5 ms·

Maybe mCaptcha [0] is worth a look. It applies a Proof-of-Work like algorithm (not blockchain-related) which makes it very expensive for scrapers to get data in

by rapnie 3y ago

Maybe mCaptcha [0] is worth a look. It applies a Proof-of-Work like algorithm (not blockchain-related) which makes it very expensive for scrapers to get data in bulk, but poses least amount of friction to individual users. The project is implemented in Rust and received NGI.eu/NLnet funding. I don't know its state of production-readiness, but Codeberg.org is considering using it (this choice is informed by higher respect for privacy and improved a11y compared to hCaptcha). [0] https://mcaptcha.org/ https://mcaptcha.org/

toastal 3y ago
If it doesn’t involve my free labor training machine learning models like reCAPTCHA and hCAPTCHA and I can still visit sites from a non-Western IP, then it’s already an improvement.
8organicbits 3y ago
Really interesting! How efficiently does a web browser compute the PoW? I'm concerned that a bot would use an efficient GPU implementation while real users would run an inefficient JS/webcrypto version.
- jchw 3y ago
  I tried to implement PoW in browser for the same concept. I think it's probably at least marginally useful, but practically you're limited by WebCrypto I think, which outperformed anything I could find in pure JS or WASM. The disadvantage of WebCrypto is that there's a limited set of algorithms you can use and also, understandably, calculating hashes is async, so if you want a lot of rounds, you'll spend a lot of time jumping in and out of the event loop. It's still probably a useful speed bump or price increase for expensive operations: what might cost a few seconds on a typical phone or desktop is probably at least enough to act as a speed bump for attackers to perform it quickly (especially combined with other measures like throttling and progressively increasing PoW difficulty for an IP.) Maybe WebGPU could change this, but I'm weary of relying on all users having a fast GPU enabled in their browser just for this use case. Though thinking about it, I wonder if there is a hybrid: start with a difficulty that's just a few seconds for CPU/WebCrypto and ramp up quickly, but also support WebGPU where possible so that web users on abusive connections may still succeed? I am not sure though, I guess this depends on the feasibility of using WebGPU and etc.
- emporas 3y ago
  Requiring every user to compute it's own PoW is a terrible idea. It defeats the whole purpose. One's person expensive computation is another person's almost free computation. I commented in the past about it: "At first glance, yes, we can create intentionally expensive computations without relying on a blockchain, that would serve the same purpose. In reality we cannot. Special computer hardware (ASICs) could generate much cheaper PoW annotations than general purpose computers, and sell it to spammers. Blockchain economic incentives ensure that ASICs will be used by the miners first and foremost." https://news.ycombinator.com/item?id=33533389 https://news.ycombinator.com/item?id=33533389
  - comex 3y ago
    > Blockchain economic incentives ensure that ASICs will be used by the miners first and foremost. So instead, what, you want people to buy BTC and send small amounts of it to websites? Problem is, given varying income levels across society and across the world, one person's expensive micropayment is another person's almost free micropayment.
    - emporas 3y ago
      In a comment down below, i made it clear i was not referring to BTC. In the internet there is no centralized registry of naming projects. There are currently three projects in which the communities call themselves bitcoin. Any one of the other two bitcoins support much smaller microtransactions than BTC. Very true, that micropayments could vary on their relative cheapness across the global population. Let's put a number, is 0.01 cent affordable by most people on the planet, for every http request?
      - elcomet 3y ago
        So maybe you should link to the one you are referring to, if there are three projects with the same name.
        emporas 3y ago
hackernewds 3y ago
how does it work? perhaps it's proprietary that the authors wouldn't want to disclose, but I did not see anything referenced in the site. I wouldn't plug it into mine without knowing g
- rapnie 3y ago
  It isn't proprietary [0]. There is a matrix channel [1] for the project to ask questions. [0] https://github.com/mCaptcha/mCaptcha https://github.com/mCaptcha/mCaptcha [1] https://matrix.to/#/#mCaptcha:matrix.batsense.net https://matrix.to/#/#mCaptcha:matrix.batsense.net
emporas 3y ago
In my opinion, PoW is the only reliable way, to avoid DDoS attacks. Scraping too much, too quickly is a light form of DDoS, although not intentional. PoW was invented in 2006 exactly for that purpose. The genius of bitcoin (not BTC) is that it provides an organized and practical way, for PoW to be used by everyone on the planet. Some people find it strange, because there is an imaginary token created out of pure nothing which represents the PoW. It would work fine, without that imaginary token i.e. bitcoin, just by dollars of euros, but it wouldn't be internet native. The point is always to just send a minimal PoW with every http or tcp/ip request.
- sph 3y ago
  Proof-of-work was originally introduced by Adam Back's hashcash, to fight email spam. Bitcoin is an evolution of that idea applied to digital cash. https://en.wikipedia.org//wiki/Hashcash https://en.wikipedia.org//wiki/Hashcash
  - emporas 3y ago
    Yes, DDoS attacks are spam over the http protocol. Spam is spam over the imap protocol. Overwhelming a server with too many download requests, is not spam but it has the same effect. Calling the police every ten minutes because the door sounds like someone tries to break in, is spam.
    - account42 3y ago
      > Spam is spam over the imap protocol. IMAP isn't used for sending email. You're thinking of SMTP.
  - jcq3 3y ago
    Would it be possible to use bitcoin pow as a replacement for captcha? It both blocks ddos and create an income through mining (client side) for the host.
    - GTP 3y ago
RockRobotRock 3y ago
hCaptcha's accessibility model seems quite good to me: https://www.hcaptcha.com/accessibility https://www.hcaptcha.com/accessibility
- fsckboy 3y ago
  proof of work sounds accessible to me
- bramd 3y ago
  I disagree. To "solve" their CAPTCHAs I had to register by providing a working email address. I don't encounter HCAPTCHA problems that often, so when I need to solve a new one usually my cookie has expired and I have to reopen the link to get a new one before being able to continue. I just store such links in my password manager, but imagine you have to find an email with the link they sent you over a year ago before being able to just continue on with what you were doing. And even then, depending on ad blocking/privacy settings their cookie may not even work. I think this whole thing is a big hurdle just because I'm unable to solve visual puzzles. Besides, having a company collecting email addresses of people who are disabled in one way or another and giving them an identifying cookie is a privacy/data disaster waiting to happen. That being said, I think the audio alternatives for visual CAPTCHAs are also unacceptable. Even if you can hear them, they may be hard to solve especially if they are not provided in your mother tongue. I think we can and should be able to do better by now
  - RockRobotRock 3y ago
    Good points
ranger_danger 3y ago
There is also this proof-of-work solution https://gitgud.io/fatchan/haproxy-protection/ https://gitgud.io/fatchan/haproxy-protection/
RobotToaster 3y ago
There's also (the imaginatively named) powcaptcha https://git.sequentialread.com/forest/pow-captcha https://git.sequentialread.com/forest/pow-captcha
tambourine_man 3y ago
I got interested in mCaptcha, followed your link, but couldn’t find anywhere an example of what the end user would deal with. What kind of PoW are we talking about?
- m3at 3y ago
  You can find some demos linked on github [1], the simplest being: https://demo.mcaptcha.org/widget/?sitekey=pHy0AktWyOKuxZDzFfoaewncWecCHo23 https://demo.mcaptcha.org/widget/?sitekey=pHy0AktWyOKuxZDzFf... [1] https://github.com/mCaptcha/mCaptcha#client-side-widget https://github.com/mCaptcha/mCaptcha#client-side-widget
  - tambourine_man 3y ago
    Thanks, the GitHub page is much better.
- dicknuckle 3y ago
  Did you click on Link to Widget? It's just above the video link.
Zuiii 3y ago
> It applies a Proof-of-Work like algorithm (not blockchain-related) If you're going to waste my energy to do proof-of-work anyway, I'd rather you use it for something useful (even mining crypto-currency to pay for server costs) rather than let it go to waste.

by rapnie 3y ago

toastal 3y ago

If it doesn’t involve my free labor training machine learning models like reCAPTCHA and hCAPTCHA and I can still visit sites from a non-Western IP, then it’s already an improvement.

8organicbits 3y ago

Really interesting! How efficiently does a web browser compute the PoW? I'm concerned that a bot would use an efficient GPU implementation while real users would run an inefficient JS/webcrypto version.

jchw 3y ago
I tried to implement PoW in browser for the same concept. I think it's probably at least marginally useful, but practically you're limited by WebCrypto I think, which outperformed anything I could find in pure JS or WASM. The disadvantage of WebCrypto is that there's a limited set of algorithms you can use and also, understandably, calculating hashes is async, so if you want a lot of rounds, you'll spend a lot of time jumping in and out of the event loop. It's still probably a useful speed bump or price increase for expensive operations: what might cost a few seconds on a typical phone or desktop is probably at least enough to act as a speed bump for attackers to perform it quickly (especially combined with other measures like throttling and progressively increasing PoW difficulty for an IP.) Maybe WebGPU could change this, but I'm weary of relying on all users having a fast GPU enabled in their browser just for this use case. Though thinking about it, I wonder if there is a hybrid: start with a difficulty that's just a few seconds for CPU/WebCrypto and ramp up quickly, but also support WebGPU where possible so that web users on abusive connections may still succeed? I am not sure though, I guess this depends on the feasibility of using WebGPU and etc.
emporas 3y ago
Requiring every user to compute it's own PoW is a terrible idea. It defeats the whole purpose. One's person expensive computation is another person's almost free computation. I commented in the past about it: "At first glance, yes, we can create intentionally expensive computations without relying on a blockchain, that would serve the same purpose. In reality we cannot. Special computer hardware (ASICs) could generate much cheaper PoW annotations than general purpose computers, and sell it to spammers. Blockchain economic incentives ensure that ASICs will be used by the miners first and foremost." https://news.ycombinator.com/item?id=33533389 https://news.ycombinator.com/item?id=33533389
- comex 3y ago
  > Blockchain economic incentives ensure that ASICs will be used by the miners first and foremost. So instead, what, you want people to buy BTC and send small amounts of it to websites? Problem is, given varying income levels across society and across the world, one person's expensive micropayment is another person's almost free micropayment.
  - emporas 3y ago
    In a comment down below, i made it clear i was not referring to BTC. In the internet there is no centralized registry of naming projects. There are currently three projects in which the communities call themselves bitcoin. Any one of the other two bitcoins support much smaller microtransactions than BTC. Very true, that micropayments could vary on their relative cheapness across the global population. Let's put a number, is 0.01 cent affordable by most people on the planet, for every http request?
    - elcomet 3y ago
      So maybe you should link to the one you are referring to, if there are three projects with the same name.
      - emporas 3y ago

hackernewds 3y ago

how does it work? perhaps it's proprietary that the authors wouldn't want to disclose, but I did not see anything referenced in the site. I wouldn't plug it into mine without knowing g

rapnie 3y ago
It isn't proprietary [0]. There is a matrix channel [1] for the project to ask questions. [0] https://github.com/mCaptcha/mCaptcha https://github.com/mCaptcha/mCaptcha [1] https://matrix.to/#/#mCaptcha:matrix.batsense.net https://matrix.to/#/#mCaptcha:matrix.batsense.net

emporas 3y ago

In my opinion, PoW is the only reliable way, to avoid DDoS attacks. Scraping too much, too quickly is a light form of DDoS, although not intentional. PoW was invented in 2006 exactly for that purpose. The genius of bitcoin (not BTC) is that it provides an organized and practical way, for PoW to be used by everyone on the planet. Some people find it strange, because there is an imaginary token created out of pure nothing which represents the PoW. It would work fine, without that imaginary token i.e. bitcoin, just by dollars of euros, but it wouldn't be internet native. The point is always to just send a minimal PoW with every http or tcp/ip request.

sph 3y ago
Proof-of-work was originally introduced by Adam Back's hashcash, to fight email spam. Bitcoin is an evolution of that idea applied to digital cash. https://en.wikipedia.org//wiki/Hashcash https://en.wikipedia.org//wiki/Hashcash
- emporas 3y ago
  Yes, DDoS attacks are spam over the http protocol. Spam is spam over the imap protocol. Overwhelming a server with too many download requests, is not spam but it has the same effect. Calling the police every ten minutes because the door sounds like someone tries to break in, is spam.
  - account42 3y ago
    > Spam is spam over the imap protocol. IMAP isn't used for sending email. You're thinking of SMTP.
- jcq3 3y ago
  Would it be possible to use bitcoin pow as a replacement for captcha? It both blocks ddos and create an income through mining (client side) for the host.
  - GTP 3y ago

RockRobotRock 3y ago

hCaptcha's accessibility model seems quite good to me: https://www.hcaptcha.com/accessibility https://www.hcaptcha.com/accessibility

fsckboy 3y ago
proof of work sounds accessible to me
bramd 3y ago
I disagree. To "solve" their CAPTCHAs I had to register by providing a working email address. I don't encounter HCAPTCHA problems that often, so when I need to solve a new one usually my cookie has expired and I have to reopen the link to get a new one before being able to continue. I just store such links in my password manager, but imagine you have to find an email with the link they sent you over a year ago before being able to just continue on with what you were doing. And even then, depending on ad blocking/privacy settings their cookie may not even work. I think this whole thing is a big hurdle just because I'm unable to solve visual puzzles. Besides, having a company collecting email addresses of people who are disabled in one way or another and giving them an identifying cookie is a privacy/data disaster waiting to happen. That being said, I think the audio alternatives for visual CAPTCHAs are also unacceptable. Even if you can hear them, they may be hard to solve especially if they are not provided in your mother tongue. I think we can and should be able to do better by now
- RockRobotRock 3y ago
  Good points

ranger_danger 3y ago

There is also this proof-of-work solution https://gitgud.io/fatchan/haproxy-protection/ https://gitgud.io/fatchan/haproxy-protection/

RobotToaster 3y ago

There's also (the imaginatively named) powcaptcha https://git.sequentialread.com/forest/pow-captcha https://git.sequentialread.com/forest/pow-captcha

tambourine_man 3y ago

I got interested in mCaptcha, followed your link, but couldn’t find anywhere an example of what the end user would deal with. What kind of PoW are we talking about?

m3at 3y ago
You can find some demos linked on github [1], the simplest being: https://demo.mcaptcha.org/widget/?sitekey=pHy0AktWyOKuxZDzFfoaewncWecCHo23 https://demo.mcaptcha.org/widget/?sitekey=pHy0AktWyOKuxZDzFf... [1] https://github.com/mCaptcha/mCaptcha#client-side-widget https://github.com/mCaptcha/mCaptcha#client-side-widget
- tambourine_man 3y ago
  Thanks, the GitHub page is much better.
dicknuckle 3y ago
Did you click on Link to Widget? It's just above the video link.

Zuiii 3y ago

> It applies a Proof-of-Work like algorithm (not blockchain-related) If you're going to waste my energy to do proof-of-work anyway, I'd rather you use it for something useful (even mining crypto-currency to pay for server costs) rather than let it go to waste.