2 ms·
It hardly works. PoWs can be hyper-optimized in bot code compared to in browser JS, and your PoW has to be tolerable even for slow old devices so it can't be to
by mike_hearn 3y ago
It hardly works. PoWs can be hyper-optimized in bot code compared to in browser JS, and your PoW has to be tolerable even for slow old devices so it can't be too demanding anyway.
It also assumes a very smooth gradient of suspiciousness. When using JS challenges though, you can be often working with binary signals (at least, that's what I was able to get). So then there's not much "maybe so/maybe no" about it. Either you detect a bot with 100% confidence, in which case you just drop the banhammer. Or you don't spot it and have to let it through.