3 ms·
> makes a note of the current time Makes a note where exactly? In a data store? That means that I'm allowing an untrusted entity to trigger an action that requ
by mabbo 5y ago
> makes a note of the current time
Makes a note where exactly? In a data store? That means that I'm allowing an untrusted entity to trigger an action that requires me to store and later query my data store. That's a bad idea. The whole reason to have a captcha at all is to stop bots from overloading your system. The data store is a major bottle neck in most systems.
Proof of work is stateless. It's fast to verify. If you sign the challenge input before giving it to the user, you can also statelessly verify it's a legit challenge. No data store needed until after verification is complete.
Edit: also what ahsima said! The point of a captcha is to make it more expensive to use a bot net against you. Timers don't do that.
- kazinator 5y agoAnother excellent point! A correct implementation of proof of work means that we can hand off some (relatively) cheaply generated cookie and then maintain no state in relation to that while the answer is being calculated on the other end. This stateless principle is implemented in TCP SYN cookies for warding off SYN flood attacks, for instance. Thank you, also.
- 10000truths 5y agoAn 8-byte timestamp is not a lot of state. You could have a million concurrent connections and use only 8 MB for a file descriptor -> timestamp lookup table. The TCP send/receive buffers will exhaust your system memory long before the timestamps do.
- CyberShadow 5y agoYou need a datastore anyway to prevent replay attacks.