Live data from Hacker News

Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work

capjs.js.org

11–20 of 125 posts

Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work

#11

can someone ELI5 how these proof-of-work captchas work under the hood to detect whether i'm a bot or not?

They don't detect if you're a bot or not; it just makes it more expensive, the idea being that doing $action 10,000 (or more) times becomes much more costly for the attacker, preferably to the point where doing $action (posting spam, creating accounts, etc.) is no longer profitable. It's probably more useful to see it as a ratelimiter than a bot detection mechanism.

Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work

#12
post #4

What does proof-of-work mean here and what makes it easy for humans and hard for bots?

Think of crawlers: a crawler typically makes hundreds or thousands of requests per second. The owners of the crawler then sell this data for X$, or gain X$ profit.

Proof of work adds a very small cost to each individual request, increasing the cost of crawling to a number higher than X. Because actual humans make very few requests, we don’t notice the increase in cost.

Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work

#13

So each spam message will take an extra second and 2 additional cents for electricity? I'm not sure what's the use case here.

Better suited for discouraging scraping. 2 cents * 300 scrapes = $6 although 2 cents is huge over estimation and you would probably not show this every time. Only when there is unusual traffic.

Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work

#15
post #4

What does proof-of-work mean here and what makes it easy for humans and hard for bots?

Think of crawlers: a crawler typically makes hundreds or thousands of requests per second. The owners of the crawler then sell this data for X$, or gain X$ profit. Proof of work adds a very small cost to each individual request, increasing the cost of crawling to a number higher than X. Because actual humans make very few requests, we don’t notice the increase in cost.

This exactly, having ran very large scraping operations, it only takes a slight increase in cost to make it unprofitable for many use cases.

Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work

#16
post #2

How did we end up with bitcoin before this?

PoW rate limiting actually pre-dates PoW cryptocurrency, the former has just had a resurgence recently in response to AI scrapers pissing in everyone's pools.

https://en.wikipedia.org/wiki/Hashcash

The original Bitcoin paper even cited Hashcash as inspiration.

Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work

#18
post #4

What does proof-of-work mean here and what makes it easy for humans and hard for bots?

It's equally easy for both. But people using broswers only do it a few times, while bots need to do it many times. A second for a human every X pages is not much, but it's a death-knell for the general practice of bots (and they can't store the cookies because you can rate-limit them that way).

Imagine scrapping thousands of page, but with a X>1 second wait for each. There wouldn't be a need to use such solution if crawlers were rate-limiting themselves, but they don't.

Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work

#19
I don't mind captchas to protect forms and such, but given that so many sites want captchas solved for the first GET request, I really wonder how much more CO2 this is going to produce. And when I see "invisible mode", I'd really like to ask the authors if they think their work is a net-positive for the world.

Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work

#20

Why not make this contribute to something greater, like scientific grid computing, or a charitable bitcoin donation? Instead we're just burning a few watts to slow down crawlers.

I like the citizen science idea, the bitcoin one is so shitty. There was an epedemic of websites covertly mining in browsers a while back and this is a dangerous road to go down.
Post reply on HN