Hacker News Reader

Comment by kazinator | Hacker News Reader

Why do we need work? Since no valuable work product is being made, proof of work is really just a proxy for proof of elapsed time.

The animated demo shows this perfectly. The bar which is showing the progress in the proof of work could just be a simple timer, and it would look exactly the same.

The back end generates the page, and makes a note of the current time. Then it doesn't accept the submission until N seconds have passed since that time. The animated bar on the front end is just for show; the browser isn't what is enforcing it.

Proof of elapsed time requires nothing from the other party. If I want proof that you spent at least 30 seconds waiting from the moment I gave you some starting signal, the only evidence I need to trust are the readings of my own stopwatch.

View on HN

Captchas are there to prevent bots which are making thousands or millions of submissions. With a timer the bot just needs to make all of the captcha requests first and then wait 30 seconds for all of the timers to expire in parallel. But with proof of work the spammer actually needs to compute all of the work for every submission, which would require a significant amount of computational power, rendering some types of bots uneconomical to run.

Excellent point! It's not hard for a single attacking context to have the resources to generate vast numbers of requests in parallel. If a botnet is involved, it can use different originating IP addresses.

And so, that's why we need proof of work; thank you for bringing my derailed narrative back on the proper technical track.

You're leaving the implementation of your uncheatable POET as an exercise to the reader it seems.

> makes a note of the current time

Makes a note where exactly? In a data store? That means that I'm allowing an untrusted entity to trigger an action that requires me to store and later query my data store. That's a bad idea. The whole reason to have a captcha at all is to stop bots from overloading your system. The data store is a major bottle neck in most systems.

Proof of work is stateless. It's fast to verify. If you sign the challenge input before giving it to the user, you can also statelessly verify it's a legit challenge. No data store needed until after verification is complete.

Edit: also what ahsima said! The point of a captcha is to make it more expensive to use a bot net against you. Timers don't do that.

Another excellent point! A correct implementation of proof of work means that we can hand off some (relatively) cheaply generated cookie and then maintain no state in relation to that while the answer is being calculated on the other end.

This stateless principle is implemented in TCP SYN cookies for warding off SYN flood attacks, for instance.

Thank you, also.

An 8-byte timestamp is not a lot of state. You could have a million concurrent connections and use only 8 MB for a file descriptor -> timestamp lookup table. The TCP send/receive buffers will exhaust your system memory long before the timestamps do.

You need a datastore anyway to prevent replay attacks.

Reply on news.ycombinator.com