[Web-bot-auth] IETF 126 -- reCAPTCHA POV

Rim Vilgalys <interweb@google.com> Thu, 23 July 2026 15:32 UTC

MIME-Version: 1.0
From: Rim Vilgalys <interweb@google.com>
Date: Thu, 23 Jul 2026 11:31:34 -0400
Message-ID: <CAOgpWZki_NVBqQeeMCEn6-W+HcX_2Oy9tpVwC_s9_2zJ38Ajbg@mail.gmail.com>
To: web-bot-auth@ietf.org
Content-Type: multipart/alternative; boundary="000000000000348a8f065748f451"
Message-ID-Hash: YNVXVENEWZOK4JUUORJKB6PXFZRBST75
CC: Pablo Gonzalez <pablogm@google.com>
Precedence: list
Subject: [Web-bot-auth] IETF 126 -- reCAPTCHA POV
Archived-At: <https://mailarchive.ietf.org/arch/msg/web-bot-auth/GQ0FLz2Wc9EfeyxKGmc_2Cv5A28>

Hi everyone!

I work on the Google reCAPTCHA team (also branded as Google Cloud Fraud
Defence) alongside Pablo Gonzalez <pablogm@google.com>. This was my first
time (remotely) attending any kind of IETF event and I’ve been really
impressed with everything that’s been brought forward in the WBA & MoLE
proposals and how in-depth the discussion has been. A huge thank you to
everyone who’s presented and for all the work you’ve put in this!

I wanted to share a perspective on how the goals of both WBA & MoLE
proposals align with reCAPTCHA's mission to protect websites from fraud
while minimizing friction for users. Specifically this relates to the
debate “between” WBA & MoLE in the sense that if one is “better” the other
might not be necessary or worth developing (also I’m not trying to reply to
any individual commenter here, this is just a ‘vibe’ from some of the
overall discussion).

>From our POV, both WBA & MoLE are additive signals that let us reduce
friction for both users and legitimate automation while better protecting
our customers from fraud and abuse. These don’t immediately replace the
existing reputation signals we already collect and use, but hopefully they
prove reliable enough against bad actors that we don’t need to collect as
much reputational data or run as many challenges against anonymized traffic.

Overall, I think the goal stated in the MoLE talk by Dennis Jackson—to
minimize the need for both CAPTCHAs and surveillance-based reputation—is
very compelling, and that’s a mutual goal of ours. I think we also share
the overall aim of shifting as much of the friction onto attackers as we
can, and both of these proposals work towards that.

In any case, thank you to all the organizers & presenters! Pablo and I both
sincerely wish we could have joined you all in Vienna and get to know more
of you in person. I can at least say this is the most interesting 3AM
meeting I’ve ever attended 🙃

Thanks!
-- 
Rim Vilgalys | interweb@google.com
SWE on reCAPTCHA <https://cloud.google.com/recaptcha-enterprise> Evaluation

[Web-bot-auth] IETF 126 -- reCAPTCHA POV Rim Vilgalys