We didn't open source this functionality on purpose, and are very very specific about what use-cases we onboard that require it.
That being said, we've gotten to learn a lot more about browser fingerprinting and captcha solving and it's a really interesting space.
If you're curious about it, check out this blog post: https://antoinevastel.com/bot detection/2018/01/17/detect-chrome-headless-v2.html