Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

mCaptcha – Proof of work based, privacy respecting CAPTCHA system

github.com

Post reply on HN
Print view View original

21–30 of 100 posts

Re: mCaptcha – Proof of work based, privacy respecting CAPTCHA system

#21

Post by realaravinth »

blackoil wrote: post #15

If it became popular enough, people with weakest machines and mobiles will suffer, while a spam bot can ruin optimized code or ASIC.

Very good point!

Accessibility is a critical to mCaptcha. In fact, Codeberg is trying out mCaptcha purely because of its more accessible[0]. That said, it is possible to choose a difficulty factor very high to deny access to folks with older, slower devices. A survey to benchmark mCaptcha performance on devices in the wild is WIP[1]. I hope it will provide insights to help webmasters integrating mCaptcha to select difficulty factors that work for their visitors.

[0]: https://codeberg.org/Codeberg/Community/issues/479#issuecomm...

[1]: https://github.com/mCaptcha/survey

Re: mCaptcha – Proof of work based, privacy respecting CAPTCHA system

#22

Post by ivanhoe »

supernes wrote: post #18
realaravinth wrote: post #11

Earlier quoted context omitted.

> I appreciate the effort towards better UX, but there are already "invisible" CAPTCHAs like Botpoison that discriminate better than this. Interesting project, thank you for sharing! From Botpoison's website[0] under FAQ: > Botpoison combines: > - Hashcash , a cryptographic hash-based proof-of-work algorithm. > - IP reputation checks, cross-referencing proprietary and 3rd party data sets. > - IP rate-limits. > - Sess…

Thinking about it a bit more, systems like mCaptcha and Botpoison aren't really CAPTCHA in the strict sense - they solve a somewhat different problem than telling if there's a human at the other end, and IMO that's an important distinction to make (and doesn't necessarily make them inferior to other solutions.) I still think PoW alone is not enough as it can be automated, albeit at a slower rate. Most of the time I w…

strictly speaking it's a rate limiter, not captcha... but frankly it's probably closer to what most ppl use captchas for these days...

Re: mCaptcha – Proof of work based, privacy respecting CAPTCHA system

#23

Post by realaravinth »

supernes wrote: post #18
realaravinth wrote: post #11

Earlier quoted context omitted.

> I appreciate the effort towards better UX, but there are already "invisible" CAPTCHAs like Botpoison that discriminate better than this. Interesting project, thank you for sharing! From Botpoison's website[0] under FAQ: > Botpoison combines: > - Hashcash , a cryptographic hash-based proof-of-work algorithm. > - IP reputation checks, cross-referencing proprietary and 3rd party data sets. > - IP rate-limits. > - Sess…

Thinking about it a bit more, systems like mCaptcha and Botpoison aren't really CAPTCHA in the strict sense - they solve a somewhat different problem than telling if there's a human at the other end, and IMO that's an important distinction to make (and doesn't necessarily make them inferior to other solutions.) I still think PoW alone is not enough as it can be automated, albeit at a slower rate. Most of the time I w…

> Thinking about it a bit more, systems like mCaptcha and Botpoison aren't really CAPTCHA in the strict sense

Very true! I chose to use “captcha” because it's easier to convey what it does than, say, calling it a PoW-powered rate-limter.

> The real value is in the combination of factors, especially what BP call the "session and request analysis" and other fingerprinting solutions.

Also true. I'm not sure if it is possible to implement fingerprinting without tracking activity across the internet --- something that a privacy-focused software can't do.

I have been investigating privacy-focused, hash-based spam detection that uses peer reputation[0] but the hash-based mechanism can be broken with a slight modification to the spam text.

I would love to implement spam detection but it shouldn't compromise the visitor's privacy :)

[0]: please see "kavasam" under "Projects that I'm currently working on". I should set up a website for the project soon. https://batsense.net/about

Disclosure: author of mCaptcha.

Re: mCaptcha – Proof of work based, privacy respecting CAPTCHA system

#24

Post by AbacusAvenger »

realaravinth wrote: post #16
AbacusAvenger wrote: post #13

I looked into doing something like this once and decided it wasn't going to be very effective, for a few different reasons. JS engines (or even WASM) aren't going to be as fast at this kind of work as native machine code would be. Especially when you consider that libraries like OpenSSL have heavily tuned implementations of the SHA algorithms. Any bot solving a SHA-based challenge would be able to extract the challen…

Thank you for your detailed response, you raise some very interesting and valid points! > JS engines (or even WASM) aren't going to be as fast at this kind of work as native machine code would be You are right. mCaptcha has a WASM and a JS polyfill implementations. Native code will definitely be faster than WASM but in an experiment I ran for fun[0], I discovered that the WASM was roughly 2s slower than native implem…

About the benchmark data:

It looks like your pow_sha256 library is using is the "sha2" crate, which is a pure Rust implementation of SHA2. So your benchmark is around the delta of your library compiled to native code vs. your library compiled to WASM, which is an interesting benchmark but I don't think it answers the right question.

A more interesting benchmark would probably answer the question "what would those looking to defeat mCaptcha use and how does that performance compare?" So perhaps an implementation of an mCaptcha challenge solver using OpenSSL would be warranted for that.

Re: mCaptcha – Proof of work based, privacy respecting CAPTCHA system

#25

Post by arsome »

realaravinth wrote: post #21
blackoil wrote: post #15

If it became popular enough, people with weakest machines and mobiles will suffer, while a spam bot can ruin optimized code or ASIC.

Very good point! Accessibility is a critical to mCaptcha. In fact, Codeberg is trying out mCaptcha purely because of its more accessible[0]. That said, it is possible to choose a difficulty factor very high to deny access to folks with older, slower devices. A survey to benchmark mCaptcha performance on devices in the wild is WIP[1]. I hope it will provide insights to help webmasters integrating mCaptcha to select di…

The problem is that mCaptcha allows you to deny access to older, slower devices, but does nothing to deny access to bots. Which can likely run optimized implementations of the PoW which run hundreds of times faster than the web based version.

Re: mCaptcha – Proof of work based, privacy respecting CAPTCHA system

#27

Post by realaravinth »

AbacusAvenger wrote: post #24
realaravinth wrote: post #16

Earlier quoted context omitted.

Thank you for your detailed response, you raise some very interesting and valid points! > JS engines (or even WASM) aren't going to be as fast at this kind of work as native machine code would be You are right. mCaptcha has a WASM and a JS polyfill implementations. Native code will definitely be faster than WASM but in an experiment I ran for fun[0], I discovered that the WASM was roughly 2s slower than native implem…

About the benchmark data: It looks like your pow_sha256 library is using is the "sha2" crate, which is a pure Rust implementation of SHA2. So your benchmark is around the delta of your library compiled to native code vs. your library compiled to WASM, which is an interesting benchmark but I don't think it answers the right question. A more interesting benchmark would probably answer the question "what would those loo…

That's a good idea, I'll be sure to do that!
Post reply on HN