Re:Proof of work - an unobtrusive alternative to captchas
by underwater on Friday May 06, 2011 @05:29AM
(#2520459)
Not necessarily. You store which random number you sent to the client in the session on the server. Once it's been solved you invalidate it.
Re:Proof of work - an unobtrusive alternative to captchas
by tomstuart on Friday May 06, 2011 @05:32AM
(#2520462)
How do you know that the response really is the smallest such integer, rather than a precomputed one (e.g. the largest int with a hash beginning "0000")?
Re:Proof of work - an unobtrusive alternative to captchas
by JoachimSchipper on Friday May 06, 2011 @06:14AM
(#2520533)
You don't (have to) care about "the smallest", just "any integer with a hash beginning with 0000".
Re:Proof of work - an unobtrusive alternative to captchas
by tomgallard on Friday May 06, 2011 @06:20AM
(#2520542)
But once the spamming machine has worked that out once, they can submit the same integer every time.
It would be better if the server sent a request saying send me an integer which has a hash beginning with npqr where n, p q and r are all random characters.
The random number would have to be sent from the server, else the same hash could be used every time.
Also MD5 can be easily done on an FPGA at hundreds of millions of tests a second. Other algorithms might be more effective, particularly those which attempt to use large amounts of memory.
Nice idea though.