E-Business
Cloudflare Launches New Security Key-Based Replacement for CAPTCHA
Cloudflare, which you may know as a provider of DNS services or the company telling you why the website you clicked on won’t load, wants to replace the “madness” of CAPTCHAs across the web with an entirely new system.
CAPTCHAs are those tests you have to take, often when trying to log into a service, that ask you to click images of things like busses or crosswalks or bicycles to prove that you’re a human.
(CAPTCHA, if you didn’t know, stands for “Completely Automated Public Turing test to tell Computers and Humans Apart.”)
The problem is, they add a lot of friction to using the web and can sometimes be difficult to solve — I’m sure I’m not the only person who has frustratingly failed a CAPTCHA because I didn’t see that corner of a crosswalk in one image.
In a blog, Cloudflare says it aims to “get rid of CAPTCHAs completely” by replacing them with a new way to prove you are a human by touching or looking at a device using a system it calls “Cryptographic Attestation of Personhood.” Right now, it only supports a limited number of USB security keys like YubiKeys, but you can test Cloudflare’s system for yourself right now on the company’s website.
I tried it out, and it worked great. All I had to do was click the prominent “I am human (beta)” button on the site, then follow a few prompts to select my security key, then tap it, and then allow the site to access the make and model of the key. When I did, the system waved me through (though it just took me back to the blog).
The whole process took all of a few seconds, and I have to admit that it was really nice not to puzzle over grainy images of busses and bus-looking objects. And in addition to the speed of it all, this new method could have a major accessibility benefit, as those with visual disabilities may not be able to complete CAPTCHAs in their current form.
Here is the company’s “elevator pitch” of what’s going on behind the scenes to establish that you’re a human via its new method: “The short version is that your device has an embedded secure module containing a unique secret sealed by your manufacturer. The security module is capable of proving it owns such a secret without revealing it. Cloudflare asks you for proof and checks that your manufacturer is legitimate.”
You can read a much more extensive explanation on the company’s blog.
While it’s all an intriguing idea, it may not be the end to CAPTCHAs as we know it just yet. For one thing, you probably won’t see the prompt in many places, as Cloudflare says this is only an experiment right now, available “on a limited basis in English-speaking regions.” And in its current state, it only works with a limited set of hardware: YubiKeys, HyperFIDO keys, and Thetis FIDO U2F keys.
Cloudflare promises it will “look into adding other authenticators as soon as possible.” That could possibly expand to your phone: Cloudflare suggests the possibility of tapping a phone to their computer to pass a wireless signature using NFC. Google can now treat both iPhones and Android phones as physical security keys; If Google and Apple got on board with Cloudflare’s method, it could significantly reduce the barrier to entry to using it, since smartphones are much more common than security keys.
However, Cloudflare’s system may actually be a worse solution, according to one critic. As Ackermann Yuriy (CEO of the consulting firm Webauthn Works) points out, “attestation does not prove anything but the device model,” meaning that it doesn’t actually prove if someone using a device for authentication is, in fact, a human.
Cloudflare essentially admits this itself in its own blog, saying that a drinking bird (those bird toys that dip their beaks into water repeatedly) could press a touch sensor on a security key, thereby passing the authentication test. If the point of CAPTCHAs is to prevent bot farms from overrunning websites, we may need to consider whether bot farms equipped with with jury-rigged security key devices (or worse) will take advantage.
Cloudflare isn’t always positively associated with CAPTCHAs; in a recent example, the company moved from Google’s reCAPTCHA to a service from hCaptcha in April 2020, and some people weren’t fans:
CAPTCHAs also assume that website owners want to allow relatively anonymous traffic, but anonymous identity may be irrelevant if an website has your actual identity through login information you’ve provided. And with the recent push against ad targeting, driven in large part by Apple’s huge new privacy feature in iOS 14.5 that asks users if they want to let each app track them around the web, it’s possible that website providers will move more toward logins anyway.
Though it certainly sounds like a hassle to have to potentially deal with even more logins (which is much easier to do with a great password manager!), that shift could, counterintuitively, have the potential benefit of pushing us toward a passwordless future even sooner. If more services are pushing for direct logins, that could lead to more of them supporting security keys instead of a password. And more sites supporting security keys could put pressure on others to support them as well, like the trend we see toward two-factor authentication with phones.
While we’re not at that passwordless future just yet, Cloudflare’s potential replacement for the CAPTCHA could be a first step in that direction.
The Internet Society’s six-month Fellowship Peering program continues to help make internet access affordable, dependable, and resilient. The program, according to the global charitable organisation, is targeted for fifteen professionals in the peering and interconnection sector.
“It offers a unique opportunity to build the skills, knowledge, and networks necessary to improve local Internet infrastructure and policy,” according to the site’s description.
The fellowship participants will participate in a comprehensive curriculum that includes virtual training sessions, collaborative forums, and technical and advocacy-based instruction on routing, Internet Exchange Points, and policy.
The fellowship culminates in attendance at a global peering event, which provides direct experience and networking opportunities with important voices in the Internet community.
The fellowship enhances participants’ impact in their particular nations by developing engagement with seasoned professionals and boosting regional and global collaboration. The program invites fellows to return to their communities prepared to expand interconnectivity, improve policy conditions, and make a meaningful contribution to the development of the Internet ecosystem.
Applicants must have at least three years of Internet experience and be based in Latin America and the Caribbean, Africa, or Asia-Pacific.
Eligibility also required proper travel documentation and availability to attend important events such as African Peering and Interconnection Forum, Latin American and Caribbean Network Operators Forum, or Peering Asia, as well as a commitment of roughly four hours per week over six months.
Socio-Economic Rights and Accountability Project (SERAP) has called for the withdrawal of the amendment of the Nigeria Data Protection Act 2023 because it seeks to regulate the activities of bloggers operating within the territorial boundaries of Nigeria.
The organisation in its letter urged Mr Godswill Akpabio, Senate President, and Mr Tajudeen Abbas, Speaker of the House of Representatives, to “immediately withdraw the repressive bill.”
The titled A Bill for an Act to Amend the Nigeria Data Protection Act, 2023, to Mandate the Establishment of Physical Offices within the Territorial Boundaries of the Federal Republic of Nigeria by Social Media Platforms and for Related Matters among others intends to regulate bloggers, including by requiring all bloggers to register local offices and join recognised national association for bloggers.
Currently, the bill has passed its first and second reading in the Senate.
In the letter signed its deputy director, Mr Kolawole Oluwadare, SERAP asked Mr Akpabio and Mr Abbas “to ensure that any amendment to the Nigeria Data Protection Act promotes and protects the rights of bloggers and other journalists and does not undermine the fundamental human rights of Nigerians.”
It demanded an end to “the imposition of unnecessary restrictions on the rights of Nigerians online and Internet-based content.”
In the letter dated April 12, 2025, the group said, “This bill is a blatant attempt to bring back and fast-track the obnoxious and widely rejected social media bill by the back-door.”
“If passed, the bill would also be used to ban major social media platforms—including Facebook, X (formerly Twitter), Instagram, WhatsApp, YouTube, TikTok, and independent bloggers if they ‘continuously fail to establish/register and maintain physical offices in Nigeria for a period of 30 days.
“Lawmakers should not become arbiters of truth in the public and political domain. Regulating the activities of bloggers and forcing them to associate would have a significant chilling effect on freedom of expression and lead to censorship or restraint.
“Should the National Assembly and its leadership fail to withdraw the bill to regulate the activities of bloggers, and should any such bill be assented to by President Bola Tinubu, SERAP would consider appropriate legal action to challenge the legality of any such law and ensure it is never implemented in the public interest,” the organisation warned.
National Information Technology Development Agency (NITDA) has issued a public advisory warning Nigerians about a fraudulent website impersonating the Google Play Store.
Mrs Hadiza Umar, head of Corporate Affairs and External Relations at NITDA, made this known on Friday in Abuja.
Umar stated that the fake website was distributing a new malware strain known as the Play Praetor Trojan.
“Cybercriminals are using fraudulent websites designed to mimic the Google Play Store to lure victims into downloading malicious applications,” she said.
She explained that the fake Play Store links were being circulated through various social engineering tactics, including phishing emails, malicious advertisements, and SMS messages.
According to Umar, once the fake application is installed, the Play Praetor Trojan gives attackers unauthorised access to the victim’s device.
“This access can lead to data theft, credential harvesting, financial fraud, remote control of the device, and further malware deployment,” she warned.
She urged the public to download apps only from the official Google Play Store or other trusted sources.
Umar also advised users to verify app developers, read reviews before installation, regularly update their devices and apps to patch vulnerabilities, and use reputable mobile security solutions to detect and block threats.
Four Red Flags Nigerians Ignored until CBEX Crashed- DUBAWA
How Starlink Took over Africa’s Largest Internet Market
World Bank Announces $800m Support for Nigeria’s CCT Initiative
CBN Grants Final Approval to Ascensia to Operate as Finance Company
CSCS Reports Strong 2024 Results as PBT Rises by 24%
E-Business3 days agoNITDA Warns Against Fake Google Play Store
General News3 days agoLagos Commences Integration of NIN with State Single Social Register
E-Financial3 days agoSEC Bans Unregistered Digital Asset Exchanges, Online Forex Platforms
News3 days agoNOA Uncovers Fraud by Banks, Universities in Students Loan Scheme
E-Financial3 days agoUBA Redefines Banking with Next-Gen PoS Terminals and Revamped MONI App
E-Financial3 days agoAfrica Loses $88.6Bn Yearly to Corruption- ECOWAS
E-Financial3 days agoNIBSS Heads to Court to Recover N4Bn Lost due to System Glitch
General News3 days agoNigeria Records $6.83Bn Balance of Payments Surplus in 2024 Amid Economic Reforms