[Web-bot-auth] Updated Anonymous Bot Authentication draft
Eric Rescorla <ekr@rtfm.com> Thu, 09 July 2026 03:53 UTC
Return-Path: <ekr@rtfm.com>
X-Original-To: web-bot-auth@mail2.ietf.org
Delivered-To: web-bot-auth@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 25DFC113A0BFB for <web-bot-auth@mail2.ietf.org>; Wed, 8 Jul 2026 20:53:15 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1783569195; bh=6DJKWsmfE8pQCZ27kta5kz/6NnfsR3Va/Rl4OTE8Z3I=; h=From:Date:Subject:To; b=y5/w6YQqXy1LDQAiKKq6K12N3rmlOyG56VuSwHUc10X8YZx0cboWiY4rxRPumX7To ifEcG0yIvlf/kfY4Ip6YN8ls9d6To9hGBtVyX0zY2g4WNlGIyhm+P+lwtSNOY+KRbN ocgwaVKLJ/iS/RKd9xUciFQHzH9pNnpOjJRzBpPI=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -1.897
X-Spam-Level:
X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20251104.gappssmtp.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0OiVCS6cr3e8 for <web-bot-auth@mail2.ietf.org>; Wed, 8 Jul 2026 20:53:14 -0700 (PDT)
Received: from mail-yx1-xb134.google.com (mail-yx1-xb134.google.com [IPv6:2607:f8b0:4864:20::b134]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 49E0C113A0BF2 for <web-bot-auth@ietf.org>; Wed, 8 Jul 2026 20:53:14 -0700 (PDT)
Received: by mail-yx1-xb134.google.com with SMTP id 956f58d0204a3-664e3ed58bcso680347d50.1 for <web-bot-auth@ietf.org>; Wed, 08 Jul 2026 20:53:14 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1783569188; cv=none; d=google.com; s=arc-20260327; b=d23Ie0CisjeZ9/8z6/UDaD2+kpBqtUEdLI8uJ/pdOx7GOCnT+ICX21W+2Q2Ea0+Z1h u0SFUaCpJPhIkl0lHi+29x80pLv/KFWwBn2NMjQ2bpDOyaGQr9+DNcXcg4YG1xKZSCOe AtmMN23E1WgtQOFS7XaK0bpblrTZ6nCXFwE5FJ3Tzb2zOG3WsPVbBz0le9gjDkUzdLAy 0XOZSzK2By454wSnwf7oq+wXc0Elrk4cbBt854HxN4QtMW7yxbPuvQuMalUTv592bwRM d4CVumNHMiMPn6DUEvoB0RtdmjvMWXxxCqPA9iFGLJg5x1ZqhEqtqvgEhdpdI5mPpgld e+9w==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=to:subject:message-id:date:from:mime-version:dkim-signature; bh=Li2Fpt4yTk1lzrGJPW91tQHCPlcyTnLbHcs9Om7VMk8=; fh=g/BalIhD3tmy7gbmu47rdqj2P6nmHazV0EIQo5JQ2DM=; b=SXSw6equuRRK1Jw8hvISNruQQAC42N+nqV+0lhOTJWdzgPLOOUVaHtFzKYC5bR4mph pIel1fK81lmu/SBbKtZ43XggHr4KgkLMOQOhn0x4wBpnP2ZLht4u6BxNqYVsHYEvgf4A 2iFer5LajKPXldXhKt21h7XQLCDt71rxN0vOdVUJ6zuVKZZN/ybU5jYXgyFdiT5egJYw k39dgd/cup/j+JT+f7epoiwQlk9PJ9E3Id/eSrhQP+xaLHFSHBBpkQW2tXldPOZpNnXV Bkn/18kuwws/wHSCiHNk6usnYObxww6ERtJHCFXQ+pekc6FX4NIJhTcxBMPgcdi7Ja5l 8PZw==; darn=ietf.org
ARC-Authentication-Results: i=1; mx.google.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20251104.gappssmtp.com; s=20251104; t=1783569188; x=1784173988; darn=ietf.org; h=content-type:to:subject:message-id:date:from:mime-version:from:to :cc:subject:date:message-id:reply-to:content-type; bh=Li2Fpt4yTk1lzrGJPW91tQHCPlcyTnLbHcs9Om7VMk8=; b=zr75aWNNS8OuqU3WU7ZkJ5gHpGv4Yt1s4dvIhxY8LbJvtEn5R5ifPrL5rvYGl2O2YR AFG8O9Z5uXAEK4AOKL3fmgKuWDZEhJtVJ53FdDDNVzYinnLrevLS/q1JbxsdCuEXsxF6 EwOZS0U+jZmFQdGszgByhjAZ/CFkWr8EcHbNlED8zgvnvzZgoFdUNZbKnc88N0fmnKY0 0VZER8xaxuKFeRy5n3ILqks+rRb6O/AdcqrDZeCx0svNOZwWryhFgHuvoR3VzVKSLZM6 IAF9e0N7Re4K2Qxr4hLyNgXtpY8hZhOs5BWFv/lNC3XZctDJkpizCJJseLm9q4SUd5rp Lbcg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783569188; x=1784173988; h=content-type:to:subject:message-id:date:from:mime-version:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=Li2Fpt4yTk1lzrGJPW91tQHCPlcyTnLbHcs9Om7VMk8=; b=dZeCNvPlBCbRkwY70MYuzNu6h2V7aRSZVMRU6u/VeYUeYN4mkdJKu4yjTzyXj/6azB 02dH6iOwbt50cgGmBS2snZCXrN4qFBFvfaec1HeVeraDx83VP7TldtVrqWIOOljbqXrW D2s+hYliQVdLsdvSqnB/uYTlD7kgGw4+oK5ZYSI85OVYNU2EW/DTKofcWqmk8oAZexO8 O9UsYYUJIUuKuxtcbBQQ/4k8/GtWvbqM06CyIHxJivH8WsZx44XkoQg7DZ/18skNyabZ 7sHWjKyVwuvsumB/mBvrwolDQYr4tHYtTAGMkMXxBkjmIQhNLcifrLcGmqTqXL/VuhxQ 9bCw==
X-Gm-Message-State: AOJu0YxL5s6heR8Cl90nXnSx/3X3ahEba4erVEJtjbd8LMzzrt8BK3fn iV0t9KCNH7tP3jWZJgn1dmFwJpFXC9PRAqq0dNUs2+DGM6dqfxTf1CpQrBib8dswzivUNBNY8q+ TgwAluiMb6qki9zQ910JH1ktbHyMm2EdAkfVTvb4FdjAsgZKyjNAU4Gc=
X-Gm-Gg: AfdE7clhyK4saXwa3Eo0zy7mNTRoAl/m1ZC7FDat7sFyyKpMfOwJGK/3vllJZ+KbiKI EYWzdaglBt0h2WjSodE/1d9JkPS/+T//2nEIgJDG9Y2PtuB46e7bBSOOS1jWfbc5uVqkWvEa/ji LLbuSytxiUspn8Y7OA5a0+A6e9E6rZwCJVLqYw8xU+ipxDGKVBQ1SzMc5X4oYy9rnpV8qr4EWMI rNBIm5h3DxPzGZZouft3vV497SIvv2REm/ZQGRw1kkBU5TteBTq0j3MkqRcwgS9zb0V53pxYwb7 mOSHZzbkMLKixpwtqsVKIgmeIjga50tnRAqN7vbZSWVM7ILp4FxWjVDlsrLul4V/IWbFBJNjihC 5YMTSSzc8o+s=
X-Received: by 2002:a05:690e:15db:b0:667:8b93:4fe1 with SMTP id 956f58d0204a3-667b831b8b7mr472727d50.51.1783569188379; Wed, 08 Jul 2026 20:53:08 -0700 (PDT)
MIME-Version: 1.0
From: Eric Rescorla <ekr@rtfm.com>
Date: Wed, 08 Jul 2026 20:52:32 -0700
X-Gm-Features: AVVi8Cf2YYPipUC9x6qczHLxXlujto8JyQr1015uElB16d-zHMgvER3bhqPaz9w
Message-ID: <CABcZeBOdp=9Jj=Dk+SDvenL=VzhXOjHDnP8EwmPTfpxdvbNeWQ@mail.gmail.com>
To: "web-bot-auth@ietf.org" <web-bot-auth@ietf.org>
Content-Type: multipart/alternative; boundary="000000000000e7f4800656258f8f"
Message-ID-Hash: LTXOQJCTZAMXVMLDBVLLNERUYGGAET5V
X-Message-ID-Hash: LTXOQJCTZAMXVMLDBVLLNERUYGGAET5V
X-MailFrom: ekr@rtfm.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [Web-bot-auth] Updated Anonymous Bot Authentication draft
List-Id: Authentication of non-human users to human-oriented Web sites <web-bot-auth.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/web-bot-auth/mpZziG9e0hjgOmoxHvHQ4BWDFZY>
List-Archive: <https://mailarchive.ietf.org/arch/browse/web-bot-auth>
List-Help: <mailto:web-bot-auth-request@ietf.org?subject=help>
List-Owner: <mailto:web-bot-auth-owner@ietf.org>
List-Post: <mailto:web-bot-auth@ietf.org>
List-Subscribe: <mailto:web-bot-auth-join@ietf.org>
List-Unsubscribe: <mailto:web-bot-auth-leave@ietf.org>
Hi folks, I've updated my Anonymous Bot Auth draft to incorporate the new authentication mechanisms developed for MoLE [0]. This version is largely conceptually similar but is designed to reuse as much as possible from MoLE to minimize the amount of Webbotauth specific invention we have to do. It also inherits two new nice features from MoLE: 1. Sites can dynamically adjust the amount of usage limit consumed by individual requests. 2. Multiple Sites can share the same Moderator. I didn't make the draft deadline, but you can find a copy on GitHub at: https://ekr.github.io/draft-rescorla-anonymous-webbotauth/draft-rescorla-anonymous-webbotauth.html -Ekr [0] https://datatracker.ietf.org/doc/draft-jms-mole-architecture/ https://datatracker.ietf.org/doc/draft-jms-mole-protocols/
- [Web-bot-auth] Updated Anonymous Bot Authenticati… Eric Rescorla