Web Bot Auth
Cryptographic identification of automated web clients — a way for a bot to prove who it is, and for a site to admit, throttle, or refuse it accordingly. The work of an IETF Web Bot Auth working group, documented here from eff-web-under-attack-ietf.
What it is
A scheme letting a crawler present verifiable, signed identity instead of an easily-spoofed user-agent string. The stated motivation is operational: aggressive, anonymous bot traffic strains servers, and verifiable identity lets operators tell good bots from abusive ones.
The governance double-use
The same primitive that filters abusive traffic also enables identity-keyed, selective access — the technical precondition for licensing automated access. Once a site can cryptographically tell who is crawling, it can grant entry only to clients that have paid or been approved. EFF argues this is how a server-load fix becomes a gatekeeping mechanism, pairing with ai-preferences to turn the open web’s default-open posture into default-closed. The counter-view — that operators have a legitimate need to control automated load and abuse — is the case the standard is nominally built for.
Connections
- developed at ietf
- analyzed in eff-web-under-attack-ietf
- companion mechanism: ai-preferences