undefined | Better HN

0 pointscubefox1y ago0 comments

It's completely unclear what a "proof of work" captchas is supposed to be.

0 comments

It's CPU intensive JS code that must run to get an output that must match something server-side, the idea is that it makes attacks/spam not economically viable to run.

hombre_fatal1y ago

The problem is that it doesn’t do anything. Maybe you slightly slow down a volumetric spam attack, but you’re just putting a sleep() before letting spam through which might be the worst solution. As for economic viability, it’s still just a sleep(). Even if it somehow did cost extra money to use more of the CPU, botnets don’t even use their own hardware.

And if you make the PoW so hard that it takes very very long to solve then you basically made a captcha that bots have no problem doing (it’s just time) and humans don’t want to do at all especially on their phone.

porridgeraisin1y ago

Brave search uses it. From my limited understanding, it sends a time-consuming javascript function and its input to your browser, and has your browser calculate the output and send it back. The server matches your output with the expected output. I assume the server would pre-compute in some way? On the spectrum, it leans more towards being a spam-alleviating thing rather than a human-distinguishing thing.

porridgeraisin1y ago

> pre-compute

Or it could be a SAT or something that's easy to verify and hard to solve.

shreyshnaccount1y ago

id think its some kind of proof of sequential work, basically an un-parallelizable calculation that is guaranteed to take a certain number of steps, and making solving thousands of them much harder and hopefully not worth it

marcosdumay1y ago

Almost always it's some variation of "give me a string with the SHA256 hash starting with 0.a471"

j / k navigate · click thread line to collapse

0 comments

jamesnorden1y ago

It's CPU intensive JS code that must run to get an output that must match something server-side, the idea is that it makes attacks/spam not economically viable to run.

hombre_fatal1y ago

porridgeraisin1y ago

> pre-compute

Or it could be a SAT or something that's easy to verify and hard to solve.

shreyshnaccount1y ago

marcosdumay1y ago

Almost always it's some variation of "give me a string with the SHA256 hash starting with 0.a471"

j / k navigate · click thread line to collapse