3 ms·

> they do serve a non-theatrical purpose in many cases of throttling the speed of brute force attacks Might do that unobtrusively for the average person, by us

by rapnie 3y ago

> they do serve a non-theatrical purpose in many cases of throttling the speed of brute force attacks Might do that unobtrusively for the average person, by using projects like mCaptcha [0] for instance. [0] https://mcaptcha.org/ https://mcaptcha.org/

JCharante 3y ago
Oh what a perfect find. I have on my todolist to add POW to some of my api endpoints
- berkes 3y ago
  I've had that idea for years. Two versions that I experimented with. One is where the incoming POW hashes contribute to hashing power for some blockchain mining. An alternative "pay as you use the API" system. The other using hashcash. Just a way to slow down abuse. Both, however, suffer from the downside that many/all "ASIC resisting crypto mining" suffer from as well: the cheapest CPU power is CPU power from machines/power you don't own. Botnets, viruses, trojans etc. So such a mechanism to throtthe or protect APIs won't hold back spammers and abusers for long.
  - rezonant 3y ago
    Dirty energy is (often) cheap, so that's the energy the bad actors will use. I don't know that incentivizing bad actors to waste energy in a climate crisis is the best way to fight this problem. You might correctly claim clean energy is often cheaper, but you must also consider the regions in which they'll get away with nefarious activity, and whether those areas have made the investments into making clean energy cheap.
    - berkes 3y ago
      I was specifically talking about "ASIC resistant crypto mining".
    - andrepd 3y ago
      >Dirty energy is (often) cheap, so that's the energy the bad actors will use Hmm, I don't get this, surely all actors will want the cheapest energy, no? The problem being the underlying one, that the dirty energy doesn't pay its externalities and is thus cheaper than renewables.
    - pixl97 3y ago
      My guess is most bad actors will just use stolen energy (your computer with a botnet on it).
- matheusmoreira 3y ago
  I'm not sure whether that's genius or horrifying. On the one hand, that could form the micropayments network the web always needed. On the other hand, it would enable quite a bit of abuse on its own.
mimi89999 3y ago
Is it similar to https://friendlycaptcha.com/ https://friendlycaptcha.com/ ?
- latexr 3y ago
  It’s funny how they have a section with three human avatars and one robot, with green checkmarks on the humans, yet those faces look AI-generated.
- realaravinth 3y ago
  Author of mCaptcha here o/ Yes, the only differences are that mCaptcha is 100% FOSS and uses variable difficulty factor, which makes it easy to solve Proof-of-Work under normal traffic level but becomes harder as an attack is detected.
ovx 3y ago
or https://altcha.org https://altcha.org which is easier to integrate ;)
Tmpod 3y ago
mCaptcha is interesting, but I wonder what its energy impact would be on a sufficiently large deployment, e.g imagine we replaced all reCAPTCHAs with mCaptcha.
- realaravinth 3y ago
  Author of mCaptcha here o/ mCaptcha uses PoW and that is energy inefficient, but it not as bad as the PoWs used in blockchains. The PoW difficulty factor in mCaptcha is significantly lower than blockchains, where several miners will have to pool their resources to solve a single challenge. In mCaptcha, it takes anywhere between 200ms to 5s to solve a challenge. Which is probably comparable to the energy used to train AI models used in reCAPTCHA. The protection mechanisms used to guard access to the internet must be privacy-respecting and idempotent. mCaptcha isn't perfect, and I'm constantly on the lookout for finding better and cleaner ways to solve this problem.
  - bluish29 3y ago
    > Which is probably comparable to the energy used to train AI models used in reCAPTCHA Are you comparing the energy it takes to train a model which is bounded and defined with unbounded inference which can (in principle) go multiple order of magnitude depending on the usage? Or maybe I misunderstood what you are trying to say? then I apologize in advance.
    - realaravinth 3y ago
      I am, but what I said was more of a hypothesis than a fact :) From what I understand of reCAPTCHA, the model isn't static and is continuously learning from every interaction[0]: > reCAPTCHA’s risk-based bot algorithms apply continuous machine learning that factors in every customer and bot interaction to overcome the binary heuristic logic of traditional challenge-based bot detection technologies. I don't know the energy demands of such a system. mCaptcha, under attack situations, will at most take 5s of CPU time on a busy (regular multitasking with multiple background process) smartphone. [0]: https://www.google.com/recaptcha/about/ https://www.google.com/recaptcha/about/

by rapnie 3y ago

JCharante 3y ago

Oh what a perfect find. I have on my todolist to add POW to some of my api endpoints

berkes 3y ago
I've had that idea for years. Two versions that I experimented with. One is where the incoming POW hashes contribute to hashing power for some blockchain mining. An alternative "pay as you use the API" system. The other using hashcash. Just a way to slow down abuse. Both, however, suffer from the downside that many/all "ASIC resisting crypto mining" suffer from as well: the cheapest CPU power is CPU power from machines/power you don't own. Botnets, viruses, trojans etc. So such a mechanism to throtthe or protect APIs won't hold back spammers and abusers for long.
- rezonant 3y ago
  Dirty energy is (often) cheap, so that's the energy the bad actors will use. I don't know that incentivizing bad actors to waste energy in a climate crisis is the best way to fight this problem. You might correctly claim clean energy is often cheaper, but you must also consider the regions in which they'll get away with nefarious activity, and whether those areas have made the investments into making clean energy cheap.
  - berkes 3y ago
    I was specifically talking about "ASIC resistant crypto mining".
  - andrepd 3y ago
    >Dirty energy is (often) cheap, so that's the energy the bad actors will use Hmm, I don't get this, surely all actors will want the cheapest energy, no? The problem being the underlying one, that the dirty energy doesn't pay its externalities and is thus cheaper than renewables.
  - pixl97 3y ago
    My guess is most bad actors will just use stolen energy (your computer with a botnet on it).
matheusmoreira 3y ago
I'm not sure whether that's genius or horrifying. On the one hand, that could form the micropayments network the web always needed. On the other hand, it would enable quite a bit of abuse on its own.

mimi89999 3y ago

Is it similar to https://friendlycaptcha.com/ https://friendlycaptcha.com/ ?

latexr 3y ago
It’s funny how they have a section with three human avatars and one robot, with green checkmarks on the humans, yet those faces look AI-generated.
realaravinth 3y ago
Author of mCaptcha here o/ Yes, the only differences are that mCaptcha is 100% FOSS and uses variable difficulty factor, which makes it easy to solve Proof-of-Work under normal traffic level but becomes harder as an attack is detected.

ovx 3y ago

or https://altcha.org https://altcha.org which is easier to integrate ;)

Tmpod 3y ago

mCaptcha is interesting, but I wonder what its energy impact would be on a sufficiently large deployment, e.g imagine we replaced all reCAPTCHAs with mCaptcha.

realaravinth 3y ago
Author of mCaptcha here o/ mCaptcha uses PoW and that is energy inefficient, but it not as bad as the PoWs used in blockchains. The PoW difficulty factor in mCaptcha is significantly lower than blockchains, where several miners will have to pool their resources to solve a single challenge. In mCaptcha, it takes anywhere between 200ms to 5s to solve a challenge. Which is probably comparable to the energy used to train AI models used in reCAPTCHA. The protection mechanisms used to guard access to the internet must be privacy-respecting and idempotent. mCaptcha isn't perfect, and I'm constantly on the lookout for finding better and cleaner ways to solve this problem.
- bluish29 3y ago
  > Which is probably comparable to the energy used to train AI models used in reCAPTCHA Are you comparing the energy it takes to train a model which is bounded and defined with unbounded inference which can (in principle) go multiple order of magnitude depending on the usage? Or maybe I misunderstood what you are trying to say? then I apologize in advance.
  - realaravinth 3y ago
    I am, but what I said was more of a hypothesis than a fact :) From what I understand of reCAPTCHA, the model isn't static and is continuously learning from every interaction[0]: > reCAPTCHA’s risk-based bot algorithms apply continuous machine learning that factors in every customer and bot interaction to overcome the binary heuristic logic of traditional challenge-based bot detection technologies. I don't know the energy demands of such a system. mCaptcha, under attack situations, will at most take 5s of CPU time on a busy (regular multitasking with multiple background process) smartphone. [0]: https://www.google.com/recaptcha/about/ https://www.google.com/recaptcha/about/