IP blocks should be neither authentication nor authorization

> Privacy-preserving protocols like this have become practical just recently, over the past few years. It's a shame we haven't yet begun to explore their potential. The alternative is something like the Cloudflare Monetization Gateway

I think a maybe better interesting alternative – funnily enough also from Cloudflare – is CAP: https://developers.cloudflare.com/fundamentals/reference/...

CAP uses WebAuthn to basically do two things: see if your device has an attested WebAuthn hardware authenticator it can trust, and then it ask the trusted hardware to perform biometric user authentication.

And this is kinda clever, because this means it simply uses WebAuthn as an open standard, and everyone can implement it independently of Cloudflare. The only downside is that with this approach the same user can be re-identified; I think an extension to WebAuthn could help with that.