Trust Tokens es una nueva API para ayudar a combatir el fraude y distinguir a los bots de los humanos reales, sin seguimiento pasivo.
Updated
Safe and secure
Summary
Los tokens de confianza permiten que un origen emita tokens criptográficos a un Username en el que confía. Los tokens son almacenados por el browser del usuario. El navegador puede utilizar los tokens en otros contextos para evaluar la autenticidad del usuario.
La API Trust Token permite que la confianza de un usuario en un contexto (como gmail.com) se transmita a otro contexto (como un anuncio que se ejecuta en nytimes.com) sin identificar al usuario o vincular las dos identidades.
Why do we need Trust Tokens?
The Web necesita formas de establecer señales de confianza que muestren que un usuario es quien dice ser, y no un bot que finge ser un humano, o un tercero malintencionado que defrauda a una persona o servicio real. La protección contra el fraude es particularmente importante para los anunciantes, los proveedores de anuncios y las CDN.
Unfortunately, many of the existing mechanisms for measuring and propagating trustworthiness (to determine if an interaction with a site is from a real human being, for example) take advantage of techniques that can also be used for fingerprinting.
Key term:
Fingerprints allows sites to identify and track individual users by obtaining data about their device, operating system, and browser settings (such as language preferences,
user agenty fuentes disponibles) o cambios en el estado del dispositivo. Esto se puede hacer en el server comprobando los headers de las solicitudes o en el client with JavaScript.
Fingerprinting uses mechanisms that users are not aware of and cannot control. Sites like Panopticon and
amiunique.org show how fingerprint data can be combined to identify you as an individual.
The API must preserve privacy, allowing trust to spread across sites without tracking individual users.
What's in the Trust Tokens Proposal?
La web se basa en generar señales de confianza para detectar fraudes y spam. Una forma de hacer esto es rastreando la navegación con identificadores globales por usuario entre sitios. Para una API que preserva la privacidad, eso no es aceptable.
Of the proposal
explainer:
This API proposes a new storage area by origin for "Privacy Pass" style cryptographic tokens, which are accessible in third-party contexts. These tokens are not personalized and cannot be used to track users, but they are cryptographically signed so they cannot be forged.
When an origin is in a context where they trust the user, they can issue a batch of tokens to the browser, which can be "spent" at a later time in a context where the user would be unknown or less trusted. Fundamentally, tokens are indistinguishable from each other, preventing websites from tracking users through them.
In addition, we propose an extension mechanism for the browser to sign outgoing requests with keys linked to a particular token redemption.
Sample API usage
The following is an adaptation of
sample code in api explainer.
Imagine that a user visits a news website (publisher.example) que incorpora advertising de una red publicitaria de terceros (foo.example). User has previously used a social media site that issues trust tokens (issuer.example).
The following sequence shows how trusted tokens work.
1. The user visits issuer.example.
2. issuer.example verifies that the user is a human and executes the following JavaScript:
fetch('https://issuer.example/issue', {
trustToken: {
type: 'token-request'
}
});3. The user's browser stores the trust tokens associated with issuer.example.
4. Some time later, the user visits publisher.example.
5. publisher.example wants to know if the user is a human, so they ask
issuer.example executing the following JavaScript:
fetch('https://issuer.example/redeem', {
trustToken: {
type: 'srr-token-redemption'
}
}); With this code:
- The browser requests a redemption.
- The issuer returns a Signed Redemption Record (SRR) indicating that they ever issued a valid token for this browser.
- When the returned promise is resolved, the SRR can be used in subsequent resource requests.
6. publisher.example then you can run the following JavaScript in a top-level document:
fetch('foo.example/get-content', {
trustToken: {
type: 'send-srr',
issuer: 'https://issuer.example'
}
}); With this code:
foo.exampleyou get the SRR, and now you have some indication that
issuer.examplethought this user was human.foo.examplerespond accordingly.
Es posible que tenga historial de compras con un sitio de comercio electrónico, registros en una plataforma de ubicación o historial de cuenta en un banco. Los emisores también pueden considerar otros factores, como cuánto tiempo ha tenido una cuenta u otras interacciones (como CAPTCHA o envío de formularios) que aumentan la confianza del emisor en la probabilidad de que be un ser humano real.
Issuance of trusted tokens
If a trusted token issuer considers the user to be trustworthy, such as
issuer.example, the issuer can obtain trusted tokens for the user by doing a
fetch () request with a new trustToken parameter:
fetch('issuer.example/.well-known/trust-token', {
trustToken: {
type: 'token-request',
issuer: <issuer>
}
}).then(...)This invokes an extension of the Privacy pass broadcast protocol using a new crypto primitive:
-
Generate a set of pseudo-random numbers known as nonces.
-
Ciego los nonces (codifíquelos para que el emisor no pueda ver su contents) y adjúntelos a la solicitud en un
Sec-Trust-Tokenheader. -
Envíe una solicitud POST al punto final proporcionado.
The endpoint responds with blinded tokens (signatures on the blind nonces), then the tokens are unmasked and the browser stores them internally along with the associated nonces as trusted tokens.
Redemption of trusted tokens
A publisher site (like publisher.example in the example above) you can check if there are trust tokens available to the user:
const userHasTokens = await document.hasTrustToken(<issuer>);If tokens are available, the publisher's site can redeem them to obtain a signed redemption record:
fetch('issuer.example/.well-known/trust-token', {
...
trustToken: {
type: 'srr-token-redemption',
issuer: 'issuer.example',
refreshPolicy: 'none'
}
...
}).then(...)The publisher site can then send the SRR to the requests it makes using the following API:
fetch('<url>', {
...
trustToken: {
type: 'send-srr',
issuer: <issuer>,
}
...
}).then(...);The publisher must include the SRR in requests that require a trust token, such as posting a comment, liking a page, or voting in a poll.
Los tokens de confianza solo son accesibles a través de las opciones de Fetch, XHR y HTML