Show HN: Replace CAPTCHAs with WebAuthn passkeys for bot prevention

I built Nocaptcha after getting frustrated with traditional CAPTCHAs both as a user and developer. WebAuthn passkeys offered a promising alternative that's both more secure and user-friendly.

What makes Nocaptcha different: - Uses WebAuthn standard instead of puzzle-solving - No need for users to remember passwords or solve puzzles - Open source

Current limitation: Working with W3C WebAuthn Community Group on true passkey disposal for this use case.

Looking for feedback particularly on: 1. Integration experience 2. User experience compared to traditional CAPTCHAs

Show HN: Replace CAPTCHAs with WebAuthn passkeys for bot prevention
github.com

It worked fine on Mac, curious how does it work on Windows?

It does nothing on Linux.

What part of webauthn can a computer not do?

I understand if you say bots are currently not programmed to, but is that why this will temporarily work or is there something more fundamental?

What I'm scared of is some sort of cryptography becoming the death of the open web. Baking keys into your hardware and doing remote attestation. It doesn't tie you to a real-world identity except that you're locked into using an unrooted (DRM'd) device for using online services like a normal person

If I had to choose between two evils, I'd rather upload my passport to cloudflare and be able to get anonymous tokens from their API (RSA blind signatures or whatever) to prove I'm a real person and browse the web with Firefox and no closed source components, than be forced into hardware attestation and a locked-down device. But uploading government IDs to a (few) central point(s) of trust will create outcry about privacy whereas hidden cryptography baked into normal people's devices with Google Play Services and Apple Something and just working in the background goes unnoticed until everyone (the 99% who aren't on a custom ROM) already experienced the benefits

For webauthn I know it can be all software, I've used virtual devices for testing a server implementation's security, but I vaguely remember there also being a mode that requires having keys signed by a hardware vendor. Just not sure anymore if that was webauthn or something else related to authentication