A visitor using privacy protections can face more website challenges because the site has fewer signals with which to distinguish ordinary browsing from automated abuse. Mozilla’s proposed PACT architecture tries to give sites a useful access signal without requiring them to learn a visitor’s identity or browsing history.
In its 23 June technical explanation, Mozilla describes anonymous credentials that can support rate limits. The proposal focuses on limiting abusive scale while preserving the user’s choice of browser and privacy tools.
A credential carries permission rather than a name
The architecture separates several roles. An Anchor can issue an endorsement based on an existing relationship with a user, such as a subscription. A Moderator accepts endorsements from Anchors it trusts and issues a credential that participating websites can recognise.
The browser would present that credential when accessing a site. Cryptographic techniques are intended to prevent its presentations being linked into a browsing history, and to hide which particular accepted Anchor supplied the original endorsement.
That separation is central to the proposal. If a website could identify the service that vouched for a visitor, the credential might reveal a relationship the visitor did not intend to disclose. A collection of such relationships could itself become a tracking signal.
Rate limits need something difficult to manufacture
A limit is ineffective if an abusive operator can cheaply discard an identity and create another. Mozilla therefore looks for existing relationships or resources that are harder to reproduce at scale, without restricting that role to a particular hardware manufacturer.
The proposal would also allow credentials to change as a site or Moderator observes behaviour. This is intended to support different treatment of benign and suspicious activity without turning the credential into an ordinary cross-site identifier.
There are governance questions as well as cryptographic ones. Sites choose Moderators, and Moderators decide which Anchors to trust. Mozilla acknowledges that a small set of dominant participants could become new gatekeepers, so openness depends on how those choices work in practice.
This remains a design under development
Mozilla says many details still need to be resolved and the system requires rigorous privacy and security analysis. It plans to take the underlying protocols to the IETF and the browser-facing interface to the W3C as drafts are ready.
Readers should therefore treat PACT as a proposed architecture, not an already universal replacement for CAPTCHAs or login requirements. The difficult test is whether the full system can preserve unlinkability while giving sites a dependable way to control abuse.
The proposal complements, rather than replaces, work on the browser itself. Our Firefox security report examines a separate layer: finding and repairing vulnerabilities in the software that handles web content.
Questions
Is PACT already a web standard?
No. Mozilla presents an architecture under development, with analysis and standards work still ahead.
What is an Anchor in the PACT proposal?
An Anchor can endorse a user based on an existing relationship that a Moderator accepts.
Why must credential presentations be unlinkable?
Linking them across sites could turn an access signal into a record of someone’s browsing.
