The Mozilla led proposal for "anonymous credentials" moves the anti bot chokepoint to a new protocol role called the Moderator, and the standards drafts leave that role's governance undefined.
Open a news site in a private window. Switch on a VPN. Try to leave a comment or finish a checkout. The page asks you to prove you are not a bot, again, harder this time, and on the third failure it tells you to disable your privacy tool or sign in with a big identity provider. The friction feels personal, but it is structural: the passive signals anti-abuse systems once used to tell humans from bots are the very signals privacy tools were built to remove.
A proposal published on Mozilla's Hacks blog in June 2026 calls that collision "the bot era." The post, titled "Pact: Anonymous Credentials for the Web," frames its answer as a cryptographic token that proves a visitor is a real, unique person without revealing which person. Mozilla positions the primitive as a privacy-preserving middle path between invasive login walls and CAPTCHA walls that bots now solve faster than humans.
Pact is not a finished product. It is a design direction anchored in two parallel standards efforts. The first is a W3C event, the Pact Workshop, held in May 2026, which convened browser vendors, identity researchers, and abuse-fighters. The second is an IETF draft series under the working title "Moderation of unLinkable Endorsements," or MOLE, with three documents covering architecture, HTTP transport, and protocol integration and cryptography. Working drafts live in two GitHub repositories, one for the IETF side and one for the nascent browser API side.
That paperwork is the easy half of the story. The harder half sits in a role the drafts call the Moderator.
In the current design, a user obtains an anonymous credential from a Moderator, then presents it to sites that want to confirm "unique human." The site verifies the proof without learning which Moderator issued it; the user is unlinkable across relying parties, which is the privacy property the marketing leans on. What the marketing leans on less is that someone has to decide who is allowed to issue the credential in the first place.
Issuer-side reputation is non-portable by design. If a Moderator turns out to be lax, the rest of the web does not automatically blacklist the credentials it issued, because the whole point is that sites cannot tell which Moderator signed any given token. That means the first Moderator to reach scale has a structural advantage: it becomes the de facto arbiter of "human enough" for whichever sites adopt the scheme, and switching costs rise with every site that accepts its credentials.
This is the relocation the wire coverage is missing. The proposal is not just a CAPTCHA replacement. It moves the anti-bot chokepoint away from today's commercial anti-abuse vendors and into a new protocol role whose governance question is undefined in the current drafts. Hacker News readers working through the same post have surfaced two open community questions that map directly onto that governance gap: can a Moderator be self-hosted by a community or a federation, the way email and certificate authorities have been, and what stops a browser-resident AI agent from inheriting a human's good standing and using it to act at scale.
Both questions matter for the same reason. If Moderator issuance stays centralized in a small number of large operators, the "anonymous credentials" framing produces a credentialed web whose authentication backbone is more concentrated than the CAPTCHA market it replaces. If issuance is federated or self-hostable, the proposal becomes something closer to a public utility, with a different but equally large set of governance tradeoffs. The cryptography in the MOLE drafts is agnostic on this point. The institutional design is not.
Mozilla's own framing, that anti-abuse tooling now hurts privacy-respecting users while still failing to catch modern bots, is the reason the dilemma is real. Generative AI has pushed CAPTCHA solve rates above human speed on the bot side, and privacy browsers, VPNs, and anti-fingerprinting have pulled the rug out from the passive signals that used to keep the playing field level. The post acknowledges that volumetric abuse, including SEO comment spam, credential stuffing, and distributed denial-of-service attacks, is a problem any proposal must answer to.
What to watch next. First, whether the W3C workshop output names specific Moderator operators or leaves the role open and contested. Second, whether the IETF drafts harden the cryptography before the protocol details drift further from the marketing. Third, whether community proposals for self-hosted or federated Moderators gain traction in the internet-drafts repository and the web-drafts repository, or get edged out by a single-vendor reference implementation. The privacy primitive is the headline. The issuance role is the product.