4 ms·

> so really captchas are more like putting a small min amount of effort. At that point a proof of work captcha (mCaptcha.org is one, but there are others), is

> so really captchas are more like putting a small min amount of effort. At that point a proof of work captcha (mCaptcha.org is one, but there are others), is probably the best option. Especially with how any reasonably effective traditional captcha is an accessibility nightmare.

cubefox 2y ago
It's completely unclear what a "proof of work" captchas is supposed to be.
- porridgeraisin 2y ago
  Brave search uses it. From my limited understanding, it sends a time-consuming javascript function and its input to your browser, and has your browser calculate the output and send it back. The server matches your output with the expected output. I assume the server would pre-compute in some way? On the spectrum, it leans more towards being a spam-alleviating thing rather than a human-distinguishing thing.
  - porridgeraisin 2y ago
    > pre-compute Or it could be a SAT or something that's easy to verify and hard to solve.
    - shreyshnaccount 2y ago
      id think its some kind of proof of sequential work, basically an un-parallelizable calculation that is guaranteed to take a certain number of steps, and making solving thousands of them much harder and hopefully not worth it
- jamesnorden 2y ago
  It's CPU intensive JS code that must run to get an output that must match something server-side, the idea is that it makes attacks/spam not economically viable to run.
  - hombre_fatal 2y ago
    The problem is that it doesn’t do anything. Maybe you slightly slow down a volumetric spam attack, but you’re just putting a sleep() before letting spam through which might be the worst solution. As for economic viability, it’s still just a sleep(). Even if it somehow did cost extra money to use more of the CPU, botnets don’t even use their own hardware. And if you make the PoW so hard that it takes very very long to solve then you basically made a captcha that bots have no problem doing (it’s just time) and humans don’t want to do at all especially on their phone.
- marcosdumay 2y ago
  Almost always it's some variation of "give me a string with the SHA256 hash starting with 0.a471"

cubefox 2y ago

It's completely unclear what a "proof of work" captchas is supposed to be.

porridgeraisin 2y ago
Brave search uses it. From my limited understanding, it sends a time-consuming javascript function and its input to your browser, and has your browser calculate the output and send it back. The server matches your output with the expected output. I assume the server would pre-compute in some way? On the spectrum, it leans more towards being a spam-alleviating thing rather than a human-distinguishing thing.
- porridgeraisin 2y ago
  > pre-compute Or it could be a SAT or something that's easy to verify and hard to solve.
  - shreyshnaccount 2y ago
    id think its some kind of proof of sequential work, basically an un-parallelizable calculation that is guaranteed to take a certain number of steps, and making solving thousands of them much harder and hopefully not worth it
jamesnorden 2y ago
It's CPU intensive JS code that must run to get an output that must match something server-side, the idea is that it makes attacks/spam not economically viable to run.
- hombre_fatal 2y ago
  The problem is that it doesn’t do anything. Maybe you slightly slow down a volumetric spam attack, but you’re just putting a sleep() before letting spam through which might be the worst solution. As for economic viability, it’s still just a sleep(). Even if it somehow did cost extra money to use more of the CPU, botnets don’t even use their own hardware. And if you make the PoW so hard that it takes very very long to solve then you basically made a captcha that bots have no problem doing (it’s just time) and humans don’t want to do at all especially on their phone.
marcosdumay 2y ago
Almost always it's some variation of "give me a string with the SHA256 hash starting with 0.a471"