Other critiques aside, I wish there was more effort put into developing accessible CAPTCHAs that do not require JavaScript. Whatever its merits or flaws are, this CAPTCHA is yet another CAPTCHA that requires JS.
Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work
81–90 of 125 posts
Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work
#82I hate to say it because this kind of sentiment is now wildly unfashionable, but this is an actual example of where we should be using crypto. We need the ability to time-lock a very small amount of money that we get back later in order to access a resource.
What would that solve? A scraper could just have a wallet with 10$?
Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work
#83I hate to say it because this kind of sentiment is now wildly unfashionable, but this is an actual example of where we should be using crypto. We need the ability to time-lock a very small amount of money that we get back later in order to access a resource.
What would that solve? A scraper could just have a wallet with 10$?
The same solution a proof of work provides: make it expensive to execute millions of commands, and cheap to execute one.
Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work
#84It's just going to make low battery devices with consumer grade compute drain faster while bot farm with access to to ASICs will have a negligible increase in cost. This approach is going to have all the same problem to distribute work democratically as cryptocurrencies had. And as far as I know crypto didn't solve this.
Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work
#85Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work
#86SHA-256 PoW will probably work until it doesn't (if bots choose to invest in ASICs, or services that offer this pop up). Also users may be at a disadvantage as JS crypto would not be optimized for PoW (for example lack parallel crypto capabilities or context switching between calls).
One advantage a PoW "CAPTCHA" system holds is that the service operator can change the algorithm whenever they want. This may make an ASIC approach too risky to bother with. The JSASM crypto bridge would nevertheless require some optimization from the browser developers.
Some cryptocurrencies which aim for ASIC resistance create PoW algorithms that would require re-implementation of a significant fraction of the the CPU die to be a viable ASIC attack vector. An example of that would be randomx[1]. Using it for in-browser PoW would require native support as it will not be competitive against the bots with just a JS or WASM implementation. A modification would need to be made to not be abused for crypto mining. This will also link the cost of the PoW solution to the opportunity cost of mining the respective cryptocurrency which is well understood.
[1] https://github.com/tevador/RandomX>
Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work
#87Did no-one click through to the technical white paper? https://www.researchgate.net/publication/374638786_Proof-of-... "Proof-of-Work CAPTCHA with password cracking functionality" The "work" is "to use the distributed power of webusers’ computers" to "obtain suspects’ passwords in order to access encrypted evidence" and "support law enforcement activities". Funny how that isn't mentioned anywhere in the linked site.
I think there's a good chance they just linked to the paper for technical background, unrelated to the paper's mention of law enforcement usage. The website mentions self-hosted, no third-party requests, etc. Unless they're flat-out lying.
Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work
#88I was wondering if more sites will start to drift to a system where they require you to be logged in to an account attached to a SIM card in some ways. I feel like accounts that require phone verification are already similar in that they require a some cost to access. It obviously wouldn't stop a large corporation from buying up thousands of numbers if they needed it for a specific purpose, but it would be prohibitiv…
No need for the SIM, just being logged in to something will probably be enough to stop most crawlers.
Then, if someone is logged in, you can throw TOS their way, and make it a legal problem.
Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work
#89Earlier quoted context omitted.
> Normally, it is undesirable for users’ passwords to be cracked. However, in the case of law enforcement, we often need to obtain suspects’ passwords in order to access encrypted evidence. The obvious solution is to build powerful (and expensive) dictionary cryptanalysis computers. A less obvious approach is to use the distributed power of web users’ computers, as has been done in the Seti@Home ( https://setiathome.…
Can't we just submit bogus hashes?
[dead]
Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work
#90Earlier quoted context omitted.
Definitely concerning, although I'm having trouble finding anything in the codebase to support this. This paper even seems to contradict aspects of the project's no tracking stance. If someone told me this paper was for a different (but similar) project, I'd believe it after looking at the two side by side. Would definitely want this to be addressed before I'd consider using it.
There are two binaries commited to the repo (cap_wasm_bg.wasm) but from what I can tell, it doesn't seem to be making any network calls or what have you. They still should get rid of them and add a Rust build step for their browser/node packages.
Can you elaborate on why you would want this? You can run their build script[1] if you're trying to compare outputs and behavior.
[1]: https://github.com/tiagorangel1/cap/blob/main/wasm/build.js