mCaptcha

Image CAPTCHAs cost every honest visitor a few seconds of attention and cost an attacker almost nothing. mCaptcha inverts that trade, shifting the cost onto the visitor's computer instead of the visitor. It uses SHA256 proof of work to make hammering a site more expensive for the sender than answering is for the server.

A user clicks once, the browser computes a proof, and mCaptcha validates it. A valid proof returns a token the user submits with the request, and the target site verifies that token before doing any work of its own. Difficulty is variable, so a well-behaved visitor sees no delay under moderate load and up to about two seconds when a site is under attack. Apart from that click, the exchange is automatic.

The design follows from putting the cost on the client rather than on identifying anyone.

• No tracking: the CAPTCHA routes are cookie free.
• IP address independent: visitors behind NAT are handled without being punished for a shared address.
• Replay resistant: proof of work configurations live for 30 seconds and are accepted only once.
• Variable difficulty: the work demanded rises with load rather than being fixed.
• Self-hostable: a clone and a docker-compose command bring the service up on port 7000.

Two demo servers are public, one running on a Raspberry Pi, which gives a fair sense of the server-side cost. The project calls itself active development with no stable release yet, so hosted demos may trail master. Development during 2023 was funded through the NGI Zero Entrust Fund via NLnet.