[Web-bot-auth] Re: WebBotAuth Direction

[Watson Ladd <[e-mail]>]

On Wed, May 20, 2026 at 5:06 PM <[e-mail]> wrote:
>
> Hi Watson,
>
> The argument holds. A browser-wrapped bot is, at the transport layer, identical to a human browser. Behavioral heuristics cause collateral damage to legitimate users before they catch a sophisticated bot. That is a structural property of the open web, not an implementation gap.

To be clear I am not asking about heuristics today. I am asking about
how we define abuse: is it determined by what kind of automation is
being used (I don't type HTTP GET / myself!), or is it the kinds of
interactions (spammy comments, price scraping, trying logins) that
both humans and bots can perform, but bots have an economic advantage
in doing?

To my mind this is very important for assessing the viability of
reputation based systems (more to come in Vienna) vs. attestation
based.

Sincerely,
Watson
>
> The same analysis points to where attestation does work: closed, cooperative ecosystems where it is a hard entry condition. The attack surface disappears by design. Protocol engineering delivers there.
>
> I submitted draft-litzki-sovp-00 to DISPATCH last week. It addresses one specific layer: verifying that a domain owner's signed machine-readable declaration remains intact between signing and agent ingestion. It operates before ingestion begins, orthogonal to agent identity (WIMSE) and source certification (draft-bondar-wca).
>
> The enterprise-ecosystem framing in this thread maps directly onto that layer.
>
> Draft: https://datatracker.ietf.org/doc/draft-litzki-sovp/
>
>
> Best regards
>
> Thorsten Litzki
> Inventor, Sovereign Validation Protocol
>
> LITZKI SYSTEMS LLC
> Web // LinkedIn
>
>
>
> Am 19.05.2026 um 09:27 schrieb Watson Ladd <[e-mail]>:
>
> I think that argument proves too much. The issue is not that bot traffic doesn't look human. Rather it's that there are classes of interaction that are malicious, and until recently automation (which after all humans start!) was a proxy for that actual behavioral difference.
> _______________________________________________
> Web-bot-auth mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>
>


-- 
Astra mortemque praestare gradatim