Hashcash
Security and privacy
spam prevention
SHOW HN2014
How HN took it
9 positive, 17 neutral or asking, 2 mixed, 33 critical, out of 61 comments about the project. Thread score -0.42.
Idea: 4 for, 14 againstPerformance: 2 for, 8 againstExecution: 1 for, 6 againstDesign: 1 for, 3 againstPricing: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Clever alternative to CAPTCHA that doesn't need human tests.
From 2 comments
Same here. First time in many years that I don't say to myself "bullshit" while looking at a purported solution to the captcha problem. The solution is at once obvious and very…
thibauts on HNThis is the first CAPTCHA replacement that I really like. Adding a delay that costs computing power will both slow down and add real costs to spammers (though if it's a bot net…
buro9 on HN
Works on mobile and is a welcome CAPTCHA replacement.
From 1 comment
I really like that it works fine on my mobile too. Have you done tests on many platforms to show which ones are supported? I'd probably like it to be more automatic... a single…
buro9 on HN
Objections
Botnets and spammers don't pay for CPU time, so the cost barrier is weak.
From 2 comments
How does this stop spammers? Are they supposed to give up because it uses up too much time (and CPU and therefore electricity)? - Botnet operations are hacked PCs. They aren't…
oliwarner on HN> They aren't paying for CPU time. There's still an opportunity cost. Would they prefer to hit a service which limits their machines to a few thousand attempts per day, or a…
falcolas on HN
Slow on phones and drains laptop batteries.
From 2 comments
On top of all this, the fact that hashcash requires the browser to "work hard" means that any website using it will heat up my laptop and drain its battery unnecessarily. Why is…
na85 on HNMy phone took 2 minutes to do the example one.
na85 on HN
GPU or native implementations would be much faster than JavaScript.
From 2 comments
I think the same thing we saw at the beginning of bitcoin would happen here - a GPU implementation would be able to run hundreds of the proofs in parallel. Changing the…
cyounkins on HNI implemented a proof of work system to protect access to a large number of webpages before. The problem is that a native implementation is an order of magnitude faster than the…
mtourne on HN
Hashcash.io becomes a third-party point of failure.
From 1 comment
This isn't a fundamental problem with the idea here, but one thing I don't like is that it makes hashcash.io a point of failure in your form submission. If the site goes down,…
jlebar on HN
Cheap cloud servers make cracking economical.
From 1 comment
I really like the idea, but... I'm not sure it's possible to achieve right kind of cost balance here. Some assumptions at first: every device has to use the same work scaling…
viraptor on HN
Requests
Invite codes for early access.
From 2 comments
Thank you for making it. (I'll beg you for an invite later.) I'd experimented with embedding Javascript Bitcoin miners in my website as a means of monetization without ads. I see…
jo_ on HNWoww. Such clever. Much compile. I've been trying to get Hamiyoca's JS miner to work with mupool without much success. (Stratum is straitforward. I'm just dumb.) p2pool is way…
jo_ on HN
Automatic background calculation instead of manual trigger.
From 2 comments
I really like that it works fine on my mobile too. Have you done tests on many platforms to show which ones are supported? I'd probably like it to be more automatic... a single…
buro9 on HNIf you start calculating the hash in the background, that could be useful. I might not want to wait 100 seconds after I've finished my reply, but I don't imagine I'd mind waiting…
jo_ on HN
Questions
How does this stop spammers who use hacked machines?
From 1 comment
How does this stop spammers? Are they supposed to give up because it uses up too much time (and CPU and therefore electricity)? - Botnet operations are hacked PCs. They aren't…
oliwarner on HN
What is the user experience?
From 1 comment
So what's the user experience??
pbreit on HN
Alternatives named
Rate limiting by IP address.
From 2 comments
As someone with experience in both implementing and bypassing spam protection, this idea makes no sense to me. Let's say it takes the user 30 seconds to calculate proof-of-work.…
vomitcuddle on HNWhat's the advantage of this versus just rate-limiting the number of requests per IP.
phantom784 on HN
Traditional CAPTCHAs.
From 1 comment
How does this stop spammers? Are they supposed to give up because it uses up too much time (and CPU and therefore electricity)? - Botnet operations are hacked PCs. They aren't…
oliwarner on HN
Hashcash in SpamAssassin.
From 1 comment
Recent versions of SpamAssassin already include support for this and subtract (varying amounts of) points for e-mails containing valid Hashcash tokens.
jlgaddis on HN