4 ms·

I wonder why these anti-abuse systems don't use proof-of-work. Instead of a captcha, let the browser chug for 5 seconds, and then POST the solution in order to

by gnud 10y ago

I wonder why these anti-abuse systems don't use proof-of-work. Instead of a captcha, let the browser chug for 5 seconds, and then POST the solution in order to gain a temporary access cookie. Sure, this could be attacked - but not at scale, and that's the whole point of the capchta anyway, right?

mikegerwitz 10y ago
That requires JavaScript. CloudFlare does have a JS-only challenge, which presumably does this type of thing, but this has a couple different problems. From a security perspective, you're executing arbitrary software, which is unwise, especially if you're looking for anonymity. The other issue is that the software is also proprietary. https://support.cloudflare.com/hc/en-us/articles/204191238-What-are-the-types-of-Threats- https://support.cloudflare.com/hc/en-us/articles/204191238-W... "During a JavaScript challenge you will be shown an interstitial page for about five seconds while CloudFlare performs a series of mathematical challenges to make sure it is a legitimate human visitor." Related: I have started trying to get into contact with webmasters of sites that enable JS Challenges; my template is at the bottom of this page; it'd be great if others could do the same: https://gitlab.com/mikegerwitz/dotfiles/blob/master/emacs.d/mail.org https://gitlab.com/mikegerwitz/dotfiles/blob/master/emacs.d/...
- gnud 10y ago
  Good point. The Cloudflare capthchas I've seen seemed to use Javascript, but maybe it's just incredibly good CSS. Interestingly, while a javascript calculation might leak more information to CloudFlare (since they might collect other info beseides the result of a proof-of-work function), it would probably leak less to anyone trying to analyze tor traffic from the outside? Seems to me like it would be harder to correlate the two ends of the tor circuit.
  - mikegerwitz 10y ago
    It'd be harder to do traffic analysis, yes, though I really wonder why it makes so many requests to begin with. I'd like to see an analysis of the CAPTCHA. Considering that they allow it without JS enabled, I wonder why they'd need any requests at all.
  - JumpCrisscross 10y ago
    > The Cloudflare capthchas I've seen seemed to use Javascript They have a non-JS version, too.
majke 10y ago
Browsers vary drastically in javascript performance. Counting something can take couple of milliseconds on your desktop and seconds on some old mobile phone. Ok, so you could differentiate the work for User-Agent, but then one could spoof user-agent to get less work. Going this route is not gonna be simple.
- mikeash 10y ago
  I set up a system like this for my blog comments. The work was a couple of orders of magnitude slower in the browser than it would be in native code. That means that if my users have to burn 30 seconds of CPU time, an adversary could potentially burn 0.3 seconds of CPU time per spam comment, which is not all that significant. Bumping it up beyond that makes the user experience suck, and this is for a comment system where you still have to spend time writing the comment. For just loading a web page, anything over a second or two will hurt. It's fine for my purposes, because I have no dedicated adversaries to combat, just occasional small-time spammers. But CloudFlare has a tougher time.
cocotino 10y ago
This is what TeamSpeak does, by the way.
tokenizerrr 10y ago
Not really. This wouldn't do anything against targeted spammers, where the spammer targets your site specifically. This happens more than you might think.

by gnud 10y ago

mikegerwitz 10y ago

That requires JavaScript. CloudFlare does have a JS-only challenge, which presumably does this type of thing, but this has a couple different problems. From a security perspective, you're executing arbitrary software, which is unwise, especially if you're looking for anonymity. The other issue is that the software is also proprietary. https://support.cloudflare.com/hc/en-us/articles/204191238-What-are-the-types-of-Threats- https://support.cloudflare.com/hc/en-us/articles/204191238-W... "During a JavaScript challenge you will be shown an interstitial page for about five seconds while CloudFlare performs a series of mathematical challenges to make sure it is a legitimate human visitor." Related: I have started trying to get into contact with webmasters of sites that enable JS Challenges; my template is at the bottom of this page; it'd be great if others could do the same: https://gitlab.com/mikegerwitz/dotfiles/blob/master/emacs.d/mail.org https://gitlab.com/mikegerwitz/dotfiles/blob/master/emacs.d/...

gnud 10y ago
Good point. The Cloudflare capthchas I've seen seemed to use Javascript, but maybe it's just incredibly good CSS. Interestingly, while a javascript calculation might leak more information to CloudFlare (since they might collect other info beseides the result of a proof-of-work function), it would probably leak less to anyone trying to analyze tor traffic from the outside? Seems to me like it would be harder to correlate the two ends of the tor circuit.
- mikegerwitz 10y ago
  It'd be harder to do traffic analysis, yes, though I really wonder why it makes so many requests to begin with. I'd like to see an analysis of the CAPTCHA. Considering that they allow it without JS enabled, I wonder why they'd need any requests at all.
- JumpCrisscross 10y ago
  > The Cloudflare capthchas I've seen seemed to use Javascript They have a non-JS version, too.

majke 10y ago

Browsers vary drastically in javascript performance. Counting something can take couple of milliseconds on your desktop and seconds on some old mobile phone. Ok, so you could differentiate the work for User-Agent, but then one could spoof user-agent to get less work. Going this route is not gonna be simple.

mikeash 10y ago
I set up a system like this for my blog comments. The work was a couple of orders of magnitude slower in the browser than it would be in native code. That means that if my users have to burn 30 seconds of CPU time, an adversary could potentially burn 0.3 seconds of CPU time per spam comment, which is not all that significant. Bumping it up beyond that makes the user experience suck, and this is for a comment system where you still have to spend time writing the comment. For just loading a web page, anything over a second or two will hurt. It's fine for my purposes, because I have no dedicated adversaries to combat, just occasional small-time spammers. But CloudFlare has a tougher time.

cocotino 10y ago

This is what TeamSpeak does, by the way.

tokenizerrr 10y ago

Not really. This wouldn't do anything against targeted spammers, where the spammer targets your site specifically. This happens more than you might think.