10 ms·

How does this stop spammers? Are they supposed to give up because it uses up too much time (and CPU and therefore electricity)? - Botnet operations are hacked

How does this stop spammers? Are they supposed to give up because it uses up too much time (and CPU and therefore electricity)? - Botnet operations are hacked PCs. They aren't paying for CPU time. - Low-rent spammers often use hacked or rented servers. They aren't paying for CPU time. - Even I don't pay for CPU load on my VPS. This won't stop spam. Simple as that. You might get money from this but you're also going to keep getting spam. Oh and you'll chronically annoy everybody on a slow computer who doesn't want to wait. Compare it to this $0.70/1000 for CAPTCHAs. That's really expensive because it's real money. It also takes time. It also doesn't guarantee posting (many sites have secondary spam-detection features) which might mean 90% are insta-deleted, 5% are held for moderation and only 5% make it through. $0.014/post is actually pretty expensive. Much more than they're spending to get past you.

tomjen3 12y ago
If they rent access to cheap vps boxes then they are effectively buying posts at whatever rate they pay for the vps / however many posts they can get out - so making posting more time consuming also means they get less out of their vps so the cost per post is much higher.
- opendais 12y ago
  As the parent said, they don't rent. They break low security boxes / poorly secured boxes and use their cpu cycles for $0 + opportunity cost of the hack.
falcolas 12y ago
> They aren't paying for CPU time. There's still an opportunity cost. Would they prefer to hit a service which limits their machines to a few thousand attempts per day, or a service which does not and lets them put through several million attempts per day? > Even I don't pay for CPU load on my VPS. Perhaps not, but it sets a hard limit on how much you can do in a given time period. > That's really expensive because it's real money. If they're stealing computer time via a botnet, they're probably not going to be paying Amazon Turk with their own credit card.
- bitJericho 12y ago
  Good point. In a closed community, you could ask users to wait 60 seconds to register/login/etc, or they could pay 10 bucks a year for instant access all the time (plus perks since most people wouldn't care about the wait once in a while). This could be used by those downloader sites that make users wait.
na85 12y ago
On top of all this, the fact that hashcash requires the browser to "work hard" means that any website using it will heat up my laptop and drain its battery unnecessarily. Why is that a good thing?
- brokentone 12y ago
  Would you rather type a captcha?
  - beachwood23 12y ago
    Yes, I would actually. I can do a CAPTCHA in about 5 seconds, whereas generating the proof-of-work took around 10 seconds on my computer.
  - na85 12y ago
    Absolutely.
- hippich 12y ago
  if you laptop solves this in 10 seconds and you need to post 10 messages a day, it is under 2 minutes of working hard for your laptop. I doubt it will make a dent in your battery life
  - ozten 12y ago
    > and you need to post 10 messages a day Showing a captcha each time, for a repetitive task would be a horrible UX decision.
    - hippich 12y ago
      I guess this would depend on how bad situation with spam is on specific site. Just like showing CAPTCHA only once you could do showing hashcash widget only once...
  - na85 12y ago
    My phone took 2 minutes to do the example one.
lmkg 12y ago
It changes the economics. If your botnet used to be able to post a million spams per second, and now it can only do a thousand, then now you're making 99.9% less money from renting out your botnet compared to last week. The fact that your botnet cost $0 of monetary transactions to acquire and retain doesn't factor into it. Botnets may not have a marginal cost, but they still have a limited supply, and a demand for their use, which determined the cost to consumers. If they are less effective per time on spamming, either the cost of spamming will increase, or botnet operators will shift into other more profitable verticals.
- comex 12y ago
  But if the alternative is solving CAPTCHAs by paying real money, then the question is whether the hackers can spend less money to run the hashcash instances on EC2 - they don't have to actually run the computations on the botnet computers.
  - 3pt14159 12y ago
    The alternative is that botnets can inject html in a man in the middle attack and get real users to solve useless CAPTCHAs anyway. For example, when a user goes to yahoo.com a temporary page may show up that says "due to increased spammers, we need to you do enter a CAPTCHA to prove you are not a bot. So the user enters the CAPTCHA, then some other botted computer enters it in the real webform. Basically these types of measures are stupid because any virused computer can be made to do them anyway this is why CAPTCHAs are only 70 cents / 1000, it isn't because people in India are lining up to enter CAPTCHAs at an Indian minimum wage.
    - comex 12y ago
      If you do that, then you're only going to get the user to solve a few CAPTCHAs per pwned computer per day (maybe 20 or so if you make it really mean). If that's all you want, this hashcash implementation won't be an obstacle either, but that's a far cry from a million spams a second.
    - jlebar 12y ago
jsilence 12y ago
"That's really expensive because it's real money" Letting my mind go wild and wondering whether it would make sense to let visitors actually pay for the login. This could be DOGE-Coins for example. One could set up a DOGE-faucet and give back the WOWness. Is that idea totally dumb or does it make any sense? Would love to read your opinion.
- rjaco31 12y ago
  That would be pretty swaggy, but as parent comment said, if it's cheap enough for the spammers, it would be way more annoying for your lambda user than effective against spam.

tomjen3 12y ago

If they rent access to cheap vps boxes then they are effectively buying posts at whatever rate they pay for the vps / however many posts they can get out - so making posting more time consuming also means they get less out of their vps so the cost per post is much higher.

opendais 12y ago
As the parent said, they don't rent. They break low security boxes / poorly secured boxes and use their cpu cycles for $0 + opportunity cost of the hack.

falcolas 12y ago

> They aren't paying for CPU time. There's still an opportunity cost. Would they prefer to hit a service which limits their machines to a few thousand attempts per day, or a service which does not and lets them put through several million attempts per day? > Even I don't pay for CPU load on my VPS. Perhaps not, but it sets a hard limit on how much you can do in a given time period. > That's really expensive because it's real money. If they're stealing computer time via a botnet, they're probably not going to be paying Amazon Turk with their own credit card.

bitJericho 12y ago
Good point. In a closed community, you could ask users to wait 60 seconds to register/login/etc, or they could pay 10 bucks a year for instant access all the time (plus perks since most people wouldn't care about the wait once in a while). This could be used by those downloader sites that make users wait.

na85 12y ago

On top of all this, the fact that hashcash requires the browser to "work hard" means that any website using it will heat up my laptop and drain its battery unnecessarily. Why is that a good thing?

brokentone 12y ago
Would you rather type a captcha?
- beachwood23 12y ago
  Yes, I would actually. I can do a CAPTCHA in about 5 seconds, whereas generating the proof-of-work took around 10 seconds on my computer.
- na85 12y ago
  Absolutely.
hippich 12y ago
if you laptop solves this in 10 seconds and you need to post 10 messages a day, it is under 2 minutes of working hard for your laptop. I doubt it will make a dent in your battery life
- ozten 12y ago
  > and you need to post 10 messages a day Showing a captcha each time, for a repetitive task would be a horrible UX decision.
  - hippich 12y ago
    I guess this would depend on how bad situation with spam is on specific site. Just like showing CAPTCHA only once you could do showing hashcash widget only once...
- na85 12y ago
  My phone took 2 minutes to do the example one.

lmkg 12y ago

It changes the economics. If your botnet used to be able to post a million spams per second, and now it can only do a thousand, then now you're making 99.9% less money from renting out your botnet compared to last week. The fact that your botnet cost $0 of monetary transactions to acquire and retain doesn't factor into it. Botnets may not have a marginal cost, but they still have a limited supply, and a demand for their use, which determined the cost to consumers. If they are less effective per time on spamming, either the cost of spamming will increase, or botnet operators will shift into other more profitable verticals.

comex 12y ago
But if the alternative is solving CAPTCHAs by paying real money, then the question is whether the hackers can spend less money to run the hashcash instances on EC2 - they don't have to actually run the computations on the botnet computers.
- 3pt14159 12y ago
  The alternative is that botnets can inject html in a man in the middle attack and get real users to solve useless CAPTCHAs anyway. For example, when a user goes to yahoo.com a temporary page may show up that says "due to increased spammers, we need to you do enter a CAPTCHA to prove you are not a bot. So the user enters the CAPTCHA, then some other botted computer enters it in the real webform. Basically these types of measures are stupid because any virused computer can be made to do them anyway this is why CAPTCHAs are only 70 cents / 1000, it isn't because people in India are lining up to enter CAPTCHAs at an Indian minimum wage.
  - comex 12y ago
    If you do that, then you're only going to get the user to solve a few CAPTCHAs per pwned computer per day (maybe 20 or so if you make it really mean). If that's all you want, this hashcash implementation won't be an obstacle either, but that's a far cry from a million spams a second.
  - jlebar 12y ago

jsilence 12y ago

"That's really expensive because it's real money" Letting my mind go wild and wondering whether it would make sense to let visitors actually pay for the login. This could be DOGE-Coins for example. One could set up a DOGE-faucet and give back the WOWness. Is that idea totally dumb or does it make any sense? Would love to read your opinion.

rjaco31 12y ago
That would be pretty swaggy, but as parent comment said, if it's cheap enough for the spammers, it would be way more annoying for your lambda user than effective against spam.