Device attestation

Cryptographic attestation of a genuine device or platform (e.g. Private Access Tokens) that lets a site admit real users without a CAPTCHA while blocking headless automation.

grounded in: HN front page 2026-07-12 themes: 'proving you're human' + the scraper-vs-anti-scraper arms race