Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

mCaptcha – Proof of work based, privacy respecting CAPTCHA system

github.com

Post reply on HN
Print view View original

81–90 of 100 posts

Re: mCaptcha – Proof of work based, privacy respecting CAPTCHA system

#81

Post by jqpabc123 »

nneonneo wrote: post #80
jqpabc123 wrote: post #61

Much, much simpler solution --- an actual time based rate limiter: 1) Include a hidden, unique token when the login screen is served to client. 2) On the client, enforce a minimum 3 sec delay from time of screen load before the login will be submitted with the hidden token included. 3) On the server, if the hidden token isn't returned or is unknown/not found or if the delay from the time of issue is less than 3 sec.,…

But this is totally useless - it doesn't consume any resources of the spammer! They can just launch a large number of requests (possibly from their army of bot machines to defeat IP limiting) and have them each wait 3s while doing other nefarious things in parallel. A PoW has at least the redeeming feature of consuming some resources for those 3s (or so...) making it self-limiting; there's only so many such computati…

...it doesn't consume any resources of the spammer!

It consumes the most valuable resource in the world --- time.

Re: mCaptcha – Proof of work based, privacy respecting CAPTCHA system

#82

Post by ranger_danger »

cush wrote: post #79

This is a pro-bot rate-limiter. In reality, most humans use low-spec feature phones with slow CPUs. This punishes those humans and promotes bots running on GPUs and highjacked cloud infra.

Why not just start out rate-limiting everyone equally with a timer or something?

Re: mCaptcha – Proof of work based, privacy respecting CAPTCHA system

#84

Post by nneonneo »

jqpabc123 wrote: post #81
nneonneo wrote: post #80

Earlier quoted context omitted.

But this is totally useless - it doesn't consume any resources of the spammer! They can just launch a large number of requests (possibly from their army of bot machines to defeat IP limiting) and have them each wait 3s while doing other nefarious things in parallel. A PoW has at least the redeeming feature of consuming some resources for those 3s (or so...) making it self-limiting; there's only so many such computati…

...it doesn't consume any resources of the spammer! It consumes the most valuable resource in the world --- time.

But it doesn’t though! A typical laptop can easily hold tens of thousands of I/O connections open at once in your favorite async I/O environment - that number can be in the millions with careful optimizations applied. Each connection just needs a sleep(3) applied between the initial form request and the submission.

A 3 second form delay just means the difference between a spammer launching 1000000 requests and posting them immediately to your database, vs them launching 1000000 requests and posting them to your database 3 seconds later.

Re: mCaptcha – Proof of work based, privacy respecting CAPTCHA system

#85

Post by jqpabc123 »

nneonneo wrote: post #84
jqpabc123 wrote: post #81

Earlier quoted context omitted.

...it doesn't consume any resources of the spammer! It consumes the most valuable resource in the world --- time.

But it doesn’t though! A typical laptop can easily hold tens of thousands of I/O connections open at once in your favorite async I/O environment - that number can be in the millions with careful optimizations applied. Each connection just needs a sleep(3) applied between the initial form request and the submission. A 3 second form delay just means the difference between a spammer launching 1000000 requests and postin…

Who are we kidding here --- most likely, your server can't handle 1000000 simultaneous requests.

My servers don't have enough bandwidth for that. Most of the connections are going to get dropped one way or the other. In my case, they will be intentionally dropped as being a likely denial of service attack.

Re: mCaptcha – Proof of work based, privacy respecting CAPTCHA system

#86

Post by mort96 »

nextaccountic wrote: post #75
mort96 wrote: post #58

Earlier quoted context omitted.

> mCaptcha is basically a rate-limiter. Hmm, is it a better rate limiter than others? I know that nginx, for example, makes it pretty easy to rate limit based on IP address with the `limit_req` and `limit_req_zone` directives. In essence, ngix's rate limiter also works by making each request consume a resource, but it makes the resource consumed an IP address (or range) rather than compute resources. It seems intuiti…

You can and should use multiple kinds of rate limiters

"Can" is true, and a good point. "Should" is a bit more dubious though; if IP-range-based rate limiting is enough, not wasting your users' battery with PoW-based rate limiting seems like a good thing. It seems like a potentially useful tool in your tool belt, which you should probably only deploy if IP-address-based rate limiting proves to be not enough.

Re: mCaptcha – Proof of work based, privacy respecting CAPTCHA system

#87

Post by web007 »

_448 wrote: post #50
realaravinth wrote: post #4

Earlier quoted context omitted.

The math is performed by the browser. All the user will have to do is tick a checkbox. Here's a demo: https://demo.mcaptcha.org/widget/?sitekey=pHy0AktWyOKuxZDzFf... disclosure: I'm the author of mCaptcha

Commercial spammers use high-end resources, where as users don't have that luxury. So will it not be easy for the spammers to scale the resources to overcome this?

It's not that they can't scale, it's that you want them to HAVE to scale, to make it more expensive to attack your site than another one.

Re: mCaptcha – Proof of work based, privacy respecting CAPTCHA system

#89

Post by paulnpace »

tuetuopay wrote: post #65

Oh god no please no. The web is already heavy enough to browse. Sincerely, A user of a 7 year old smartphone.

It took less time for me calculate the hash (~2 seconds) than to do a stupid puzzle game.

Sincerely,

A user of a 8 year old smartphone.

Re: mCaptcha – Proof of work based, privacy respecting CAPTCHA system

#90

Post by operator-name »

bArray wrote: post #53

From what I understand, this would allow somebody with reasonable resources to easily crack captchas with a high-end GPU. You could increase the complexity of the PoW, but ultimately you then just end up in a resource race. Ideally you want an attacker to spend as long as possible using up computation resources, whilst your normal clients spend on average little. I believe you would want a multi-stage approach that i…

The term for describing is memory hard functions. RandomX[0] is one such example where GPU parallelism does not net them a large advantage over CPUs.

[0]: https://github.com/tevador/RandomX

Post reply on HN