Thibault Meunier

thibault.uk · github.com/thibmeu · cv@thibault.uk

Principal Research Engineer at Cloudflare working on privacy-preserving authentication for the web.

Experience

Cloudflare — London, then Remote · May 2019 – present
Principal Research Engineer (2025–) · Research Engineer (2020–2025) · Systems Engineer (2019–2020)

• Lead research on Privacy Pass and bot authentication; upgraded Cloudflare’s deployment to the IETF standard, the protocol behind Private Access Tokens. It serves billions of requests a day.
• Initiated Web Bot Auth, cryptographic verification of bot and agent traffic with HTTP message signatures. Major CDN, cloud, and AI providers now run independent implementations.
• Built anonymous-credential rate limiting for bots and agents without compromising user privacy.
• Shipped key transparency auditing for WhatsApp’s end-to-end encrypted messaging: public dashboard, Real World Crypto talk, and follow-up standardisation work.
• Co-designed the Cryptographic Attestation of Personhood, a CAPTCHA alternative studied in a SOUPS 2022 paper.
• Designed and implemented lock-free probabilistic caching in Cloudflare’s CDN.
• Mentor team members, and have written more than 15 posts for the Cloudflare blog.

LiquidChain GmbH — Zug, Switzerland · Mar 2018 – Apr 2019
Research Engineer — distributed-ledger research and prototyping.

CERN — Geneva, Switzerland · Jun – Sep 2017
Intern — built a developer-tools web portal in React.

Isode Ltd — Hampton, UK · Jun – Sep 2016
Software Engineering Intern — built a Unicode-compliant emoji keyboard and TCL-based testing for XMPP.

Standards & service

• Chair of the IETF Open Cloud Mesh (OCM) working group, which standardises federated file sharing.
• Batched Token Issuance Protocol — draft-ietf-privacypass-batched-tokens, submitted for publication.
• Privacy Pass Reverse Flow — draft-meunier-privacypass-reverse-flow, an extension of the Privacy Pass issuance flow.
• Author of the Web Bot Auth drafts (HTTP message signatures protocol, directory, registry).

Selected publications & writing

• Let The Right One In: Attestation as a Usable CAPTCHA Alternative — SOUPS 2022.
• Forget IPs: using cryptography to verify bot and agent traffic — Cloudflare blog, 2025.
• Cloudflare audits key transparency for WhatsApp — Cloudflare blog, 2024.
• Humanity wastes about 500 years per day on CAPTCHAs — Cloudflare blog, 2021.

Open source

tlock-rs and drand-rs (timelock encryption in Rust) · age-plugin-simplepq and age-plugin-hpke (post-quantum and HPKE plugins for age) · ohttp-ts (Oblivious HTTP in TypeScript)

Education

Imperial College London — MSc Computing, Security and Reliability · 2017 – 2018

ENSEEIHT, Toulouse — Engineering degree, Mathematics and Computer Science · 2015 – 2018

Lycée du Parc, Lyon — Classes préparatoires, PC* · 2013 – 2015