Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work

capjs.js.org

Post reply on HN
Print view View original

91–100 of 125 posts

Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work

#91

Post by areyourllySorry »

landl0rd wrote: post #79
internetter wrote: post #23

> @cap.js/solver is a standalone library that can be used to solve Cap challenges from the server. Doesn't this defeat the purpose of Cap? Not really. Server-side solving is a core use case of proof-of-work CAPTCHAs like Cap or altcha. It's about proving effort, not necessarily involving a human. I like this. Allows for reasonable bots like IA without the mindless wasteful AI scrappers.

Isn't IA's architecture pretty strained already without this?

for manual saves, it might be able to offload the challenge to the saver's computer (but that means adding explicit support for this particular library, which might or might not happen...)

Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work

#92

Post by powgpu »

hathawsh wrote: post #72
nicwolff wrote: post #60

Did no-one click through to the technical white paper? https://www.researchgate.net/publication/374638786_Proof-of-... "Proof-of-Work CAPTCHA with password cracking functionality" The "work" is "to use the distributed power of webusers’ computers" to "obtain suspects’ passwords in order to access encrypted evidence" and "support law enforcement activities". Funny how that isn't mentioned anywhere in the linked site.

Interesting discovery. This research sounds creepy and ill-advised, but my intuition suggests to me this is an innocent attempt to do something useful rather than waste energy on a PoW algorithm. My intuition also tells me that if this project became popular enough, attackers would break the algorithm fairly easily and the project would just revert to a more conventional PoW algorithm that doesn't try to be smart.

Wasn't there a crypto that use GPU to solve LLM computation as PoW. Wouldn't that be better approach?

Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work

#95

Post by ethersteeds »

ronsor wrote: post #71
mcpar-land wrote: post #68

Earlier quoted context omitted.

> Normally, it is undesirable for users’ passwords to be cracked. However, in the case of law enforcement, we often need to obtain suspects’ passwords in order to access encrypted evidence. The obvious solution is to build powerful (and expensive) dictionary cryptanalysis computers. A less obvious approach is to use the distributed power of web users’ computers, as has been done in the Seti@Home ( https://setiathome.…

Can't we just submit bogus hashes?

Generally that is countered by asking for a mix of known and unknown solutions; your accuracy on the unknown is assessed through your accuracy on the known.

Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work

#96

Post by GoblinSlayer »

ethersteeds wrote: post #95
ronsor wrote: post #71

Earlier quoted context omitted.

Can't we just submit bogus hashes?

Generally that is countered by asking for a mix of known and unknown solutions; your accuracy on the unknown is assessed through your accuracy on the known.

But there are only a few suspect passwords, you can just know all of them, and thus reliably differentiate.

Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work

#97

Post by GoblinSlayer »

mcpar-land wrote: post #68
nicwolff wrote: post #60

Did no-one click through to the technical white paper? https://www.researchgate.net/publication/374638786_Proof-of-... "Proof-of-Work CAPTCHA with password cracking functionality" The "work" is "to use the distributed power of webusers’ computers" to "obtain suspects’ passwords in order to access encrypted evidence" and "support law enforcement activities". Funny how that isn't mentioned anywhere in the linked site.

> Normally, it is undesirable for users’ passwords to be cracked. However, in the case of law enforcement, we often need to obtain suspects’ passwords in order to access encrypted evidence. The obvious solution is to build powerful (and expensive) dictionary cryptanalysis computers. A less obvious approach is to use the distributed power of web users’ computers, as has been done in the Seti@Home ( https://setiathome.…

Bitcoin network used to bruteforce 85 bits per year, which is slightly bigger than capacity of [a-z0-9]{16}

Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work

#98

Post by subscribed »

landl0rd wrote: post #80
marinmania wrote: post #32

I was wondering if more sites will start to drift to a system where they require you to be logged in to an account attached to a SIM card in some ways. I feel like accounts that require phone verification are already similar in that they require a some cost to access. It obviously wouldn't stop a large corporation from buying up thousands of numbers if they needed it for a specific purpose, but it would be prohibitiv…

Phone number is also good because you can be reasonably sure as to whether it's voip or not. It is literally the one non-awful solution to the sybil problem we have discovered (the awful ones being things like gov id).

Thank you, I hate it.

There's no way in he'll I'm going to create an account on every site I want to read, and absolutely I'm not submitting my number for the eternal, unrelenting spam.

I have enough crap from the legitimate companies selling/leaking my number, to now deal with _that_.

Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work

#99

Post by userbinator »

tiagozip wrote: post #61
wewxjfq wrote: post #19

I don't mind captchas to protect forms and such, but given that so many sites want captchas solved for the first GET request, I really wonder how much more CO2 this is going to produce. And when I see "invisible mode", I'd really like to ask the authors if they think their work is a net-positive for the world.

> how much more CO2 this is going to produce extremely minimal emissions, you're only solving a small cryptographic challenge after all.

Not at scale, however. Like another comment said, this is going to turn out like cryptocurrencies.

(I really couldn't care less about the climate debate, but waste is waste.)

Re: Cap: Lightweight, modern open-source CAPTCHA alternative using proof-of-work

#100

Post by GoblinSlayer »

skydhash wrote: post #18
mgrandl wrote: post #4

What does proof-of-work mean here and what makes it easy for humans and hard for bots?

It's equally easy for both. But people using broswers only do it a few times, while bots need to do it many times. A second for a human every X pages is not much, but it's a death-knell for the general practice of bots (and they can't store the cookies because you can rate-limit them that way). Imagine scrapping thousands of page, but with a X>1 second wait for each. There wouldn't be a need to use such solution if c…

So if you rate limited to one request per second, then use 100 cookies to make 100 requests per second, 1 request per second per cookie.
Post reply on HN