←back to thread

The internet is no longer a safe haven

(brainbaking.com)
253 points akyuu | 4 comments | 16 Nov 25 13:12 UTC | HN request time: 0.001s | source
Show context
bo1024 ◴[16 Nov 25 16:18 UTC] No.45946196[source]▶
I wonder if a proof of work protocol is a viable solution. To GET the page, you have to spend enough electricity to solve a puzzle. The question is whether the threshold could be low enough for typical people on their phones to access the site easily, but high enough that mass scraping is significantly reduced.
replies(3): >>45946275 #>>45946380 #>>45946409 #
1. IshKebab ◴[16 Nov 25 16:43 UTC] No.45946409[source]▶
I feel like it could work. If you think about it, you need the cost to the client to be greater than the cost to the server. As long as that is true the server shouldn't mind about increased traffic because it's making a profit!

Very crudely if you think that a request costs the server ~10ms of compute time and a phone is 30x slower then you'd need 300ms of client compute time to equal it which seems very reasonable.

The only problem is you would need a cryptocurrency that a) lets you verify tiny chunks of work, and b) can't be done faster than you can do it on a phone using other hardware, and c) lets a client mine money without being to actually spend it ("homomorphic mining"?).

I don't know if anything like that exists but it would be an interesting problem to solve.

replies(2): >>45947119 #>>45949582 #
2. beeflet ◴[16 Nov 25 18:13 UTC] No.45947119[source]▶
The problem is that the attacker isn't using a phone, they are using some type of specialized hardware.

I still think it is possible with some customized variant of RandomX. The server could even make a bit of money by acting as a mining pool by forcing the clients to mine a certain block template. It's just that it would need to be installed as a browser plugin or something, it wouldn't be efficient running within a page.

Also the verification process for RandomX is still pretty intensive. so there is a high minimum bar for where it would be feasible.

replies(1): >>45951502 #
3. bo1024 ◴[16 Nov 25 23:48 UTC] No.45949582[source]▶
I wasn't picturing collecting payments from visitors (presumably with cryptocurrency), but instead just asking visitors to burn energy. It would be socially better to collect payments, but we can't assume every visitor is set up with a cryptocurrency wallet.
4. IshKebab ◴[17 Nov 25 07:20 UTC] No.45951502[source]▶
> The problem is that the attacker isn't using a phone, they are using some type of specialized hardware.

Yeah I covered that in b) in my comment.