Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

mCaptcha – Proof of work based, privacy respecting CAPTCHA system

github.com

Post reply on HN
Print view View original

31–40 of 100 posts

Re: mCaptcha – Proof of work based, privacy respecting CAPTCHA system

#31

Post by AbacusAvenger »

realaravinth wrote: post #27
AbacusAvenger wrote: post #24

Earlier quoted context omitted.

About the benchmark data: It looks like your pow_sha256 library is using is the "sha2" crate, which is a pure Rust implementation of SHA2. So your benchmark is around the delta of your library compiled to native code vs. your library compiled to WASM, which is an interesting benchmark but I don't think it answers the right question. A more interesting benchmark would probably answer the question "what would those loo…

That's a good idea, I'll be sure to do that!

Also remember that native code can use multithreading, so if your challenge is something that could be farmed out to multiple CPU threads until one finds the solution, that's another factor in favor of native code performance.

Re: mCaptcha – Proof of work based, privacy respecting CAPTCHA system

#32

Post by zhfliz »

oefrha wrote: post #29

Just checked a commercial captcha solving service, Recaptcha rate is currently at $1-$2 per thousand. Looks like this is only going to be cheaper to operate commercially.

cheapest offers go down to $0.55-$0.6 for 1k recaptcha v2 with solving times from close to a second up to 3 minutes depending on provider and luck.

Re: mCaptcha – Proof of work based, privacy respecting CAPTCHA system

#34

Post by tmikaeld »

progx wrote: post #33

This fights spammers, that use own server, but this will not protect from hostile taken computers, that can use their hash power to resolve the captcha.

It does, why spend >4 seconds for a single spam when you can move to a new target and send >40 spams in the same time?

Re: mCaptcha – Proof of work based, privacy respecting CAPTCHA system

#36

Post by realaravinth »

red0point wrote: post #28

I couldn‘t figure out how this scheme works - the only detail I found is that there is „a bunch of maths“ and replay protection of some sort. Is there a technical protocol description somewhere? I‘d be interested in reading this.

Apologies, the project isn't ready to be showcased yet. I literally woke up to a message from a friend that said it was on HN. I wish I could explain it on here, but I'm afraid it isn't that easy. Here's the high level overview:

1. mCaptcha sends a PoW configuration(first XHR request in the demo widget[0]) which includes a challenge text("string"), a salt and a difficulty factor

2. Client generates proof of work by concatenating "string" + salt until difficulty factor is met. If difficulty factor isn't satisfied, it will continue trying to generate Proof of Work(PoW) by appending nonce and incrementing it until the difficulty factor is satisfied.

3. Client sends PoW to mCaptcha, which includes nonce, original salt and "string"(second XHR request in the demo widget)

4.mCaptcha computes hash for "string" + salt + nonce. If difficulty factor is met(i.e resultant hash > difficulty factor), then mCaptcha responds with access token.

5. Client sends access token to the web service.

6. Web services authenticates access token with mCaptcha and only grants access to protected resource, if the token checks out.

I will work on a more detailed specification and report back when it is ready(3 weeks, I think)

[0]: https://demo.mcaptcha.org/widget/?sitekey=pHy0AktWyOKuxZDzFf...

disclosure: author of mCaptcha

Re: mCaptcha – Proof of work based, privacy respecting CAPTCHA system

#39

Post by quickthrower2 »

Has to be easy enough for an old laptop to prove in under 5 seconds but hard enough that (if this becomes popular) someone with a mining rig can’t be cracking millions of these a day.

Also the idea ain’t so new!: http://www.hashcash.org/hashcash.pdf

Re: mCaptcha – Proof of work based, privacy respecting CAPTCHA system

#40

Post by paranoidrobot »

AbacusAvenger wrote: post #31
realaravinth wrote: post #27

Earlier quoted context omitted.

That's a good idea, I'll be sure to do that!

Also remember that native code can use multithreading, so if your challenge is something that could be farmed out to multiple CPU threads until one finds the solution, that's another factor in favor of native code performance.

Lets just assume that you solve the "it takes a while to run" thing through some clever bits of hard-to-optimise math, that's difficult to parallelise or multithread or whatever.

If all it takes is computer time, then that's a cheap thing for the botnet operator to solve. They can just spin up another instance, and split up the crawling task to another computer (or 200).

Post reply on HN