81–90 of 159 posts
This has been suggested before, for email spam. Cloudflare could do this, too. Every time you access a busy site, seconds to minutes of useless crunching. The overall effect would be to drain batteries worldwide.
Cloud flare does do this. You get a screen saying checking your connection and it’s running hashes in your browser.
What's preventing abusers from getting new identities when the PoW kicks in and continuing the DDoS? Edit: looks like PoW is set per "service" that's under attack rather than client?
The article says that there is only a factor of 6 in solution time between a high end server and low end phone. How is that possible? The server likely has much more than 6x the ram and cpu count (and faster cpus) than the phone. Also, since it is DDOSing, the server’s work is embarrassingly parallel, but the client work isn’t necessarily parallelized at all. Even if it is only a factor of 6 (or one) they are talking…
I suspect they're off by at least an order of magnitude in that estimate, if not two (or more if GPU acceleration is possible).
Earlier quoted context omitted.
DDoS has nothing to do with sybil attacks. DoS happens because limited resource (connection initiation) is provided for free. They chose memory-hungry algorithm because that would prevent use of specific hardware (ASICs).
Attackers can still outsource the PoWs. The sybil is the assumption that 1 PoW == one PC. But you can force this assumption with provisioning keys at least.
This has been suggested before, for email spam. Cloudflare could do this, too. Every time you access a busy site, seconds to minutes of useless crunching. The overall effect would be to drain batteries worldwide.
Earlier quoted context omitted.
Cloud flare does do this. You get a screen saying checking your connection and it’s running hashes in your browser.
is it really running hashes, or is it probing your browser to see if your video card drivers look like phantomjs
>With a JS challenge, Cloudflare presents challenge page that requires no interaction from a visitor, but rather JavaScript processing by their browser.
>The visitor will have to wait until their browser finishes processing the JavaScript, which should be less than five seconds.
https://developers.cloudflare.com/fundamentals/get-started/c...
Earlier quoted context omitted.
So now you have the drawbacks of both as well, in that the guy who has the most compute to use as a toaster can DoS everyone else. Plus, PoW is nothing but wasted, needless computation . Computing is not free . Every watt spent doing anything PoW is just that much more intensification of our current climate crisis. As someone with temps of 109 with heat index of 120 coming in the next few days, with all due respect,…
I think the presence of this PoW system might mean that this form of abuse is discouraged enough that in practice it means that PoW will not be required. Who is going to compete with a huge amount of compute to DoS others? They'd need the same compute as all legitimate access put together to get to just 50% effectiveness. If this is the case and in practice PoW is never required, then your rant is moot, and instead i…
Earlier quoted context omitted.
Attackers can still outsource the PoWs. The sybil is the assumption that 1 PoW == one PC. But you can force this assumption with provisioning keys at least.
And why do we need this assumption exactly?
Overall, they will have more leverage from these resources than the number of systems they have access to. But you could at least restrict this to the number of systems with provisioning keys. The idea behind memory bound hash functions is that you're trying to make it hard to paralyze the challenge to a farm. But many systems in the farm are still going to have multiple cores and gigabytes of RAM (so they can be used to leverage multiple challenges simultaneously.) The underlying problem to solve here is an identity problem: allowing an individual machine to act as a single identity which various proof-of-work schemes have tried to achieve.
The ideal solution would also limit connections made by the same actors but that is probably not something you can achieve with something like TOR. This is a sybil problem, by the way.
Earlier quoted context omitted.
Probably by having enough computers that they can overload the server even if the number of requests coming from each individual computer is relatively low, as a multiple of what a normal user would send – low enough that those computers have enough CPU time to solve the challenges.
From https://github.com/tevador/equix/blob/master/devlog.md > The service would give the request a priority value based on the "difficulty" of the puzzle solution. Seems like single clients could increase the difficulty to higher than what the bot net would do (so it gets priority), and hence get access. Operators of the bot net would probably hard code one value as the difficulty, and it would be lower than what you…
Earlier quoted context omitted.
Probably by having enough computers that they can overload the server even if the number of requests coming from each individual computer is relatively low, as a multiple of what a normal user would send – low enough that those computers have enough CPU time to solve the challenges.
From https://github.com/tevador/equix/blob/master/devlog.md > The service would give the request a priority value based on the "difficulty" of the puzzle solution. Seems like single clients could increase the difficulty to higher than what the bot net would do (so it gets priority), and hence get access. Operators of the bot net would probably hard code one value as the difficulty, and it would be lower than what you…