Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work • Hacker News Board

Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work

#71

Post by ronsor » Fri, May 30, 2025, 7:53 PM UTC

mcpar-land wrote: post #68

nicwolff wrote: post #60

Did no-one click through to the technical white paper? https://www.researchgate.net/publication/374638786_Proof-of-... "Proof-of-Work CAPTCHA with password cracking functionality" The "work" is "to use the distributed power of webusers’ computers" to "obtain suspects’ passwords in order to access encrypted evidence" and "support law enforcement activities". Funny how that isn't mentioned anywhere in the linked site.

> Normally, it is undesirable for users’ passwords to be cracked. However, in the case of law enforcement, we often need to obtain suspects’ passwords in order to access encrypted evidence. The obvious solution is to build powerful (and expensive) dictionary cryptanalysis computers. A less obvious approach is to use the distributed power of web users’ computers, as has been done in the Seti@Home ( https://setiathome.…

Can't we just submit bogus hashes?

Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work

#72

Post by hathawsh » Fri, May 30, 2025, 7:54 PM UTC

nicwolff wrote: post #60

Did no-one click through to the technical white paper? https://www.researchgate.net/publication/374638786_Proof-of-... "Proof-of-Work CAPTCHA with password cracking functionality" The "work" is "to use the distributed power of webusers’ computers" to "obtain suspects’ passwords in order to access encrypted evidence" and "support law enforcement activities". Funny how that isn't mentioned anywhere in the linked site.

Interesting discovery. This research sounds creepy and ill-advised, but my intuition suggests to me this is an innocent attempt to do something useful rather than waste energy on a PoW algorithm. My intuition also tells me that if this project became popular enough, attackers would break the algorithm fairly easily and the project would just revert to a more conventional PoW algorithm that doesn't try to be smart.

Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work

#73

Post by warkdarrior » Fri, May 30, 2025, 7:57 PM UTC

internetter wrote: post #22

wewxjfq wrote: post #19

I don't mind captchas to protect forms and such, but given that so many sites want captchas solved for the first GET request, I really wonder how much more CO2 this is going to produce. And when I see "invisible mode", I'd really like to ask the authors if they think their work is a net-positive for the world.

"invisible mode" in CAPTCHAs are great for login forms. In the background the captcha runs. If it passes, the user doesn't need to be bothered with it. If it doesn't, the user is presented the standard captcha. I agree I hate the CF captcha popups, but I think this is a result of AI scraping. GET requests can be expensive on dynamic sites with infinite paths — like a git host.

"Invisible mode" is also great for cryptomining in the browser.

Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work

#74

Post by jeroenhd » Fri, May 30, 2025, 8:08 PM UTC

marinmania wrote: post #32

I was wondering if more sites will start to drift to a system where they require you to be logged in to an account attached to a SIM card in some ways. I feel like accounts that require phone verification are already similar in that they require a some cost to access. It obviously wouldn't stop a large corporation from buying up thousands of numbers if they needed it for a specific purpose, but it would be prohibitiv…

> a SIM card

That's basically what remote attestation is. But it's using TPMs (or similar) rather than SIM cards. The TPM has a key signed by the manufacturer, and that key can be used to sign tokens to prove that you possess a physical TPM and have it in a mode that provides access to that key.

The problem with either is that the system doesn't work if you can get access to the keys behind the system. That means banning everyone who uses a vulnerable model of SIM card/TPM implementation. SIMs are cheaper to replace, but you'd have to replace millions of them every time someone manages to voltage glitch a SIM card.

If you own an iPhone or Macbook, you have access to a browser you already does this: https://developer.apple.com/news/?id=huqjyh7k

Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work

#75

Post by downrightmike » Fri, May 30, 2025, 8:08 PM UTC

mcpar-land wrote: post #68

nicwolff wrote: post #60

Did no-one click through to the technical white paper? https://www.researchgate.net/publication/374638786_Proof-of-... "Proof-of-Work CAPTCHA with password cracking functionality" The "work" is "to use the distributed power of webusers’ computers" to "obtain suspects’ passwords in order to access encrypted evidence" and "support law enforcement activities". Funny how that isn't mentioned anywhere in the linked site.

> Normally, it is undesirable for users’ passwords to be cracked. However, in the case of law enforcement, we often need to obtain suspects’ passwords in order to access encrypted evidence. The obvious solution is to build powerful (and expensive) dictionary cryptanalysis computers. A less obvious approach is to use the distributed power of web users’ computers, as has been done in the Seti@Home ( https://setiathome.…

That is shady as hell. Welp this is dead on the vine

Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work

#76

Post by SV_BubbleTime » Fri, May 30, 2025, 8:09 PM UTC

timtom123 wrote: post #15

stephantul wrote: post #12

Earlier quoted context omitted.

Think of crawlers: a crawler typically makes hundreds or thousands of requests per second. The owners of the crawler then sell this data for X$, or gain X$ profit. Proof of work adds a very small cost to each individual request, increasing the cost of crawling to a number higher than X. Because actual humans make very few requests, we don’t notice the increase in cost.

This exactly, having ran very large scraping operations, it only takes a slight increase in cost to make it unprofitable for many use cases.

Right, scale is solved… but not at all targeted “attacks”.

If some site uses this and I only want that site as an attacker or as a personal scraper or etc, this is keenly ineffective at proving human vs bot.

Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work

#77

Post by SparkyMcUnicorn » Fri, May 30, 2025, 8:22 PM UTC

nicwolff wrote: post #60

Did no-one click through to the technical white paper? https://www.researchgate.net/publication/374638786_Proof-of-... "Proof-of-Work CAPTCHA with password cracking functionality" The "work" is "to use the distributed power of webusers’ computers" to "obtain suspects’ passwords in order to access encrypted evidence" and "support law enforcement activities". Funny how that isn't mentioned anywhere in the linked site.

Definitely concerning, although I'm having trouble finding anything in the codebase to support this.

This paper even seems to contradict aspects of the project's no tracking stance. If someone told me this paper was for a different (but similar) project, I'd believe it after looking at the two side by side.

Would definitely want this to be addressed before I'd consider using it.

Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work

#78

Post by prophesi » Fri, May 30, 2025, 9:12 PM UTC

SparkyMcUnicorn wrote: post #77

nicwolff wrote: post #60

Did no-one click through to the technical white paper? https://www.researchgate.net/publication/374638786_Proof-of-... "Proof-of-Work CAPTCHA with password cracking functionality" The "work" is "to use the distributed power of webusers’ computers" to "obtain suspects’ passwords in order to access encrypted evidence" and "support law enforcement activities". Funny how that isn't mentioned anywhere in the linked site.

Definitely concerning, although I'm having trouble finding anything in the codebase to support this. This paper even seems to contradict aspects of the project's no tracking stance. If someone told me this paper was for a different (but similar) project, I'd believe it after looking at the two side by side. Would definitely want this to be addressed before I'd consider using it.

There are two binaries commited to the repo (cap_wasm_bg.wasm) but from what I can tell, it doesn't seem to be making any network calls or what have you. They still should get rid of them and add a Rust build step for their browser/node packages.

Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work

#79

Post by landl0rd » Fri, May 30, 2025, 9:22 PM UTC

internetter wrote: post #23

> @cap.js/solver is a standalone library that can be used to solve Cap challenges from the server. Doesn't this defeat the purpose of Cap? Not really. Server-side solving is a core use case of proof-of-work CAPTCHAs like Cap or altcha. It's about proving effort, not necessarily involving a human. I like this. Allows for reasonable bots like IA without the mindless wasteful AI scrappers.

Isn't IA's architecture pretty strained already without this?

Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work

#80

Post by landl0rd » Fri, May 30, 2025, 9:23 PM UTC

marinmania wrote: post #32

I was wondering if more sites will start to drift to a system where they require you to be logged in to an account attached to a SIM card in some ways. I feel like accounts that require phone verification are already similar in that they require a some cost to access. It obviously wouldn't stop a large corporation from buying up thousands of numbers if they needed it for a specific purpose, but it would be prohibitiv…

Phone number is also good because you can be reasonably sure as to whether it's voip or not. It is literally the one non-awful solution to the sybil problem we have discovered (the awful ones being things like gov id).