3 ms·
So this is a basically a shill advertisement ending in "Your AI Agents can avoid captchas if you pay us." The last example is a false narrative, that captchas
by netik 3mo ago
So this is a basically a shill advertisement ending in "Your AI Agents can avoid captchas if you pay us."
The last example is a false narrative, that captchas will only happen if the "browser looks suspicious". Systems like Altcha put an end to this argument. They don't care if the browser looks suspicious, only that the browser can perform a proof-of-work to get past a captcha designed to slow down the request rate.
When applied consistently, it will effectively block and slow down AI crawlers, which is what this company wants to promote.
- gruez 3mo ago>Systems like Altcha put an end to this argument. They don't care if the browser looks suspicious, only that the browser can perform a proof-of-work to get past a captcha designed to slow down the request rate. That doesn't really work out in reality because bots are happy to wait 5 seconds or even 5 minutes for a PoW challenge to complete. Humans on the other hand will not, especially if they're on a mobile device with limited compute and energy.
- chrismorgan 3mo agoProof-of-work is bad rate limiting: https://news.ycombinator.com/item?id=44093918 https://news.ycombinator.com/item?id=44093918. The playing field is wildly unbalanced. Even naive attackers tend to have a lot more computing power available than a lot of your normal users, and where it’s SHA-256 (which is almost the worst choice imaginable for a proof of work scheme, yet which every single service that I know of has used), an intelligent attacker goes from being hundreds of times as powerful to millions of times as powerful.
- netik 3mo agoI agree with this assessment but for many applications it's a viable approach, until the attacker goes off and writes their own shader to solve the PoW. We go to back to threat modeling here, and looking at the amount of effort vs gain here. They're now integrating Argon2ID in an attempt to squash GPU hacks but it places ridiculous demands on the client being Memory hard.
- ameliaquining 3mo agoThis seems like the real mechanism here is not actually proof-of-work so much as security-through-obscurity.
- CodesInChaos 3mo agoDid they evaluate good old bcrypt? I haven't looked at it in a while, but it used to be very GPU unfriendly (though still vulnerable to FPGA/ASIC).
- peeet 3mo agoMore advanced and targeted bots can "bypass" Proof of work as well though, e.g. using something like https://github.com/toman-tom/Incapsula-PoW https://github.com/toman-tom/Incapsula-PoW
- pentacent_hq 3mo agoDo you have real-world experience deploying PoW captchas? I'd love to give them a try but I'm worried my forms will end up getting overwhelmed with spam if I switch away from hCaptcha.