{"slug": "privacy-pass", "name": "Privacy Pass", "category": "browsers", "category_name": "Browsers and extensions", "description": "", "recommenders": 6, "commenters": 11, "warners": 2, "score": 3.407, "rising": -0.64, "first": "2025-11-04", "latest": "2026-09-29", "why": "You can use the privacy pass [0] browser extension to skip them.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 6, "neutral": 4, "compare": 0, "warn": 2}, "spark": [2, 1, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "You can use the privacy pass [0] browser extension to skip them.", "kind": "", "icon": true, "domain": "cloudflare.com", "github_repo": null, "official_url": "https://privacypass.github.io", "pricing": "", "aliases": ["Privacy Pass"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 793471184, "item_id": 49591949, "url": "https://news.ycombinator.com/item?id=49591949", "by": "tomodachi94", "date": "2026-09-06", "version": null, "stance": "recommend", "quote": "Privacy Pass does something similar to what you describe", "excerpt": "Privacy Pass does something similar to what you describe: https://developers.cloudflare.com/waf/tools/privacy-pass/", "context": "", "use_case": "", "switched_from": "", "story": "It took a year to ship WebAssembly in Anubis"}, {"id": 768991360, "item_id": 48061960, "url": "https://news.ycombinator.com/item?id=48061960", "by": "palata", "date": "2026-05-08", "version": null, "stance": "recommend", "quote": "Look at Privacy Pass, it's interesting!", "excerpt": "> But how can this be done so that the site and I'd verifier can't collude on a backchannel to unmask you? Now we're talking :-). Look at Privacy Pass, it's interesting! If you like RFCs, it's here: https://www.rfc-editor.org/rfc/rfc9576.html Kagi has a nice explanation here: https://help.kagi.com/kagi/privacy/how-does-privacy-pass-work.html", "context": "", "use_case": "", "switched_from": "", "story": "Kids bypass age verification with fake moustaches"}, {"id": 746729936, "item_id": 46670621, "url": "https://news.ycombinator.com/item?id=46670621", "by": "promiseofbeans", "date": "2026-01-18", "version": null, "stance": "recommend", "quote": "You can use the privacy pass [0] browser extension to skip them.", "excerpt": "The vast majority of website-gate captchas are served by cloudflare these days. You can use the privacy pass [0] browser extension to skip them. Privacy passes are an open standard [1], so you can re-implement it yourself if you don\u2019t trust that extension. [0]: https://developers.cloudflare.com/waf/tools/privacy-pass/ [1]: RFC 9576 https://www.rfc-editor.org/rfc/rfc9576.html, RFC 9577 https://www.rfc-editor.org/rfc/r", "context": "", "use_case": "Skip CAPTCHA challenges", "switched_from": "", "story": "The grab list: how museums decide what to save in a disaster"}, {"id": 739855488, "item_id": 46240968, "url": "https://news.ycombinator.com/item?id=46240968", "by": "notpushkin", "date": "2025-12-11", "version": null, "stance": "recommend", "quote": "I would throw in Privacy Pass [1]", "excerpt": "I would throw in Privacy Pass [1], just in case the government and SickBooze.com can exchange info. Sadly, it\u2018s still hard to explain how exactly it works, but conceptually simpler than arbitrary ZKPs. [1]: https://privacypass.github.io/", "context": "", "use_case": "", "switched_from": "", "story": "EFF launches Age Verification Hub"}, {"id": 735491024, "item_id": 45968189, "url": "https://news.ycombinator.com/item?id=45968189", "by": "octoberfranklin", "date": "2025-11-18", "version": null, "stance": "recommend", "quote": "the good one (linked below) lets you use the \"humanness\" token across different websites", "excerpt": "Yes, there are several, and the good one (linked below) lets you use the \"humanness\" token across different websites without them being able to use it as a tracking signal / supercookie. It's very clever. https://github.com/ietf-wg-privacypass/base-drafts https://privacypass.github.io/", "context": "", "use_case": "", "switched_from": "", "story": "Cloudflare Global Network experiencing issues"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 798323456, "item_id": 49895216, "url": "https://news.ycombinator.com/item?id=49895216", "by": "theamk", "date": "2026-09-29", "version": null, "stance": "warn", "quote": "Even PrivacyPass stopped using RSA signatures for that reason", "excerpt": "relevant parts from linked repo: > The algorithm only works if a raw signing oracle is available. Most RSA usage in practice (that is, RSA signatures using PKCS#1v1.5 or RSA-PSS padding) do not expose such an oracle, and thus this attack does not pose a practical risk. Examples of RSA use that do expose such a signing oracle would include blind RSA signatures (e.g. Privacy Pass) or HSM APIs. > Are people actually sti", "context": "", "use_case": "", "switched_from": "", "story": "There's a new way to break RSA that's faster than anything we've seen before"}, {"id": 778584849, "item_id": 48661553, "url": "https://news.ycombinator.com/item?id=48661553", "by": "Chu4eeno", "date": "2026-06-24", "version": null, "stance": "warn", "quote": "seems kind of dead (a dependabot zombie)", "excerpt": "Wasn't Privacy Pass supposed to fix this? Let the browser generate and store some PoW or something that it hands off to the site, so each site doesn't have to do the same thing. https://github.com/cloudflare/pp-browser-extension seems kind of dead (a dependabot zombie). eta: I completely missed this two days ago: https://www.cloudflare.com/press/press-releases/2026/cloudflare-collaborates-with-leading-browsers-to-dev", "context": "", "use_case": "", "switched_from": "", "story": "We're making Bunny DNS free: because a faster internet won't build itself"}]}], "who": [], "tags": [], "use_cases": ["anonymous attestation tokens", "skip captcha challenges", "passing turnstile challenges"], "compared": [{"slug": "kagi", "name": "Kagi", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=45963780", "title": "Cloudflare Global Network experiencing issues", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=49894893", "title": "There's a new way to break RSA that's faster than anything we've seen before", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49590611", "title": "It took a year to ship WebAssembly in Anubis", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48657030", "title": "We're making Bunny DNS free: because a faster internet won't build itself", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48281850", "title": "Google, I Dump Your Ass", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48227860", "title": "Using Kagi Search with Low Vision", "mentions": 1}], "sentiment_by_month": {"2025-11": {"recommend": 2, "neutral": 1}, "2025-12": {"recommend": 1}, "2026-01": {"recommend": 1, "neutral": 1}, "2026-02": {}, "2026-03": {}, "2026-04": {}, "2026-05": {"recommend": 1, "neutral": 2}, "2026-06": {"warn": 1}, "2026-07": {}, "2026-08": {}, "2026-09": {"recommend": 1, "warn": 1}, "2026-10": {}}, "versions": [], "version_unnamed": 0, "family_ref": null, "runs_on": null, "lines": [], "quotes": [{"id": 798323456, "item_id": 49895216, "url": "https://news.ycombinator.com/item?id=49895216", "by": "theamk", "date": "2026-09-29", "version": null, "stance": "warn", "quote": "Even PrivacyPass stopped using RSA signatures for that reason", "excerpt": "relevant parts from linked repo: > The algorithm only works if a raw signing oracle is available. Most RSA usage in practice (that is, RSA signatures using PKCS#1v1.5 or RSA-PSS padding) do not expose such an oracle, and thus this attack does not pose a practical risk. Examples of RSA use that do expose such a signing oracle would include blind RSA signatures (e.g. Privacy Pass) or HSM APIs. > Are people actually sti", "context": "", "use_case": "", "switched_from": "", "story": "There's a new way to break RSA that's faster than anything we've seen before"}, {"id": 793471184, "item_id": 49591949, "url": "https://news.ycombinator.com/item?id=49591949", "by": "tomodachi94", "date": "2026-09-06", "version": null, "stance": "recommend", "quote": "Privacy Pass does something similar to what you describe", "excerpt": "Privacy Pass does something similar to what you describe: https://developers.cloudflare.com/waf/tools/privacy-pass/", "context": "", "use_case": "", "switched_from": "", "story": "It took a year to ship WebAssembly in Anubis"}, {"id": 778584849, "item_id": 48661553, "url": "https://news.ycombinator.com/item?id=48661553", "by": "Chu4eeno", "date": "2026-06-24", "version": null, "stance": "warn", "quote": "seems kind of dead (a dependabot zombie)", "excerpt": "Wasn't Privacy Pass supposed to fix this? Let the browser generate and store some PoW or something that it hands off to the site, so each site doesn't have to do the same thing. https://github.com/cloudflare/pp-browser-extension seems kind of dead (a dependabot zombie). eta: I completely missed this two days ago: https://www.cloudflare.com/press/press-releases/2026/cloudflare-collaborates-with-leading-browsers-to-dev", "context": "", "use_case": "", "switched_from": "", "story": "We're making Bunny DNS free: because a faster internet won't build itself"}, {"id": 772565777, "item_id": 48285361, "url": "https://news.ycombinator.com/item?id=48285361", "by": "JackGreyhat", "date": "2026-05-26", "version": null, "stance": "neutral", "quote": "supposedly does not reveal who you are", "excerpt": "They have a solution for that, called privacy pass. It uses tokens to show the system you are a paid user, but supposedly does not reveal who you are. I haven't tried it myself, so I have no idea if it works as it should. I'm still deciding to subscribe or not. More info: https://help.kagi.com/kagi/privacy/privacy-pass.html", "context": "", "use_case": "", "switched_from": "", "story": "Google, I Dump Your Ass"}, {"id": 771687889, "item_id": 48230493, "url": "https://news.ycombinator.com/item?id=48230493", "by": "promiseofbeans", "date": "2026-05-21", "version": null, "stance": "neutral", "quote": "It should also work with the Cloudflare privacy pass extension", "excerpt": "It should also work with the Cloudflare privacy pass extension [0] FWIW, since Kagi just implemented RFC 9576 [1] [0]: https://blog.cloudflare.com/privacy-pass-standard/ [1]: https://www.rfc-editor.org/rfc/rfc9576", "context": "", "use_case": "", "switched_from": "", "story": "Using Kagi Search with Low Vision"}, {"id": 768991360, "item_id": 48061960, "url": "https://news.ycombinator.com/item?id=48061960", "by": "palata", "date": "2026-05-08", "version": null, "stance": "recommend", "quote": "Look at Privacy Pass, it's interesting!", "excerpt": "> But how can this be done so that the site and I'd verifier can't collude on a backchannel to unmask you? Now we're talking :-). Look at Privacy Pass, it's interesting! If you like RFCs, it's here: https://www.rfc-editor.org/rfc/rfc9576.html Kagi has a nice explanation here: https://help.kagi.com/kagi/privacy/how-does-privacy-pass-work.html", "context": "", "use_case": "", "switched_from": "", "story": "Kids bypass age verification with fake moustaches"}, {"id": 748795456, "item_id": 46799716, "url": "https://news.ycombinator.com/item?id=46799716", "by": "coppsilgold", "date": "2026-01-28", "version": null, "stance": "neutral", "quote": "The idea behind blind signatures is that the server will give you a signed token", "excerpt": "The idea behind blind signatures is that the server will give you a signed token which is blinded and you can un-blind it on your end and then use it. The consumer of the token will not be able to collude with the issuer of the token to figure out who it was given to. There is more info here: <https://blog.cloudflare.com/privacy-pass-the-math/> I don't know if that's what Apple actually does. If it is, once it gets p", "context": "", "use_case": "anonymous attestation tokens", "switched_from": "", "story": "Lennart Poettering, Christian Brauner founded a new company"}, {"id": 746729936, "item_id": 46670621, "url": "https://news.ycombinator.com/item?id=46670621", "by": "promiseofbeans", "date": "2026-01-18", "version": null, "stance": "recommend", "quote": "You can use the privacy pass [0] browser extension to skip them.", "excerpt": "The vast majority of website-gate captchas are served by cloudflare these days. You can use the privacy pass [0] browser extension to skip them. Privacy passes are an open standard [1], so you can re-implement it yourself if you don\u2019t trust that extension. [0]: https://developers.cloudflare.com/waf/tools/privacy-pass/ [1]: RFC 9576 https://www.rfc-editor.org/rfc/rfc9576.html, RFC 9577 https://www.rfc-editor.org/rfc/r", "context": "", "use_case": "Skip CAPTCHA challenges", "switched_from": "", "story": "The grab list: how museums decide what to save in a disaster"}, {"id": 739855488, "item_id": 46240968, "url": "https://news.ycombinator.com/item?id=46240968", "by": "notpushkin", "date": "2025-12-11", "version": null, "stance": "recommend", "quote": "I would throw in Privacy Pass [1]", "excerpt": "I would throw in Privacy Pass [1], just in case the government and SickBooze.com can exchange info. Sadly, it\u2018s still hard to explain how exactly it works, but conceptually simpler than arbitrary ZKPs. [1]: https://privacypass.github.io/", "context": "", "use_case": "", "switched_from": "", "story": "EFF launches Age Verification Hub"}, {"id": 735491024, "item_id": 45968189, "url": "https://news.ycombinator.com/item?id=45968189", "by": "octoberfranklin", "date": "2025-11-18", "version": null, "stance": "recommend", "quote": "the good one (linked below) lets you use the \"humanness\" token across different websites", "excerpt": "Yes, there are several, and the good one (linked below) lets you use the \"humanness\" token across different websites without them being able to use it as a tracking signal / supercookie. It's very clever. https://github.com/ietf-wg-privacypass/base-drafts https://privacypass.github.io/", "context": "", "use_case": "", "switched_from": "", "story": "Cloudflare Global Network experiencing issues"}, {"id": 735467824, "item_id": 45966739, "url": "https://news.ycombinator.com/item?id=45966739", "by": "basilikum", "date": "2025-11-18", "version": null, "stance": "neutral", "quote": "https://developers.cloudflare.com/waf/tools/privacy-pass/", "excerpt": "https://developers.cloudflare.com/waf/tools/privacy-pass/", "context": "", "use_case": "", "switched_from": "", "story": "Cloudflare Global Network experiencing issues"}, {"id": 733085536, "item_id": 45817846, "url": "https://news.ycombinator.com/item?id=45817846", "by": "baobun", "date": "2025-11-04", "version": null, "stance": "recommend", "quote": "have you tried PrivacyPass browser extension?", "excerpt": "This may be crapshoot but have you tried PrivacyPass browser extension? https://addons.mozilla.org/en-US/firefox/addon/privacy-pass/ https://privacypass.github.io/", "context": "", "use_case": "passing Turnstile challenges", "switched_from": "", "story": "Ask HN: Help me pass Cloudflare Turnstile on my phone?"}]}