5 ms·

I actually much prefer this. Its only a small amount of CPU, negligible to your electricity bill, but it doesn't involve clicking every traffic light.

sneak 5y ago
It fails to be an automated test to tell computers and humans apart, as computers are more than capable of solving proofs of work without human intervention.
- jacoblambda 5y ago
  This is true but so are the existing captchas. Existing captchas are just harvesting training data for Google's self driving vehicles at this point. With a PoW captcha, it doesn't matter how smart you make your algorithm, it's still going to be slow. With existing systems I'd argue it's probably a lot slower for people than for machines, especially since it's people guessing what a machine thinks people would classify an image as. This is an easy solution for rate limiting low trust/high risk connections and better software isn't going to magically make it any faster. This has always been what captchas aim to accomplish.
- Pxtl 5y ago
  Because we're accepting failure on that front. Instead, it's providing rate-limiting. Hell, charge me one penny per refresh and a dime per tweet and login attempt. Then let the bots run freely if they're willing to pay that rate.
EGreg 5y ago
This is practically useless, since desktop computers doing some work can be easily eclipsed by a specialized hardware doing it for spammers and sybil attackers.
itake 5y ago
I'd be curious how well this performs on an older mobile device vs new CPU. Seems like this might exclude users lower-end electronics that might be low-income.
- ReactiveJelly 5y ago
  If it automatically scales based on current traffic, that might not matter. You can have it turn itself off during a normal "1 request per minute" day on a small blog and then crank up to "A new CPU needs 2 seconds" during a DDOS. Use token bucket or leaky bucket or whatever so a few normal users clicking around for 10 minutes won't trigger it, but after a while the server runs out of patience if they keep making requests faster.
- forestjohnson 5y ago
  Hi, developer here, there is a table showing hashes per second on various devices at the bottom of the readme. My laptop (thinkpad t480s) = 70h/s, my phone (motorolla g7) = 12h/s. Its not so bad on the phone. The site owner can tweak the difficulty for whatever lowest common denominator they want.

sneak 5y ago

It fails to be an automated test to tell computers and humans apart, as computers are more than capable of solving proofs of work without human intervention.

jacoblambda 5y ago
This is true but so are the existing captchas. Existing captchas are just harvesting training data for Google's self driving vehicles at this point. With a PoW captcha, it doesn't matter how smart you make your algorithm, it's still going to be slow. With existing systems I'd argue it's probably a lot slower for people than for machines, especially since it's people guessing what a machine thinks people would classify an image as. This is an easy solution for rate limiting low trust/high risk connections and better software isn't going to magically make it any faster. This has always been what captchas aim to accomplish.
Pxtl 5y ago
Because we're accepting failure on that front. Instead, it's providing rate-limiting. Hell, charge me one penny per refresh and a dime per tweet and login attempt. Then let the bots run freely if they're willing to pay that rate.

EGreg 5y ago

This is practically useless, since desktop computers doing some work can be easily eclipsed by a specialized hardware doing it for spammers and sybil attackers.

itake 5y ago

I'd be curious how well this performs on an older mobile device vs new CPU. Seems like this might exclude users lower-end electronics that might be low-income.

ReactiveJelly 5y ago
If it automatically scales based on current traffic, that might not matter. You can have it turn itself off during a normal "1 request per minute" day on a small blog and then crank up to "A new CPU needs 2 seconds" during a DDOS. Use token bucket or leaky bucket or whatever so a few normal users clicking around for 10 minutes won't trigger it, but after a while the server runs out of patience if they keep making requests faster.
forestjohnson 5y ago
Hi, developer here, there is a table showing hashes per second on various devices at the bottom of the readme. My laptop (thinkpad t480s) = 70h/s, my phone (motorolla g7) = 12h/s. Its not so bad on the phone. The site owner can tweak the difficulty for whatever lowest common denominator they want.