[Web-bot-auth] Re: WebBotAuth Direction

[Srecko Jovancevic <[e-mail]>]

Hello litzki system as well i have done a draft on browser which i think is complemtary to your draft but ona different layer https://datatracker.ietf.org/doc/draft-jovancevic-bvap/. As i understood your draft proposes tgat the browser is altered eonit contains specifica ai value  data that would be easier to filter on the site side one wuestion though , does that cover custom byilds and only bot , bots? And can it be used i have oroposed another draft for cooperative bora that use contracting amd is oart of my VICDM 05 draft . I do like your solution
Sent from my iPhone

On 20. 5. 2026., at 23:06, [e-mail] wrote:


You don't often get email from [e-mail]. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification>

Hi Watson,

The argument holds. A browser-wrapped bot is, at the transport layer, identical to a human browser. Behavioral heuristics cause collateral damage to legitimate users before they catch a sophisticated bot. That is a structural property of the open web, not an implementation gap.

The same analysis points to where attestation does work: closed, cooperative ecosystems where it is a hard entry condition. The attack surface disappears by design. Protocol engineering delivers there.

I submitted draft-litzki-sovp-00 to DISPATCH last week. It addresses one specific layer: verifying that a domain owner's signed machine-readable declaration remains intact between signing and agent ingestion. It operates before ingestion begins, orthogonal to agent identity (WIMSE) and source certification (draft-bondar-wca).

The enterprise-ecosystem framing in this thread maps directly onto that layer.

Draft: https://datatracker.ietf.org/doc/draft-litzki-sovp/

Best regards

Thorsten Litzki
Inventor, Sovereign Validation Protocol

LITZKI SYSTEMS LLC
Web<https://litzki-systems.com/> // LinkedIn<https://www.linkedin.com/in/thorsten-litzki/>



Am 19.05.2026 um 09:27 schrieb Watson Ladd <[e-mail]<mailto:[e-mail]>>:

I think that argument proves too much. The issue is not that bot traffic doesn't look human. Rather it's that there are classes of interaction that are malicious, and until recently automation (which after all humans start!) was a proxy for that actual behavioral difference.
_______________________________________________
Web-bot-auth mailing list -- [e-mail]<mailto:[e-mail]>
To unsubscribe send an email to [e-mail]<mailto:[e-mail]>