News for hackers. Stuff that matters.
Re:Why can’t a bot tick the 'I'm not a robot' box? by xiphias2 on Wednesday February 13, 2019 @02:40PM (#19156121)
They could use a memory-hard hashing function, like ARGON2 for proof of work, it would make spamming much harder.
Re:Why can’t a bot tick the 'I'm not a robot' box? by hombre_fatal on Wednesday February 13, 2019 @02:48PM (#19156232)
Not really, because spam isn't done on the spammer's hardware. Not to mention, an expensive hashing function is precisely something bots can do but humans cannot.

If you're putting constraints on Tor traffic, it's not because of raw throughput. It's because it's extremely poor quality traffic.

Re:Why can’t a bot tick the 'I'm not a robot' box? by xiphias2 on Wednesday February 13, 2019 @03:13PM (#19156496)
I see..the goal of ARGON2 is not to be expensive, but to be hard to parallize. Anyways the other points that you wrote make sense.
Re:Why can’t a bot tick the 'I'm not a robot' box? by Kalium on Wednesday February 13, 2019 @02:44PM (#19156177)
You're absolutely right! It could even be integrated meaningfully into browsers to make it easier to work with. Something Cloudflare's Privacy Pass (https://support.cloudflare.com/hc/en-us/articles/11500199265...) could work.
Re:Why can’t a bot tick the 'I'm not a robot' box? by xiphias2 on Wednesday February 13, 2019 @02:47PM (#19156222)
It looks really nice.

It should be default for the TOR browser for sure, if just a few people use it, it decreases the anonimity set.

Re:Why can’t a bot tick the 'I'm not a robot' box? by Kalium on Wednesday February 13, 2019 @02:51PM (#19156269)
Nah, it was released back in 2017. I've seen it discussed periodically ever since.

The issue with just doing memory-consuming work client-side is that it only marginally slows down spamming. Spammers tend to use compromised machines they don't own. Unless you can make it prohibitively expensive to calculate something using machines you don't pay for - perhaps not a trivial ask - you wind up needing a different set of tools. This is why Google tends to look at things that will exhibit human variation rather than pure computation.

It's not that your ideas aren't good. I'm sure ARGON2 has a use here! It's that this might not be a problem easily solved by consuming more resources.

Re:Why can’t a bot tick the 'I'm not a robot' box? by xiphias2 on Wednesday February 13, 2019 @02:57PM (#19156342)
Cool, I'll try it out the next time I have a problem with using TOR. You're right that ARGON2 doesn't help if CPUs/RAM are free, it just makes parallelization hard.
Re:Why can’t a bot tick the 'I'm not a robot' box? by Kalium on Wednesday February 13, 2019 @04:23PM (#19157162)
Parallelization is easy if you have a botnet of millions of machines owned by others to draw on.