Muse quietly starts signing its web visits so sites can verify it

Meta is quietly testing Web Bot Auth signatures on Muse and Meta-WebIndexer requests, so sites can tell a real Muse visit from an impostor. Only a small share of traffic is signed so far.

Reported byppc.land (opens the original story)

In this brief: 3 sections 2 min read

- • Signing observed since around October 12, and growing since then
- • Covers Muse and the Meta-WebIndexer crawler
- • Requests were first labeled under the Meta-ExternalTest user-agent string
- • Meta has made no public announcement
- • Muse runs in cloud VMs, so its traffic arrives from Cloudflare and Fastly addresses
- • Amazon blocked Muse in part because it did not identify itself when browsing
- • A valid signature lets a site allow, rate-limit, or block Muse on purpose
- • Unsigned requests still need fingerprinting to spot
- • No count or percentage of signed requests given
- • Meta's docs do not mention Web Bot Auth or a key directory
- • Unknown whether Meta-ExternalAgent or other agents will sign
- • OpenAI's ChatGPT agent signed 78.4% of sessions in Q3, the only agent at scale

Read full analysis on ppc.land

Useful?