IETF Logo Mail Archive

[Web-bot-auth] Re: WebBotAuth Direction

Jo Levy <jlevy@nortonlaw.com> Wed, 13 May 2026 14:35 UTC

Return-Path: <jlevy@nortonlaw.com>
X-Original-To: web-bot-auth@mail2.ietf.org
Delivered-To: web-bot-auth@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id D3003EDC4A65 for <web-bot-auth@mail2.ietf.org>; Wed, 13 May 2026 07:35:56 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1778682956; bh=P0UbojneUQJtFxN+OrjuhnZFdBsZwo5Da9d06HZjmwA=; h=From:To:CC:Subject:Date:References:In-Reply-To; b=Tj0ROeRbEfZUXzK3Zp+eXydjTpu3LlNfxO35vefVZk/1k5EHP+wTI2GddxnRS/6zU btsGQbxPUy2AgEMhX/2Ewei3f7f+Pu5at7Dj+36BBQakzCVb1s/KQw+DzaJVb+CF7G s+BCiwoHpep8n8YbTLN9Z4CT2DPBo86qJFiWFEoM=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.097
X-Spam-Level:
X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (1024-bit key) header.d=nortonlaw.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8LwwV_wMWzdZ for <web-bot-auth@mail2.ietf.org>; Wed, 13 May 2026 07:35:54 -0700 (PDT)
Received: from BN1PR04CU002.outbound.protection.outlook.com (mail-eastus2azon11020072.outbound.protection.outlook.com [52.101.56.72]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id B78D7EDC4A50 for <web-bot-auth@ietf.org>; Wed, 13 May 2026 07:35:54 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=wGp7+pPZFkiDWw4nhjx3TG+SQSv3cUnJrQ5b989DxPM64sJ0BieA7R/fik2/DvMrDvb+LYh7hmT8ux0VmHRoKkc5S9lCsa3XsZKz2mw2AqSC3k72Qvl+JJxxpcgh5TZybaPigv27tSb0kLPbIM9BmcEkx3g+vpOquni9gVYfaT31ftdNQR4Z9Y4OrvNhwJLfPA7IdCYMtMj6+FYOTXJY9L8cM/R4k/IvoC1I8QBJMDbt21/0vRV303cIjwp0rnXK+1bu83UNgyvXqPrYIs1jWPI3Huwann5b2Kj8VXjxEuR8gdgF1BCW6fmxj+B7HtJciTSnRrCTiyJNb1XyRSUq3w==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=P0UbojneUQJtFxN+OrjuhnZFdBsZwo5Da9d06HZjmwA=; b=H12iDqQZP3dF8DnRGH+HG3NaUPyl2FtozIFyLVMGtDFzmQV4mlEYM2xXxlCkvrjjv/jcv3hqg7MtPMbz33uo3uO08ViYOqpcM6W/rJZOoHhIp24mtrGgWxkr4HD2KnwWphUfV5F9ybfkh4gEFX/vm5b5jEtet9NOROpjIBniP5hdmKw+3kjRiGODEGCINPt7GCreZ/XqrpAT4fuHz1TCSg/kpZY//scoWfKSyhn1ImdHxJ6sVtvy1DqaREzetrT8Zf31GlnMfmOJ6BNkC70uXwQIPVHYZTLaAPblFvPMMcHAdCUITW1BXTdYgXlrhYIjCNUpEXUavi4oZpcVnvIlSQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nortonlaw.com; dmarc=pass action=none header.from=nortonlaw.com; dkim=pass header.d=nortonlaw.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nortonlaw.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=P0UbojneUQJtFxN+OrjuhnZFdBsZwo5Da9d06HZjmwA=; b=nsKTe83otvHlns2iJiuKkuNm9tXWREWPcW4SlDSY/eF4t5we8ZibPQnlJvtVOyBZBZQXDhJJazvlz+4YZF9cas/cr3skKQGXbvqDolt/Tw9eG3wXdApFZmzVQQ/0uqTUQDJ9VVk2Rti9t2Q8+T+LFhyqKbd4G1POIBSmxBkAm/s=
Received: from DM6PR12MB4975.namprd12.prod.outlook.com (2603:10b6:5:1bd::16) by SA5PPF8DEAB7A29.namprd12.prod.outlook.com (2603:10b6:80f:fc04::8d4) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9913.11; Wed, 13 May 2026 14:35:37 +0000
Received: from DM6PR12MB4975.namprd12.prod.outlook.com ([fe80::22fc:1ba4:bcb7:9359]) by DM6PR12MB4975.namprd12.prod.outlook.com ([fe80::22fc:1ba4:bcb7:9359%6]) with mapi id 15.20.9913.009; Wed, 13 May 2026 14:35:37 +0000
From: Jo Levy <jlevy@nortonlaw.com>
To: Sarah McKenna <sarah.mckenna=40sequentum.com@dmarc.ietf.org>, "Dellaert, Philippe" <pdellaer=40amazon.com@dmarc.ietf.org>
Thread-Topic: [Web-bot-auth] Re: WebBotAuth Direction
Thread-Index: AQHc4llFFAHeivzO0UqT/RD9ibnyq7YLCKeAgACD+oCAAASuEA==
Date: Wed, 13 May 2026 14:35:29 +0000
Deferred-Delivery: Wed, 13 May 2026 14:00:00 +0000
Message-ID: <DM6PR12MB4975608BC56029D7FD91B196A5062@DM6PR12MB4975.namprd12.prod.outlook.com>
References: <CADNypP_iOUp6K90V4a=WcDOhqpG5yUv+VXh_jOwtLhEJf7s4jA@mail.gmail.com> <CACsn0cnm1nYzOyYgKBH2BQ8Q3ataVLiBH6sFONpPL+CjsC6xuA@mail.gmail.com> <PH5PR18MB927672064952D71BA68D645925A4392@PH5PR18MB927672.namprd18.prod.outlook.com> <CAGJaBrB_R+R=WdxsSWreuw+sahSX0HJqW+r5PJ-wr+nJ3Hx_qA@mail.gmail.com>
In-Reply-To: <CAGJaBrB_R+R=WdxsSWreuw+sahSX0HJqW+r5PJ-wr+nJ3Hx_qA@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nortonlaw.com;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: DM6PR12MB4975:EE_|SA5PPF8DEAB7A29:EE_
x-ms-office365-filtering-correlation-id: de2378d2-692c-41e9-c0de-08deb0fce64e
x-ms-exchange-atpmessageproperties: SA
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|366016|376014|4022899009|10070799003|1800799024|55112099003|38070700021|8096899003|22082099003|56012099003|18002099003;
x-microsoft-antispam-message-info: 2ANrcQUIRihTFVtj60f3YQZgtPL3QgpyWOORn6vKuuJ/W0ZeqP2AYLbpqd8I/bbf5ttmFokQNTyPctFzl2pk+mfeH1OmZMqeqUwr0vZbmhTK3xdHMgZBWudo7ngAGC/aNMIgNOcFrIw+Byy0/9J1FtUe1pktlJnEFRPfu3efUE6dmHfTPGVNnWGm7qKpXzrSxT2GyUbAavv4K7mqb07XH8JFnmOVwGvvxhSF8p4AVGwWFhfP6WSYzweWsT2wO75hTtfQg8v3uIMpi1zUFGs5VTDpahKozC6ScCQO6o+ykhXkbukyKcxvVg/ss0yRJtUY9q8WU7l4yRlbIZEQSbVQrU1jSazUWzQtKlnWCZYtZduMkhqknZObrNgIfusuUYUB5C4/xpX0QGtC3vVQN5d/OakuU7A8TghqIJ7zxnXfeefBybP9eZs3Dlx9Emx7sKCLzR6qSa9T/B2sEmlZwpcF8rnyTnPYbBvH6eGA89BxZBX/WaMnapX2xND5FW5IG3JKZ4E9JpxH9oJ7E4Js5xeWim6Gyp1kr3RPl0rwZEXS2N5+I9jQxUHk47wDRJxQ/SmFbOXaiCEYBNVHaAGZtglURp1cR9wV+HSVXaYJU09kSNugr7WYaDBMw4BNdUqSEjIRfUIRWpdOwHwosP2ZKGeJvx929EoO0LBDvenTGTdh9sydMSuCZlvPwn7TZgppF2iTwZQMzSIuwXNo/tU6cVO2pRj02keHuYg6krjoiydah+QdEe1/pOUbJp1yG5iaDLjl
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DM6PR12MB4975.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(376014)(4022899009)(10070799003)(1800799024)(55112099003)(38070700021)(8096899003)(22082099003)(56012099003)(18002099003);DIR:OUT;SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 2
x-ms-exchange-antispam-messagedata-0: +LQYqYOdLXvY//UtWs+Xpt+zP6ipNUPri71LIKW+2n2ISBJ8h4qb5GfhHN0+gDX22ph+ctMRwuGzxd+J5s8ykEoAz9vb1xV5A8Ktkty1/10BDJZKOS/GaMbQ5enuvw2mX6l5d996hhm8H1wE1RR1PfjI1UP40sPIoqHI40iFcjJxrlVii0TSVPKS5MCizSOc2g1FcTzfkaq1+AllbZmyk8XrnAxJudLQXFftHAGlpFwhSfU5i8j2euGHpoQC9jCNoab1FKH5JkdwdrCA1pH+8CfT4zH+Wf1Y9OEEEq3yPokqQcOYwvnBwqYS1/LU7SMFmE59WrYP9/MnHuMx90G0ui8bMK3lw6rm5p6iOCr7hfVB9114xRNd8aIoqYWJcT0jmMKYLRUkQjL4dmt3b//VsOjyKlfGfkElsOL8gJT/lA9/UbtmhjniipAMsfeJFgsUo8iMSCrZfVhgF7jxHr+HGqESn+tOyGkJESGKUyDahyvyDdCtpgrZav351M/SKrBUmot8vsXAoC+/H5oG1zU2WymDnMfceaGLMv45/o02QvFnWTwpArlm5JmnmwNa/4/zEBG6a4Vp+wNeRy/dFgT1EfCbLBl/9li+tEyJx+pqnDCWsuq2u5S8UVjhwFaE5jyAU1e8XYL8xFLmeeIfpM8YPyzyg5697onjgPa34cO1htzszwY5zxvemwUrm9cHd+dQBbVi6tT8Yi0HJXdBFYMMItCfb09RAZBSv/zJ9JHIJfLL2pND9xuu2iOD/LBKIURLkqg0Yldm9idh5qAbNJJBJUtKmUzlJA1BQ3UDjGL93+XkVvQzK1oJ9VqGzOCekf4qL9QP82V2W5NDy2719fJWMDZ7K3ZY4NeGLbvvIyDw/S7/lUDQJG4zifkZvLSlMsgYbl4nThi8yx5cFwMg7HyJjfaZeFO79VrD7v6ysJKl296mVEvKfPK5lcnJ6pnjGmvjYUQE09qydJ8xhNeorTn8yeyutAgoLow6n5dewLjPKoVu8nY72K35BUmxBT/kDsQIie5LZkTd//7+IqxlPuzkV1Y3EPj5/yehjnNcd3aSX5Sd6CXhrkaJh0cjg/EahCCmWiWyNDhoWg1bDBdUexCzn9ctYwfkS7rpLX+nsiLniQHtBpPxU90+YNe9rx+mlks8GrAIw0MnE3/yjoCajtKECgABpjskxHAa3fDTvMcwwUzP8AZGk7r8bz4wGEPu7XaOPbLr+wbL0C8RXKCGkgvJ2fkxNCHi6uksHC7jEgX5bXBhE19gYPZV5kt2LDp/Y/iHqU5cL4V5v0qQdHX6JBPGdkdJgk3Yli23562ZV/UZYBeBxMaRUacl1A3bsRvg8OcX3YZ/cwZNL0ePoLrvHgwO6hBmeWyHRv0kp7XsuIWdRE38b3HeotI/ihjPqnX3KIhK845eoQ+X6eCvYPPqWBVqIxP3XerR8fnOa7qHZGDO3RgXdiyhY+rDZSWnit0gsrUQsWiG4P7GSBLPQV/TgTm3v6Q/iJaMnBTkcbRfc0Z2pQ1kqFZoHNRMO+O5kyGp8x+OFJ4x8mN+w5LA6VKJfaf5RHHuahHncxm7H6Vp99VnIVCsWMnDlPogS0vmLFMNhEb1GuHrEYMDW5KjKs8kMDVy1r8VtJEdySwxCBLDKlWFwCWyAhYrHgbkWNaxlyQDaDnCCrb47qEvB/6WpdMkY384kY502E2MoYwyFx46CxfO7m2yp3TUOOEOuh/15pUEWBs+c5j8LsugVt5v2eHgyxXed0dNAR8R9TmiVCXx69ThkScLYB7yWxFIn27DhrfnSt6KOqitDuzi
x-ms-exchange-antispam-messagedata-1: pR4lSZMuxVfGiQ==
Content-Type: multipart/alternative; boundary="_000_DM6PR12MB4975608BC56029D7FD91B196A5062DM6PR12MB4975namp_"
MIME-Version: 1.0
X-OriginatorOrg: nortonlaw.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: DM6PR12MB4975.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: de2378d2-692c-41e9-c0de-08deb0fce64e
X-MS-Exchange-CrossTenant-originalarrivaltime: 13 May 2026 14:35:37.4899 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 5770b94e-2075-43bc-979f-84273a0b42e7
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: /A8hSEuWvVkO21A2uvf2dD9u2uBHQJRNKHfOgStsanu5sYBY8V6cmvuPtDBXbfnWkrKU6Xnb6B+w7zsnoaGivA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA5PPF8DEAB7A29
Message-ID-Hash: L6T676OOKICETJ3SSWNKX5ERFBZBM66M
X-Message-ID-Hash: L6T676OOKICETJ3SSWNKX5ERFBZBM66M
X-MailFrom: jlevy@nortonlaw.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: Watson Ladd <watsonbladd@gmail.com>, Rifaat Shekh-Yusef <rifaat.s.ietf@gmail.com>, "web-bot-auth@ietf.org" <web-bot-auth@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [Web-bot-auth] Re: WebBotAuth Direction
List-Id: Authentication of non-human users to human-oriented Web sites <web-bot-auth.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/web-bot-auth/kUTFKfX38fC3VakGHEFRrL8-OB0>
List-Archive: <https://mailarchive.ietf.org/arch/browse/web-bot-auth>
List-Help: <mailto:web-bot-auth-request@ietf.org?subject=help>
List-Owner: <mailto:web-bot-auth-owner@ietf.org>
List-Post: <mailto:web-bot-auth@ietf.org>
List-Subscribe: <mailto:web-bot-auth-join@ietf.org>
List-Unsubscribe: <mailto:web-bot-auth-leave@ietf.org>

+1 on #1, focusing first on the anonymous approach. It’s likely to reach consensus sooner and provide a solution that will have more widespread applications and use.

From: Sarah McKenna <sarah.mckenna=40sequentum.com@dmarc.ietf.org>
Sent: Wednesday, May 13, 2026 12:18 AM
To: Dellaert, Philippe <pdellaer=40amazon.com@dmarc.ietf.org>
Cc: Watson Ladd <watsonbladd@gmail.com>; Rifaat Shekh-Yusef <rifaat.s.ietf@gmail.com>; web-bot-auth@ietf.org
Subject: [Web-bot-auth] Re: WebBotAuth Direction

My preference is #1, we already have #2 in production (through kyapay), but we need #1.

On Tue, May 12, 2026, 7:26 PM Dellaert, Philippe <pdellaer=40amazon.com@dmarc.ietf.org<mailto:40amazon.com@dmarc.ietf.org>> wrote:
Option 2 is the preference here as well.

Agreed on this perspective, anonymous is valuable, but will take longer discussions and is not a prerequisite for the bot identity approach.

Regards,
Philippe

From: Watson Ladd <watsonbladd@gmail.com<mailto:watsonbladd@gmail.com>>
Date: Tuesday, May 12, 2026 at 2:50 PM
To: Rifaat Shekh-Yusef <rifaat.s.ietf@gmail.com<mailto:rifaat.s.ietf@gmail.com>>
Cc: web-bot-auth@ietf.org<mailto:web-bot-auth@ietf.org> <web-bot-auth@ietf.org<mailto:web-bot-auth@ietf.org>>
Subject: [EXTERNAL] [Web-bot-auth] Re: WebBotAuth Direction

CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.

I want option 2. I think anonymous is very hard and will take a while and we understand identity.

Astra mortemque praestare gradatim

On Tue, May 12, 2026, 2:33 PM Rifaat Shekh-Yusef <rifaat.s.ietf@gmail.com<mailto:rifaat.s.ietf@gmail.com>> wrote:
All,

Based on the discussion during the interim and later on the mailing list, it sounds like there is significant enthusiasm for the anonymous approach, but still interest in the bot identity approach.

So, we would like to get the WG opinion on the following directions:
1. Work on the approaches in sequence, starting with the anonymous approach, followed by the bot identity approach.
2. Work on both, anonymous and bot identity approaches, in parallel.

Please, reply to this email on the mailing and indicate which option you prefer.

Regards,
 Rifaat & David

_______________________________________________
Web-bot-auth mailing list -- web-bot-auth@ietf.org<mailto:web-bot-auth@ietf.org>
To unsubscribe send an email to web-bot-auth-leave@ietf.org<mailto:web-bot-auth-leave@ietf.org>
_______________________________________________
Web-bot-auth mailing list -- web-bot-auth@ietf.org<mailto:web-bot-auth@ietf.org>
To unsubscribe send an email to web-bot-auth-leave@ietf.org<mailto:web-bot-auth-leave@ietf.org>

v2.46.0 | Report a Bug | By Email | System Status