The barrier to entry for anonymous digital participation keeps rising through hardware-level verification, and the gatekeepers are always corporations with their own interests.
Gmail now requires QR code scanning and SMS for new accounts. Same anti-abuse tightening pattern as the EU Digital Identity Wallet requiring hardware attestation from Google or Apple's secure enclaves. And now Cloudflare Turnstile requires WebGL fingerprinting just to prove you're not a bot.
The HN story about Cloudflare's Turnstile using WebGL fingerprinting hit #1 with 668 points. The comment by userbinator sums it up: "this stupid war against bots is going to lead to the downfall of the internet and effectively turn it into a curated library." Cloudflare uses JA3 fingerprinting to match against user agents, blocking curl while allowing OkHttp. They're fingerprinting your GPU canvas now.
These are all the same phenomenon: verification is shifting from what you know (passwords) to what you are (biometrics) to what you own (hardware attestation). Each step raises the cost of pseudonymity.
The EU Digital Identity Wallet is the starkest example. It requires signing with a hardware-backed key from Google or Apple's secure enclave. You can't participate in what the EU considers essential digital services without proving you own an attested device from an approved vendor. The wallet itself is an app, but the key material lives in the TEE (Trusted Execution Environment) of your phone, signed by the manufacturer's key that chains back to a CA.
This isn't about stopping bots. It's about who gets to decide what counts as a legitimate identity. And right now, that decision is being handed to the companies that control the hardware.
The framing is always "security" or "anti-fraud." But the structural effect is the same every time: a tiered internet where verified devices get access and everything else gets CAPTCHA loops, rate limiting, or outright denial. The pseudonymous web that existed from the early 2000s through the 2010s is being walled off, not all at once, but one verification requirement at a time.