;]

> IP reputation

my ISP has, it seems, all of their addresses in a blacklist. The ips are also dynamic.

For IP reputation, looking for IPs associated with proxies and also data center IPs though blacklisting all the big cloud providers will grab innocent users. EG: US military runs outbound proxies on azure.

This all for new traffic. Users that are known to be non fraudulent have a unique persistent cookie that allows them to bypass all the checks. So they could jump on a VPN and stuff would work.

Stuff we built for an online bank was even more advanced and looked at the incoming packets to detect proxies(tcp fingerprinting to determine OS). And we did shady stuff with fingerprinting internal networks with WebRTC. Our adversaries were 100 times better than simple carders running selenium scripts.

Requires the browser to complete a Proof of Work challange.

Not for verifying humanness, but against spam / dos attacks.

Is that what this is actually doing though? Is it PoW for a mining operation, or just causing some electrons to be moved around to prove your not a bot? I didn't read too far into what the PoW actually is since their demo shat the bed.

The problem is spam networks have more computers and more power than your phone does so any proof that you can do, spammers can do 1000x faster. PoW can sort of work when your attack to defend against is a ddos situation where an attacker has to make far more requests than the average user, but most captchas try to defend against bots being able to use the site at all which PoW can not do.

"Demo Friendly Captcha in action The form was unable to submit. Please contact the site administrator."

Demo Hell 101. Make sure the demo shows the product working.