Cloudflare is testing a system to allow users to use FIDO keys to skip CAPTCHAs.
From a user perspective, a Cryptographic Attestation of Personhood works as follows:
1. The user accesses a website protected by Cryptographic Attestation of Personhood, such as cloudflarechallenge.com.
2. Cloudflare serves a challenge.
3. The user clicks I am human (beta) and gets prompted for a security device.
4. User decides to use a Hardware Security Key.
5. The user plugs the device into their computer or taps it to their phone for wireless signature (using NFC).
6. A cryptographic attestation is sent to Cloudflare, which allows the user in upon verification of the user presence test.
Completing this flow takes five seconds. More importantly, this challenge protects users’ privacy since the attestation is not uniquely linked to the user device. All device manufacturers trusted by Cloudflare are part of the FIDO Alliance. As such, each hardware key shares its identifier with other keys manufactured in the same batch (see Universal 2nd Factor Overview, Section 8). From Cloudflare’s perspective, your key looks like all other keys in the batch.
Cloudflare says it is primarily interested in reducing the amount of time users spend on CAPTCHAs, which it estimates currently take up 500 years of user time every day.
CAPTCHAs are certainly frustrating, and anything that can be done to replace them while still mitigating brute force and DDOS attacks is great. But it would also be great to see FIDO keys become more accepted and normalized across the Internet.