Nikita Bier: Proxy self-verification is a challenge for the next five years

Former X Product Head Nikita Bier stated that the most important technical issue in the next five years is to establish widely accepted standards that allow proxies to prove their identity to service providers. Based on this, service providers can separate proxy traffic from human traffic and modify their interfaces.

He believes that the next six months are merely a transition period. Proxies will engage in a cat-and-mouse game to bypass detection in order to maintain the usability of products during their growth phase. This is just a stopgap measure and not a final solution. The post was in response to discussions about browser proxy use cases disappearing by about half within two days and websites beginning to change their strategies.

Bier had previously written in the same direction on September 22. He stated that bot detection and human verification would become the most urgent needs for businesses, as proxy clusters would overwhelm websites and forms, with small companies and government websites being the most vulnerable. At that time, he mentioned that X had evaluated market solutions but found none that integrated the latest technologies, so detection had to be done in-house.

He stepped down as X Product Head in August and transitioned to a consulting role, publicly stating that he is no longer full-time. During his tenure, X launched country of origin labeling for data sources and strengthened defenses against AI bots and spam traffic. This time, the issue was reframed from "blocking bots" to "allowing proxies to legally self-report their identity."

In responses, some have already proposed specifications in development. One side of WorkOS mentioned an open specification auth.md for proxy identity and registration. Another response stated that the existing OAuth authorization scope is too broad for proxies, and that Cross-App Access and ID-JAG are attempts at specification layers, with implementation possibly taking another two to three years. Until then, the authorizations obtained by proxies and regular applications will appear the same, relying only on post-authorization behavior for differentiation.

The buyers are proxy products that need to access websites, while the sellers are websites, forms, and login services. This is a detection battle driven by regulatory gaps, not a new model release. Within six months, funding will flow towards bypassing detection and human verification, while websites will allocate budgets for interception. The party that can first establish identity standards will benefit, while proxies that rely on disguising human traffic and small sites and government sites without protection will be under pressure.

Bier divides the timeline into two segments: five years to establish standards, and six months of guerrilla tactics. The endgame is for service providers to know that the other side is a proxy and proactively modify their interfaces, rather than continuing to treat all non-human traffic as an attack.

Source: Public Information