mCaptcha – Proof of work based, privacy respecting CAPTCHA system

Post by operator-name » Thu, Aug 04, 2022, 9:51 PM UTC

realaravinth wrote: post #16

AbacusAvenger wrote: post #13

I looked into doing something like this once and decided it wasn't going to be very effective, for a few different reasons. JS engines (or even WASM) aren't going to be as fast at this kind of work as native machine code would be. Especially when you consider that libraries like OpenSSL have heavily tuned implementations of the SHA algorithms. Any bot solving a SHA-based challenge would be able to extract the challen…

Thank you for your detailed response, you raise some very interesting and valid points! > JS engines (or even WASM) aren't going to be as fast at this kind of work as native machine code would be You are right. mCaptcha has a WASM and a JS polyfill implementations. Native code will definitely be faster than WASM but in an experiment I ran for fun[0], I discovered that the WASM was roughly 2s slower than native implem…

Post by waynesonfire » Thu, Aug 04, 2022, 10:50 PM UTC

csense wrote: post #78

nneonneo wrote: post #73

This isn’t a CAPTCHA. A CAPTCHA should be something that can tell a human user apart from a non-human user with a high degree of accuracy, such that it should be hard for a bot to pass even a single instance. As noted elsewhere in the thread, this is a rate-limiting system. It cannot protect low-rate critical resources like registrations, but would be useful in mitigating large-scale spam attacks.

According to Wikipedia, CAPTCHA stands for Completely Automated Public Turing test to tell Computers and Humans Apart. This code shouldn't be called CAPTCHA as it makes no attempt to tell humans from machines. (If anything, SHA256 proof-of-work is a problem that's easy for a computer but hard for a human, the opposite of a Turing test.) I'd call it "Proof-Of-Work Client-side RAte Protection" -- it's a POWCRAP, not a…

Post by _3r4f » Fri, Aug 05, 2022, 7:45 AM UTC

jqpabc123 wrote: post #85

nneonneo wrote: post #84

Earlier quoted context omitted.

But it doesn’t though! A typical laptop can easily hold tens of thousands of I/O connections open at once in your favorite async I/O environment - that number can be in the millions with careful optimizations applied. Each connection just needs a sleep(3) applied between the initial form request and the submission. A 3 second form delay just means the difference between a spammer launching 1000000 requests and postin…

Who are we kidding here --- most likely, your server can't handle 1000000 simultaneous requests. My servers don't have enough bandwidth for that. Most of the connections are going to get dropped one way or the other. In my case, they will be intentionally dropped as being a likely denial of service attack.

Post by jqpabc123 » Fri, Aug 05, 2022, 9:49 AM UTC

_3r4f wrote: post #95

jqpabc123 wrote: post #85

Earlier quoted context omitted.

Who are we kidding here --- most likely, your server can't handle 1000000 simultaneous requests. My servers don't have enough bandwidth for that. Most of the connections are going to get dropped one way or the other. In my case, they will be intentionally dropped as being a likely denial of service attack.

You don't need to keep a connection open assuming this is HTTP. Just send another request. You're sending two requests either way, it doesn't matter that you're waiting 3s because you can just do it in parallel.

Post by b3n » Mon, Aug 08, 2022, 11:05 AM UTC

jarrell_mark wrote: post #69

AGPL seems problematic here. If a company uses this as their captcha system does it force them to open source their entire code base?