Those Damned Crosswalks: Why Fighting Bots Is Breaking the Web

Picture this. It's early morning. Coffee in hand. You just want to quickly scroll through the news before starting your day.

Instead? Squinting at warped pictures of fire hydrants and traffic lights. Again.

You pass. Barely. And finally get to the article.

Sound about right?

You're not imagining it. This is getting worse by the day.

The Problem Nobody Wants to Talk About

Here's what nobody tells you about those annoying puzzles. They're a symptom of something bigger.

Website owners have a genuine problem. Bots are eating them alive. We're talking credential stuffing, comment spam, ticket bots, content scraping. The financial damage runs into millions every year.

Fair enough. Someone needs to fight back.

But here's the thing: the tools sites used to distinguish humans from bots are disappearing. Third-party cookies? Gone. Detailed browser fingerprints? Blocked. Persistent IP addresses? Masked by design.

So what happened? Sites got desperate. They started demanding more proof from you. More CAPTCHAs. Mandatory logins just to read one measly page. Entire VPN ranges getting blocked because a few bad actors happened to use them.

Privacy improved. Usability tanked.

We're stuck in a cycle where protecting users and giving them a decent experience are pulling in opposite directions.

The Fixes That Create New Problems

Some solutions sound elegant until you scratch the surface.

Take Web Environment Integrity (WEI). The pitch: your device proves it's "trustworthy" before accessing certain content. Keeps compromised machines running bots out, right?

Except—who decides what's trustworthy?

A handful of OS and hardware companies. They'd control which devices and software can access the web.

Ring any bells?

That's basically swapping one set of gatekeepers for another. And history has a habit of repeating itself when power gets concentrated. Single points of failure. Potential for abuse. Barriers for small players who can't afford to play nice with the major gatekeepers.

At NameOcean, we see this clearly in our world. The domain name system is built on decentralization. ICANN manages the root zone through an international, distributed process. No single entity can shut down the whole web.

That same thinking should apply to proving you're human.

A Smarter Approach: Privacy-Preserving Vouching

What if websites didn't need to know who you are? Just that you're a real person, within reasonable usage limits?

That's the core idea driving new research into anonymous credentials.

Think about it this way. You pay for a VPN because you value your privacy. But that VPN's IP range is probably blacklisted on dozens of sites because other services got flooded with bot traffic from similar IPs.

So instead of blocking all VPN users—which punishes legitimate customers—what if your VPN provider could cryptographically verify: "This is a paying subscriber. They're capped at normal usage. Treat them accordingly."

The website gets confidence you're not a bot operation. The VPN provider doesn't expose your identity or even confirm you used their service. You get fewer roadblocks.

This isn't theoretical. Apple already uses something similar. Private Access Tokens let iOS devices prove they're not bots without revealing which sites you visit. It works because Apple controls the hardware, creating a trust anchor.

But we can build on this without needing hardware manufacturers involved.

How Anonymous Credentials Actually Work

The cryptography sounds complicated, but the concept is simple.

A party you already trust gives you a credential. Later, when a website needs proof you're legitimate, you present it. The website learns only what it needs: that you're real and within rate limits. Nothing about your identity. Nothing about your browsing history. Nothing that lets sites track you across the web.

Think of a library card that proves you're a member without recording which books you borrowed. You get access. The library gets proof you're legit. Nobody builds a profile of your reading habits.

The same principle applies to rate limiting. A credential says "this user is genuine and hasn't hit their limit" without revealing who they are, where the credential came from, or enabling correlation between sites.

This is what makes privacy-preserving vouching work. And unlike hardware attestation, it doesn't hand control to chip makers or OS developers.

What This Means for Anyone Building Websites

If you've built anything online, you've felt this tension. You want to protect your infrastructure. But you also don't want to frustrate real visitors.

Current options are crude. CAPTCHAs fail 30-50% of the time for actual humans. IP blocking catches VPN and Tor users indiscriminately. Login walls shrink your audience and create friction.

Privacy-preserving anonymous credentials would change that tradeoff. Better signal about legitimate traffic without invasive tracking. Smoother experience for users without sacrificing privacy.

At NameOcean, we're paying close attention because the same principles matter for domain registration and DNS. We've seen what happens when critical infrastructure gets too concentrated. A web where anyone can vouch for users—and sites can choose which issuers to trust—reflects what we believe: the open, decentralized architecture of the internet should be protected at every layer.

What's Next

We're not solving this tomorrow. Rolling out anonymous credentials at web scale means tackling hard problems in cryptography, standardization, and user experience. The proposals floating around at Mozilla, Cloudflare, and among browser vendors are encouraging, but they're still early.

Here's what matters: the conversation is happening.

The web doesn't have to pick between privacy and usability. We can build systems that verify humans without surveilling them.

Until then, you'll keep squinting at those crosswalks.

But maybe not forever.