privymail.eu

A computational puzzle instead of a CAPTCHA service

How privymail.eu slows down automatically created accounts without giving visitor data to third parties, and what a puzzle cannot do.

The form through which an account is created at privymail.eu shows no picture puzzle and embeds no third-party service. Instead, the browser solves a computational puzzle that our own service issues and checks. The method is called ALTCHA.

The usual doorman is watching, too

A form on the internet attracts programs that submit it in bulk. For a mail service that is more than a nuisance: mailboxes created in bulk are used to send spam, and that harms delivery for everyone else.

The usual defence is a third party's CAPTCHA service, a check that tries to tell humans from programs. For that, the browser loads program code from that party's servers. The third party learns at least the IP address and the page the form is on; some of these services also analyse how someone behaves in the browser. privymail.eu therefore embeds no third-party CAPTCHA service. We do not ask for a phone number as proof either; the post Why we do not use SMS codes gives the reasons.

Work instead of information

ALTCHA does not ask the browser for information about the person in front of it, but for work. The sequence has four steps:

  1. Fetch a puzzle. The browser asks our service for a puzzle. It is signed with a key of the service, expires after a short time and is valid for this one purpose only.
  2. Compute. The browser tries number after number and runs a deliberately expensive calculation with each, until the result has the required beginning. For a single form that is a short wait; for very many forms it is a bill that someone has to pay.
  3. Send the solution along. The solution goes to our service together with the form.
  4. Check and invalidate. The service checks signature, purpose, expiry and solution and marks the puzzle as used. A solution is valid exactly once.

The order of the checks is deliberate. Before the service invalidates a solution, it checks how the address is written; a typing error therefore does not cost a solved puzzle. Whether an address is already taken, by contrast, is revealed only to someone who has solved a puzzle. That way the form does not become a cheap tool for trying out addresses.

What does not happen along the way: the page talks to no third-party server. The puzzle, the check and the small program that does the computing all come from us. For a solved puzzle, the service remembers only its signature, and only until the puzzle would have expired. It contains no link to a person.

The program is the official ALTCHA widget, free software under the MIT licence. In its default setting it records pointer movements, key presses and focus changes and sends them if a service asks for them. Our service never asks, and our integration additionally switches the recording off.

What it costs

  • Waiting time. The computation takes time, more on slow devices than on fast ones.
  • JavaScript. The puzzle needs program code in the browser. This website does without JavaScript; the form cannot.
  • Other people's code in our care. The widget is free software from a project with a single maintainer, that is, one person who looks after it. We serve the file ourselves and pin its version and checksum.
  • One more key. The service signs every puzzle. Anyone who had the signing key could issue puzzles for themselves; then only the limits would slow them down.

What it does not solve

  • It does not prove a human. Any computer can solve the puzzle, including a remote-controlled browser. It makes bulk expensive, not impossible: whoever pays for enough computing time gets through.
  • It slows down account creation, not the abuse afterwards. No puzzle stops what an existing account does. That takes other means.
  • It does not replace limits. The puzzle stands alongside the limits per origin, not in their place.
  • It does not decide what the browser does. Our page calls no third-party servers. What a browser does on its own on the side, such as connections to its maker, is not in the hands of the website.

Further reading