mCaptcha VS crypto-puzzle

What about proof of work based CAPTCHA like https://github.com/mCaptcha/mCaptcha ? Since CAPTCHAs can be solved by bots, at least make it more costly for them.

That should only be an issue if the server is under attack.

According to the docs (https://github.com/mCaptcha/mCaptcha/blob/master/docs/CONFIG...), you can set three difficulty levels:

MCAPTCHA_CAPTCHA_AVG_TRAFFIC_DIFFICULTY

MCAPTCHA_CAPTCHA_PEAK_TRAFFIC_DIFFICULTY

MCAPTCHA_CAPTCHA_BROKE_MY_SITE_TRAFFIC_DIFFICULTY

It isn't proprietary [0]. There is a matrix channel [1] for the project to ask questions.

[0] https://github.com/mCaptcha/mCaptcha

[1] https://matrix.to/#/@realaravinth:matrix.batsense.net

Funnily enough I've recently implemented [0] a little proof-of-work generator (or more specifically a time-lock puzzle [1] generator), which is the base building block on top which something like this can be built.

It's a very cool idea imo, you generate a cryptographic puzzle that's cheap for you to make, cheap for you to verify if its solved, and potentially cheap-enough for legitimate users to solve, but expensive-enough that users making too many requests would find solving them prohibitively expensive.

I wish something like this was bolted onto email protocols, it would just cost more to be a spammer than it'd be worth it.

Interesting how mCaptcha seems based on sha256, I don't know enough but it would be worth checking how much the algorithm can be sped up with (already existing) dedicated ASICs, if the attacker can solve the puzzle like 10000x faster than normal users you just can't crank the difficulty of the puzzle high enough and for motivated attackers this becomes basically useless. Basing this of on repeated squarings, like the RSW paper on time-lock puzzles did, seems potentially better.

[0]: https://github.com/fabiospampinato/crypto-puzzle

Nice! I had written a little algorithm that one could use to implement something like this (maybe interesting if you want to understand how it could work): https://github.com/fabiospampinato/crypto-puzzle

I think there's something to this, it costs you next to nothing to generate these puzzles and get a guaranteed, tunable, slowdown factor on attackers (or cost increase for them I guess).