Hacker News new | ask | show | jobs
by cedws 3 days ago
The cost is nothing. The browser implementation is too slow, mobile devices are too slow, and hash algorithms with hardware acceleration are too fast. You can’t balance these three constraints in a way that only keeps out the bad guys.

The hashing is just elaborate obfuscation. Anubis uses SHA256 which isn’t ASIC-resistant, and thanks to Bitcoin you could probably buy one off the shelf.
1 comments
eqvinox 3 days ago
and yet, it works.
link
cedws 2 days ago
The hashing has nothing to do with it. It's just an arbitrary hoop for clients to jump through that filters out the bots that haven't implemented that hoop. So why not just use the client's fingerprint and call it a day? Use their canvas or JA3 fingerprint and I'm willing to bet it would be just as effective.
link
eqvinox 1 day ago
It's impossible to know without trying, but I suspect those checks would be too easy to bypass/fake in a crawler.

You can submit a PR and then we can try…

link
cedws 1 day ago
Most scrapers are unsophisticated, this is why Anubis "works." For this same reason, basic fingerprinting already employed by Cloudflare et al would have the same efficacy.
link