111–120 of 125 posts
Earlier quoted context omitted.
> how much more CO2 this is going to produce extremely minimal emissions, you're only solving a small cryptographic challenge after all.
Not at scale, however. Like another comment said, this is going to turn out like cryptocurrencies. (I really couldn't care less about the climate debate, but waste is waste.)
Earlier quoted context omitted.
For which part? Every time a new submission is created on HN, you have a curl script that posts a comment on it shilling your product. (According to the /newest tab there seems to be one submission every few minutes.) What's harder for you to automate: the comment always posts successfully after 500ms, or you get a Cloudflare Turnstile captcha every time?
PoW is for a completely different threat model than CAPTCHA. If you're trying to decide which is better, you're doing it wrong.
> CAPTCHA alternative
Did no-one click through to the technical white paper? https://www.researchgate.net/publication/374638786_Proof-of-... "Proof-of-Work CAPTCHA with password cracking functionality" The "work" is "to use the distributed power of webusers’ computers" to "obtain suspects’ passwords in order to access encrypted evidence" and "support law enforcement activities". Funny how that isn't mentioned anywhere in the linked site.
> Normally, it is undesirable for users’ passwords to be cracked. However, in the case of law enforcement, we often need to obtain suspects’ passwords in order to access encrypted evidence. The obvious solution is to build powerful (and expensive) dictionary cryptanalysis computers. A less obvious approach is to use the distributed power of web users’ computers, as has been done in the Seti@Home ( https://setiathome.…
can someone ELI5 how these proof-of-work captchas work under the hood to detect whether i'm a bot or not?
They don't detect if you're a bot or not; it just makes it more expensive, the idea being that doing $action 10,000 (or more) times becomes much more costly for the attacker, preferably to the point where doing $action (posting spam, creating accounts, etc.) is no longer profitable. It's probably more useful to see it as a ratelimiter than a bot detection mechanism.
Actually, this just uses SHA-256 hashing, which already has specialized CPU instructions (that browser WASM can't use) and ASICs.
I can't see how this isn't DOA?
Did no-one click through to the technical white paper? https://www.researchgate.net/publication/374638786_Proof-of-... "Proof-of-Work CAPTCHA with password cracking functionality" The "work" is "to use the distributed power of webusers’ computers" to "obtain suspects’ passwords in order to access encrypted evidence" and "support law enforcement activities". Funny how that isn't mentioned anywhere in the linked site.
> Normally, it is undesirable for users’ passwords to be cracked. However, in the case of law enforcement, we often need to obtain suspects’ passwords in order to access encrypted evidence. The obvious solution is to build powerful (and expensive) dictionary cryptanalysis computers. A less obvious approach is to use the distributed power of web users’ computers, as has been done in the Seti@Home ( https://setiathome.…
Earlier quoted context omitted.
Cap does not send any of the calculated hashes ANYWHERE, the white paper just details a bit how proof-of-work works and I thought that it would be interesting to share.
added a note saying that to the docs, should hopefully clarify stuff a bit!
FWIW, I do believe you just made a few unintentional awkward choices instead of being malicious... But a product associated with something like this is a hard sell.
How does this compare to Anubis, another similar PoW based CAPTCHA? Paired with this, and if there is a way to block out DDOS https traffic then we might be able to stop dependence on Cloudflare altogether.
I'd be so happy if the Internet moved away from Cloudflare for Captcha. I got on their "bad list" at one point (for who knows why), and no matter how many times I checked the "I am a human" box their Captcha wouldn't let me through for a few days. I was unable to login to the portal of a product that we pay for. It was such a frustrating experience.
I was wondering if more sites will start to drift to a system where they require you to be logged in to an account attached to a SIM card in some ways. I feel like accounts that require phone verification are already similar in that they require a some cost to access. It obviously wouldn't stop a large corporation from buying up thousands of numbers if they needed it for a specific purpose, but it would be prohibitiv…
Such site is better provide some unique service no one else can. There is no way I am sharing my phone number with random sites unless I absolutely have to, I get enough spam & scam already, and tracking potential is enormous.
Earlier quoted context omitted.
There are two binaries commited to the repo (cap_wasm_bg.wasm) but from what I can tell, it doesn't seem to be making any network calls or what have you. They still should get rid of them and add a Rust build step for their browser/node packages.
you can compare the hashes of the wasm lmao the build script is very much public
Very surprised to get pushback on what I thought was an industry standard lmao
Earlier quoted context omitted.
> Normally, it is undesirable for users’ passwords to be cracked. However, in the case of law enforcement, we often need to obtain suspects’ passwords in order to access encrypted evidence. The obvious solution is to build powerful (and expensive) dictionary cryptanalysis computers. A less obvious approach is to use the distributed power of web users’ computers, as has been done in the Seti@Home ( https://setiathome.…
2030: to enter the site you must allow us to mine few ethereal on your pc...
We’ll, who am I kidding