Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

mCaptcha – Proof of work based, privacy respecting CAPTCHA system

github.com

Post reply on HN
Print view View original

41–50 of 100 posts

Re: mCaptcha – Proof of work based, privacy respecting CAPTCHA system

#41

Post by realaravinth »

AbacusAvenger wrote: post #31
realaravinth wrote: post #27

Earlier quoted context omitted.

That's a good idea, I'll be sure to do that!

Also remember that native code can use multithreading, so if your challenge is something that could be farmed out to multiple CPU threads until one finds the solution, that's another factor in favor of native code performance.

I haven't encountered a case where multithreading will make the algorithm weaker, but I do have a variation of the benchmark code(on disk, at the moment) that will spin up multiple worker threads to compute PoW.

Re: mCaptcha – Proof of work based, privacy respecting CAPTCHA system

#42

Post by supernes »

realaravinth wrote: post #23
supernes wrote: post #18

Earlier quoted context omitted.

Thinking about it a bit more, systems like mCaptcha and Botpoison aren't really CAPTCHA in the strict sense - they solve a somewhat different problem than telling if there's a human at the other end, and IMO that's an important distinction to make (and doesn't necessarily make them inferior to other solutions.) I still think PoW alone is not enough as it can be automated, albeit at a slower rate. Most of the time I w…

> Thinking about it a bit more, systems like mCaptcha and Botpoison aren't really CAPTCHA in the strict sense Very true! I chose to use “captcha” because it's easier to convey what it does than, say, calling it a PoW-powered rate-limter. > The real value is in the combination of factors, especially what BP call the "session and request analysis" and other fingerprinting solutions. Also true. I'm not sure if it is pos…

Client-local fingerprinting is not inherently evil, just when you combine it with additional signals and decide to use it in violation of users' privacy. AFAIK it's the most reliable way to distinguish unique visitor agents, and under that use case it's far more respectful of personal information than an IP address.

Re: mCaptcha – Proof of work based, privacy respecting CAPTCHA system

#43

Post by mabbo »

I think calling this a Captcha isn't a greay way to explain what this is about.

Bots spamming your sign up page are playing an economics game. Can I quickly and cheaply enough do whatever this bot action is so that the end result is worth the cost? Captchas were good because you need humans to verify them, which raised the cost to around $0.05 per action. But now ML breaks most captchas cheaply and easily.

Proof of work based 'captchas' are another solution. They slow down the bots, and cost compute time, reducing the economic efficiency of the attacker. They make it not worth the effort. And if the attacks continue, you can autoscale the difficulty.

And for humans, it's a minor slowdown without requiring any mental effort from them.

It's a nice solution.

Re: mCaptcha – Proof of work based, privacy respecting CAPTCHA system

#44

Post by Retr0id »

paranoidrobot wrote: post #40
AbacusAvenger wrote: post #31

Earlier quoted context omitted.

Also remember that native code can use multithreading, so if your challenge is something that could be farmed out to multiple CPU threads until one finds the solution, that's another factor in favor of native code performance.

Lets just assume that you solve the "it takes a while to run" thing through some clever bits of hard-to-optimise math, that's difficult to parallelise or multithread or whatever. If all it takes is computer time, then that's a cheap thing for the botnet operator to solve. They can just spin up another instance, and split up the crawling task to another computer (or 200).

A captcha can always be parallelised. All the attacker has to do is attempt n different captchas in parallel.

Re: mCaptcha – Proof of work based, privacy respecting CAPTCHA system

#45

Post by Retr0id »

realaravinth wrote: post #27
AbacusAvenger wrote: post #24

Earlier quoted context omitted.

About the benchmark data: It looks like your pow_sha256 library is using is the "sha2" crate, which is a pure Rust implementation of SHA2. So your benchmark is around the delta of your library compiled to native code vs. your library compiled to WASM, which is an interesting benchmark but I don't think it answers the right question. A more interesting benchmark would probably answer the question "what would those loo…

That's a good idea, I'll be sure to do that!

You should compare against a GPU implementation of SHA256 (hashcat has a good one).

You may also want to consider ASICs - although you won't be able to build your own ASIC, you can look at the hashrates offered by bitcoin mining hardware, and extrapolate.

Re: mCaptcha – Proof of work based, privacy respecting CAPTCHA system

#46

Post by dspillett »

realaravinth wrote: post #11
supernes wrote: post #5

The goal of CAPTCHA is to tell computers and humans apart. I appreciate the effort towards better UX, but there are already "invisible" CAPTCHAs like Botpoison that discriminate better than this. PoW solutions are just more energy-intensive rate limits.

> I appreciate the effort towards better UX, but there are already "invisible" CAPTCHAs like Botpoison that discriminate better than this. Interesting project, thank you for sharing! From Botpoison's website[0] under FAQ: > Botpoison combines: > - Hashcash , a cryptographic hash-based proof-of-work algorithm. > - IP reputation checks, cross-referencing proprietary and 3rd party data sets. > - IP rate-limits. > - Sess…

> and those behind CG-NAT

I'm in two minds about how I feel inconveniencing those behind CG-NAT. I don't want to punish the innocent, but the ISPs aren't going to move towards better solutions (IPv6) without a push from their paying customers, and they'll never get that push with sufficient strength if we work tirelessly to make the problem affect us and not affect those subscribers.

Re: mCaptcha – Proof of work based, privacy respecting CAPTCHA system

#47

Post by jsnell »

AbacusAvenger wrote: post #13

I looked into doing something like this once and decided it wasn't going to be very effective, for a few different reasons. JS engines (or even WASM) aren't going to be as fast at this kind of work as native machine code would be. Especially when you consider that libraries like OpenSSL have heavily tuned implementations of the SHA algorithms. Any bot solving a SHA-based challenge would be able to extract the challen…

Yes, the range of applications where proof of work is viable is really narrow. (In fact, so narrow that I suspect it can't work for anything where the abuse has a monetary motive.)

One way to think about this is by comparing the cost of passing the POW to the money the same compute resources would make when mining a cryptocurrency. I believe that a low-end phone used for mining a CPU-based cryptocurrency would be making O(1 cent) per day. Let's say that you're willing to cause 1 minute of friction for legit users on low-end devices (already something that I'd expect will be unacceptable from a product perspective). Congratulations: you just cost the attacker 1/1500th of a cent. That's orders of magnitudes too low to have any impact on the economics of spam, credential stuffing, scraping, or other typical bulk abuse.

Re: mCaptcha – Proof of work based, privacy respecting CAPTCHA system

#48

Post by vintermann »

AbacusAvenger wrote: post #13

I looked into doing something like this once and decided it wasn't going to be very effective, for a few different reasons. JS engines (or even WASM) aren't going to be as fast at this kind of work as native machine code would be. Especially when you consider that libraries like OpenSSL have heavily tuned implementations of the SHA algorithms. Any bot solving a SHA-based challenge would be able to extract the challen…

Yes, the spam doesn't actually have to be profitable for the seller of the spammed product. Not as long as he thinks it is, and is willing to pay the person spamming on his behalf.

And as you say, it's often stolen resources. There may even be another link in the "think it pays" chain: the spammer may buy hacked instances out of a mistaken belief that he can make money on it, by selling spamming services to merchants who also only think it pays. There's a certain "crime premium" where some people seem willing to pay extra (in money or effort) for the feeling that they're fooling someone.

Re: mCaptcha – Proof of work based, privacy respecting CAPTCHA system

#49

Post by technion »

realaravinth wrote: post #3

Hello, I'm the author of mCaptcha. I'll be happy to answer any questions that you might have :)

I just want to say - people critique every service out there that slows spam and bots. Those critiques are valid from the "it won't stop everything" view, but it clearly stops a proportion, and the wider variety of products out there the less likely a spammer will have a canned answer for a particular site.

Re: mCaptcha – Proof of work based, privacy respecting CAPTCHA system

#50

Post by _448 »

realaravinth wrote: post #4
_448 wrote: post #2

> they will have to generate proof-of-work(a bunch of math that will takes time to compute) This was tried before and failed! The reason it failed was Maths! Most favour clicking simple images or rearranging visual elements instead of solving Maths problems.

The math is performed by the browser. All the user will have to do is tick a checkbox. Here's a demo: https://demo.mcaptcha.org/widget/?sitekey=pHy0AktWyOKuxZDzFf... disclosure: I'm the author of mCaptcha

Commercial spammers use high-end resources, where as users don't have that luxury. So will it not be easy for the spammers to scale the resources to overcome this?
Post reply on HN