4 ms·

> Correct me if I'm wrong, but wouldn't this keep the endpoint accessible for any bot/script that is willing to "invest the work"? E.g. if I only plan to query

by Zababa 5y ago

> Correct me if I'm wrong, but wouldn't this keep the endpoint accessible for any bot/script that is willing to "invest the work"? E.g. if I only plan to query the endpoint a few times per day, the captcha won't be an obstacle. Isn't this already the case with other captchas where you can pay people to solve them for you? You could easily build a programmatic solution for that. If you're willing to "invest the work", nothing can really stop people automatically.

xg15 5y ago
If nothing can really stop people anyway, then what's the point of all this? But I think the problem is that a PoW captcha can be cracked significantly more easily than a regular captcha: For a regular captcha, a spammer would have to deal with brittle image analysis software or find people willing to do extremely boring, borderline illegal work for pennies. For a PoW captcha, they have to load the page in Selenium and... that's it. All that's left is a slight bump in the power bill.
- arbol 5y ago
  > If nothing can really stop people anyway, then what's the point of all this? Barriers to entry. Different services will require different levels of security. This might be enough for a simple poll app.
  - xg15 5y ago
    But a barrier for whom? If you're a script kiddy who knows how Selenium works, you can crack this. What this does for resource-poor attackers is implement some wasteful form of rate-limiting. But then, why not just use actual rate-limiting?
- Zababa 5y ago
  > If nothing can really stop people anyway, then what's the point of all this? It works, the thing is that "working" in that case is to increase the cost of doing this. Solving 1000 captchas costs $2 https://anti-captcha.com/ https://anti-captcha.com/. The difference here is that people that have no money can automate selenium on their own computer and defeat a PoW captcha. But for people that have to pay for either servers or a captcha solving service, there is no difference.

by Zababa 5y ago

xg15 5y ago

If nothing can really stop people anyway, then what's the point of all this? But I think the problem is that a PoW captcha can be cracked significantly more easily than a regular captcha: For a regular captcha, a spammer would have to deal with brittle image analysis software or find people willing to do extremely boring, borderline illegal work for pennies. For a PoW captcha, they have to load the page in Selenium and... that's it. All that's left is a slight bump in the power bill.

arbol 5y ago
> If nothing can really stop people anyway, then what's the point of all this? Barriers to entry. Different services will require different levels of security. This might be enough for a simple poll app.
- xg15 5y ago
  But a barrier for whom? If you're a script kiddy who knows how Selenium works, you can crack this. What this does for resource-poor attackers is implement some wasteful form of rate-limiting. But then, why not just use actual rate-limiting?
Zababa 5y ago
> If nothing can really stop people anyway, then what's the point of all this? It works, the thing is that "working" in that case is to increase the cost of doing this. Solving 1000 captchas costs $2 https://anti-captcha.com/ https://anti-captcha.com/. The difference here is that people that have no money can automate selenium on their own computer and defeat a PoW captcha. But for people that have to pay for either servers or a captcha solving service, there is no difference.