3 ms·
> Browsers could offer sites a way to verify that your users aren't bots without any personal data being sent off the device. A sufficiently memory-hard and AS
by mik1998 4y ago
> Browsers could offer sites a way to verify that your users aren't bots without any personal data being sent off the device.
A sufficiently memory-hard and ASIC-resistant proof of work scheme could be used here. But obviously, that implies some non-negligible load on the client.
- yjftsjthsd-h 4y agoI rather suspect that said PoW will either be cheap enough to be ineffective, or expensive enough to block phones (or perhaps just murder their batteries).
- throwawaypos 4y agoHow about PoS then? * Lock up, say, $5, in anonymous cryptocurrency like Monero * When visiting example.org, sign a message "example.org <current timestamp>" with your private key, and include the signed message in a request header * example.org can verify the signature (and the fact it's backed by $5) * example.org can also forward the signed messages to the advertiser as a proof of legitimate pageviews * if a bot farmer wants fake pageviews, they need to lock up separate $5 per bot (and if we're counting unique pageviews, then per pageview) edit: one gothca here is that sites could collect the signed messages to track users across sites. Perhaps there's a way to sign messages so that you prove you have $5, but not which $5 – I don't know.
- runnerup 4y agoI believe Private Access Tokens are the proposed solution using a cryptographic chip on-device like the TPM chips. https://blog.cloudflare.com/how-to-enable-private-access-tokens-in-ios-16-and-stop-seeing-captchas/ https://blog.cloudflare.com/how-to-enable-private-access-tok...