7 ms·

I don't understand the premise. The point of a CAPTCHA is to tell Computers and Humans Apart, that's what the CHA stands for. You cannot hope to do this test us

by remram 3y ago

I don't understand the premise. The point of a CAPTCHA is to tell Computers and Humans Apart, that's what the CHA stands for. You cannot hope to do this test using a proof-of-work system where the work is computer work. Call this a client rate-limiter, or whatever else, but it is obviously not a CAPTCHA and cannot function in this way. Another obvious problem is that server hardware is vastly more powerful than the average user's device. If you set your challenge to an amount of work that doesn't meaningfully drive users away and/or drain their batteries, you are allowing a malicious server to pass your challenge tens of thousands of times an hour.

tracker1 3y ago
Is server hardware vastly more powerful? If you use a hashing algorithm that isn't easily parallel, then you're dedicating a single CPU core for that exercise. Now a server may have more cores, but they are often slower per-core than a client machine. And dedicating server resources has a cost. You'd slow a brute force attack to a relative crawl, especially if the target has a large volume of pre-defined work and answers. PBKDF2, as an example on 100k iterations can easily pin a CPU core for a few seconds. This is part of why I always have my authentication services separate from my applications, it reduces the DDoS vector. Now, you can shift work to the client as kind of an inverse-ddos rate limiter. Combine that with a websocket connection, where the browser is sending user events like mouse movement, touch, scroll, focus/blur and input/paste... the two, combined with event timing analysis can give you a pretty good guess if something is a real user. And if it isn't, definitely slowing down bots.
- remram 3y ago
  Even if your server is not vastly more powerful, your 1 second of proof-of-work means a single server can pass your challenge 3600 times an hour. The point is: a CAPTCHA has to be something that is easy for humans and hard for bots. This is at best the same level of effort from human('s devices) and bots. And realistically, more, because bots aren't battery-powered. It can't work.
  - NiloCK 3y ago
    > a CAPTCHA has to be something that is easy for humans and hard for bots Do you know of any such things? Because I routinely find captchas difficult now.
    - kube-system 3y ago
      Yes, due to the emergence of better bots, traditional CAPTCHAs aren't very good at being CAPTCHAs anymore either. It's a hard problem to solve, and it's a moving target.
    - ghayes 3y ago
      I've had this problem a lot when I use a VPN. You're served a captcha that is impossible (I choose all of the correct squares and it still fails), and then I'm given a captcha with the ultra-slow click and reload images. At this point, I think it's more of an IP rate limiter than a human-bot detector.
      - eviks 3y ago
        but then some other services don't degrade like that and still offer you some easy 2-step puzzle "rotate a pic until panda is not upside down" or "find a panda"
  - kaba0 3y ago
    Similarly how many security features work, it doesn't have to be 100% (or it may even be impossible to make it 100%), it just has to be good enough/make the attack expensive enough to deter it. There aren't really any easy task left for humans that a suitably trained ML algorithm couldn't do, and anything more complex would just annoy people. Even if there is such a task, the line moves quickly -- back then reading some colored digits from an image was unfeasibly hard/expensive for bots. Nowadays your phone extracts text from your images in the background. In this vein, anything requiring ML/expensive computation is still a worthwhile addition, as today the primary purpose of a CAPTCHA is to slow down/rate limit bot-activity. Your single server use case is not really realistic -- it can be easily reverted (it won't come from 3600 IP addresses, otherwise the rate would be much lower), and 3600 times an hour is.. not a lot for a computer. So it seems to do its job well.
- est 3y ago
  > Is server hardware vastly more powerful? Actually no. The server CPU has lower GHz and server memory is slower due to ECC. But server has lotta more bandwidth to handle concurrent processing.
  - xxs 3y ago
    That would work for some desktop and very few laptops only... and only if the task cannot be ported to GPU. Other than that Javascript code would be ported to C. This very case is far worse as it uses SHA-256, all that bitcoin asics love.
  - remram 3y ago
    The average user is on a 3-year-old Android phone with 40% battery. The average server has 32 processors and industrial-grade cooling. Sure, it is possible that your gaming PC beats the average server in terms of CPU frequency. But that's not what the average website visitor is using, and you can't scale the proof-of-work out of their reach.
notpushkin 3y ago
I'd say you're too pedantic. Given both computer work (calculating hashes) and human labor (filling out reCAPTCHA) have a price point, it is only a matter of making automated actions more expensive to scale. It's only natural then that the word definition has shifted. Let's just declare that captcha now stands for Completely Automated Public Thingy to Make Spammers And Fraudsters Life A Bit Harder.
- throwawayadvsec 3y ago
  large scale spammers are just going to use free cloud credits they got for pennies on the dollar, it won't stop anyone
- 1116574 3y ago
  But it doesn't catch fraudsters! Point fo captcha is to make sure that there is a human eg. writing this comment or creating account. If I used this (admitedly cool and useful) rate limiter instead of real captcha I would have 1000s of ai generated posts and 100s of new accounts. Yes, it would be rate limited and spread over a day or week, and servers would easly handle it, but that's not the point. I don't want this fake activity at all - that's the point! This seems like a good alternative/addition to cloudflare and their anti ddos features though (?)
  - thayne 3y ago
    But a traditional captcha doesn't solve that either. Even if the captcha really is too hard for a bot, you can pay other humans to solve captchas for you at a click farm. Or even just generate content and automate everything except the captcha, and solve those yourself.
    - smohare 3y ago
      [dead]
    - Dylan16807 3y ago
      A dead comment thinks you're making a no true Scotsman argument, but you're right. The key is that the workarounds you're listing are very cheap and easy, not just possible.
dqv 3y ago
¯\_(ツ)_/¯ It's a semantic expansion. It happens all the time in language. That's not a meme! That's just an image with a caption on it! CAPTCHA is widely known as a thing that is implemented to prevent spam [0]. This is a thing that is used to prevent spam. It's CAPTCHA now. Here, the concept of preventing spam is communicated through the word CAPTCHA. "mRateLimiter: Open-source proof-of-work rate limiter for websites" Huh? What is this thing, what does it do? [0]: Speaking of the word spam... You're not spamming! Spamming is when you send junk email! You're just pressing a button on your controller over and over again!
- dragonwriter 3y ago
  > Speaking of the word spam... You're not spamming! Spamming is when you send junk email! You're just pressing a button on your controller over and over again! The gaming use seems to precede the email use by quite a bit, and be part of the route between the Monty Python sketch and the email use, FWIW.
- johnchristopher 3y ago
  It's typical HN: word definitions don't matter and can be tortured to death to mean anything unless one wants to nit-pick then people better use the most academic, agreed-upon and official meaning of a word. Now back to updating the sophos captcha appliance at work.
  - thebears5454 3y ago
    Human language is a thing of beauty
Fice 3y ago
Telling computers and humans apart is a wrong goal. Every request comes from a computer that is commanded by some human. And why shouldn't users be allowed to use automated user agents when they don't do it for spamming or anything malicious? CAPTCHA is essentially a proof-of-work variant where challenges are designed to be solved by humans rather than computers, and same as any PoW it works by means of consuming some limited resource (human time, processor time, energy).
- teacpde 3y ago
  A lot of times the purpose is more on rate limiting than disallowing bot access. The goal to tell apart is on the premise that humans are a lot slower than bots.
  - weird-eye-issue 3y ago
    In our SaaS we have usage limits and rate limits. Have never needed to implement "bot detection" for this reason
    - kalleboo 3y ago
      How do you rate limit a botnet coming from tens of thousands of different IP addresses?
      - weird-eye-issue 3y ago
        For anonymous/free users we have very strict usage limits and the functionality is more limited to only operations that cost us less money. So a very targeted attack would do damage but that is true of basically any system and we could flip on bot blocking in Cloudflare if needed and if that would help
        remram 3y ago
        Cloudflare's bot blocking uses CAPTCHA... By your own admission, the only reason you don't have a CAPTCHA is that you haven't needed one yet.
Semaphor 3y ago
It’s not worse than others, computers are better than I at solving the cancer that is ReCaptcha and hCaptcha. It’s why I let them do it. edit: To be fair, as another comment mentioned, this would be cheaper to solve.
deleted 3y ago
[deleted]
danShumway 3y ago
The problem is that traditional audio/video captchas are not proof of humanity either. Captchas are a method for increasing the amount of work that an automated client needs to do to access your site. They do not block bots, they just impose a cost. They're designed to block bots, sure, I agree. But we are burying our heads in the sand if we think that captchas imply humanity. They don't. The tests that they impose are not rigorous or strong enough to do that. What audio/video captchas do in practice is impose a cost in front of automated access. We'd like them to do more than that, but the tech hasn't really ultimately worked out in that direction so even though we'd like a captcha to prove that a user is a human, what the captcha enforces is just a cost-per-request. Sometimes that involves paying a human pennies to solve the captcha, sometimes it just means turning on accessibility features and piping the captcha into a text-to-speech service. Either way, the final request can still be trivially coming from a bot (and regularly is).

by remram 3y ago

tracker1 3y ago

Is server hardware vastly more powerful? If you use a hashing algorithm that isn't easily parallel, then you're dedicating a single CPU core for that exercise. Now a server may have more cores, but they are often slower per-core than a client machine. And dedicating server resources has a cost. You'd slow a brute force attack to a relative crawl, especially if the target has a large volume of pre-defined work and answers. PBKDF2, as an example on 100k iterations can easily pin a CPU core for a few seconds. This is part of why I always have my authentication services separate from my applications, it reduces the DDoS vector. Now, you can shift work to the client as kind of an inverse-ddos rate limiter. Combine that with a websocket connection, where the browser is sending user events like mouse movement, touch, scroll, focus/blur and input/paste... the two, combined with event timing analysis can give you a pretty good guess if something is a real user. And if it isn't, definitely slowing down bots.

remram 3y ago
Even if your server is not vastly more powerful, your 1 second of proof-of-work means a single server can pass your challenge 3600 times an hour. The point is: a CAPTCHA has to be something that is easy for humans and hard for bots. This is at best the same level of effort from human('s devices) and bots. And realistically, more, because bots aren't battery-powered. It can't work.
- NiloCK 3y ago
  > a CAPTCHA has to be something that is easy for humans and hard for bots Do you know of any such things? Because I routinely find captchas difficult now.
  - kube-system 3y ago
    Yes, due to the emergence of better bots, traditional CAPTCHAs aren't very good at being CAPTCHAs anymore either. It's a hard problem to solve, and it's a moving target.
  - ghayes 3y ago
    I've had this problem a lot when I use a VPN. You're served a captcha that is impossible (I choose all of the correct squares and it still fails), and then I'm given a captcha with the ultra-slow click and reload images. At this point, I think it's more of an IP rate limiter than a human-bot detector.
    - eviks 3y ago
      but then some other services don't degrade like that and still offer you some easy 2-step puzzle "rotate a pic until panda is not upside down" or "find a panda"
- kaba0 3y ago
  Similarly how many security features work, it doesn't have to be 100% (or it may even be impossible to make it 100%), it just has to be good enough/make the attack expensive enough to deter it. There aren't really any easy task left for humans that a suitably trained ML algorithm couldn't do, and anything more complex would just annoy people. Even if there is such a task, the line moves quickly -- back then reading some colored digits from an image was unfeasibly hard/expensive for bots. Nowadays your phone extracts text from your images in the background. In this vein, anything requiring ML/expensive computation is still a worthwhile addition, as today the primary purpose of a CAPTCHA is to slow down/rate limit bot-activity. Your single server use case is not really realistic -- it can be easily reverted (it won't come from 3600 IP addresses, otherwise the rate would be much lower), and 3600 times an hour is.. not a lot for a computer. So it seems to do its job well.
est 3y ago
> Is server hardware vastly more powerful? Actually no. The server CPU has lower GHz and server memory is slower due to ECC. But server has lotta more bandwidth to handle concurrent processing.
- xxs 3y ago
  That would work for some desktop and very few laptops only... and only if the task cannot be ported to GPU. Other than that Javascript code would be ported to C. This very case is far worse as it uses SHA-256, all that bitcoin asics love.
- remram 3y ago
  The average user is on a 3-year-old Android phone with 40% battery. The average server has 32 processors and industrial-grade cooling. Sure, it is possible that your gaming PC beats the average server in terms of CPU frequency. But that's not what the average website visitor is using, and you can't scale the proof-of-work out of their reach.

notpushkin 3y ago

I'd say you're too pedantic. Given both computer work (calculating hashes) and human labor (filling out reCAPTCHA) have a price point, it is only a matter of making automated actions more expensive to scale. It's only natural then that the word definition has shifted. Let's just declare that captcha now stands for Completely Automated Public Thingy to Make Spammers And Fraudsters Life A Bit Harder.

throwawayadvsec 3y ago
large scale spammers are just going to use free cloud credits they got for pennies on the dollar, it won't stop anyone
1116574 3y ago
But it doesn't catch fraudsters! Point fo captcha is to make sure that there is a human eg. writing this comment or creating account. If I used this (admitedly cool and useful) rate limiter instead of real captcha I would have 1000s of ai generated posts and 100s of new accounts. Yes, it would be rate limited and spread over a day or week, and servers would easly handle it, but that's not the point. I don't want this fake activity at all - that's the point! This seems like a good alternative/addition to cloudflare and their anti ddos features though (?)
- thayne 3y ago
  But a traditional captcha doesn't solve that either. Even if the captcha really is too hard for a bot, you can pay other humans to solve captchas for you at a click farm. Or even just generate content and automate everything except the captcha, and solve those yourself.
  - smohare 3y ago
    [dead]
  - Dylan16807 3y ago
    A dead comment thinks you're making a no true Scotsman argument, but you're right. The key is that the workarounds you're listing are very cheap and easy, not just possible.

dqv 3y ago

¯\_(ツ)_/¯ It's a semantic expansion. It happens all the time in language. That's not a meme! That's just an image with a caption on it! CAPTCHA is widely known as a thing that is implemented to prevent spam [0]. This is a thing that is used to prevent spam. It's CAPTCHA now. Here, the concept of preventing spam is communicated through the word CAPTCHA. "mRateLimiter: Open-source proof-of-work rate limiter for websites" Huh? What is this thing, what does it do? [0]: Speaking of the word spam... You're not spamming! Spamming is when you send junk email! You're just pressing a button on your controller over and over again!

dragonwriter 3y ago
> Speaking of the word spam... You're not spamming! Spamming is when you send junk email! You're just pressing a button on your controller over and over again! The gaming use seems to precede the email use by quite a bit, and be part of the route between the Monty Python sketch and the email use, FWIW.
johnchristopher 3y ago
It's typical HN: word definitions don't matter and can be tortured to death to mean anything unless one wants to nit-pick then people better use the most academic, agreed-upon and official meaning of a word. Now back to updating the sophos captcha appliance at work.
- thebears5454 3y ago
  Human language is a thing of beauty

Fice 3y ago

Telling computers and humans apart is a wrong goal. Every request comes from a computer that is commanded by some human. And why shouldn't users be allowed to use automated user agents when they don't do it for spamming or anything malicious? CAPTCHA is essentially a proof-of-work variant where challenges are designed to be solved by humans rather than computers, and same as any PoW it works by means of consuming some limited resource (human time, processor time, energy).

teacpde 3y ago
A lot of times the purpose is more on rate limiting than disallowing bot access. The goal to tell apart is on the premise that humans are a lot slower than bots.
- weird-eye-issue 3y ago
  In our SaaS we have usage limits and rate limits. Have never needed to implement "bot detection" for this reason
  - kalleboo 3y ago
    How do you rate limit a botnet coming from tens of thousands of different IP addresses?
    - weird-eye-issue 3y ago
      For anonymous/free users we have very strict usage limits and the functionality is more limited to only operations that cost us less money. So a very targeted attack would do damage but that is true of basically any system and we could flip on bot blocking in Cloudflare if needed and if that would help
      - remram 3y ago
        Cloudflare's bot blocking uses CAPTCHA... By your own admission, the only reason you don't have a CAPTCHA is that you haven't needed one yet.

Semaphor 3y ago

It’s not worse than others, computers are better than I at solving the cancer that is ReCaptcha and hCaptcha. It’s why I let them do it. edit: To be fair, as another comment mentioned, this would be cheaper to solve.

deleted 3y ago

[deleted]

danShumway 3y ago

The problem is that traditional audio/video captchas are not proof of humanity either. Captchas are a method for increasing the amount of work that an automated client needs to do to access your site. They do not block bots, they just impose a cost. They're designed to block bots, sure, I agree. But we are burying our heads in the sand if we think that captchas imply humanity. They don't. The tests that they impose are not rigorous or strong enough to do that. What audio/video captchas do in practice is impose a cost in front of automated access. We'd like them to do more than that, but the tech hasn't really ultimately worked out in that direction so even though we'd like a captcha to prove that a user is a human, what the captcha enforces is just a cost-per-request. Sometimes that involves paying a human pennies to solve the captcha, sometimes it just means turning on accessibility features and piping the captcha into a text-to-speech service. Either way, the final request can still be trivially coming from a bot (and regularly is).