101–110 of 125 posts
What about integrating Altcha (altcha.org) is hard? Seems pretty straightforward.
One of the main reasons we've switched from hCaptcha is privacy. The server-side stuff can be self-hosted and there is a Golang integration. Really nice.
Here is the link for anyone who would like to take a look: https://altcha.org/
Other critiques aside, I wish there was more effort put into developing accessible CAPTCHAs that do not require JavaScript. Whatever its merits or flaws are, this CAPTCHA is yet another CAPTCHA that requires JS.
I don't mind captchas to protect forms and such, but given that so many sites want captchas solved for the first GET request, I really wonder how much more CO2 this is going to produce. And when I see "invisible mode", I'd really like to ask the authors if they think their work is a net-positive for the world.
Earlier quoted context omitted.
Can't we just submit bogus hashes?
Generally that is countered by asking for a mix of known and unknown solutions; your accuracy on the unknown is assessed through your accuracy on the known.
If you were doing a lot of scraping, you could just solve this on a GPU in 1/10 or less of the time it takes a human's phone to do it. Generally you need a decent computer to render a webpage while scraping it these days, so I don't see what this is solving.
scrapers usually don't render a webpage, else their scraping wouldn't be efficient at all.
Earlier quoted context omitted.
Definitely concerning, although I'm having trouble finding anything in the codebase to support this. This paper even seems to contradict aspects of the project's no tracking stance. If someone told me this paper was for a different (but similar) project, I'd believe it after looking at the two side by side. Would definitely want this to be addressed before I'd consider using it.
There are two binaries commited to the repo (cap_wasm_bg.wasm) but from what I can tell, it doesn't seem to be making any network calls or what have you. They still should get rid of them and add a Rust build step for their browser/node packages.
Did no-one click through to the technical white paper? https://www.researchgate.net/publication/374638786_Proof-of-... "Proof-of-Work CAPTCHA with password cracking functionality" The "work" is "to use the distributed power of webusers’ computers" to "obtain suspects’ passwords in order to access encrypted evidence" and "support law enforcement activities". Funny how that isn't mentioned anywhere in the linked site.
Did no-one click through to the technical white paper? https://www.researchgate.net/publication/374638786_Proof-of-... "Proof-of-Work CAPTCHA with password cracking functionality" The "work" is "to use the distributed power of webusers’ computers" to "obtain suspects’ passwords in order to access encrypted evidence" and "support law enforcement activities". Funny how that isn't mentioned anywhere in the linked site.
I think there's a good chance they just linked to the paper for technical background, unrelated to the paper's mention of law enforcement usage. The website mentions self-hosted, no third-party requests, etc. Unless they're flat-out lying.
Did no-one click through to the technical white paper? https://www.researchgate.net/publication/374638786_Proof-of-... "Proof-of-Work CAPTCHA with password cracking functionality" The "work" is "to use the distributed power of webusers’ computers" to "obtain suspects’ passwords in order to access encrypted evidence" and "support law enforcement activities". Funny how that isn't mentioned anywhere in the linked site.
Cap does not send any of the calculated hashes ANYWHERE, the white paper just details a bit how proof-of-work works and I thought that it would be interesting to share.
SHA-256 PoW will probably work until it doesn't (if bots choose to invest in ASICs, or services that offer this pop up). Also users may be at a disadvantage as JS crypto would not be optimized for PoW (for example lack parallel crypto capabilities or context switching between calls). One advantage a PoW "CAPTCHA" system holds is that the service operator can change the algorithm whenever they want. This may make an A…
JS crypto is only used as a fallback, Rust WASM is used for solving.