A couple of questions

[binaryfire]

Hi @realaravinth. Thanks for creating and open-sourcing this great project! I build websites for clients and have been looking for a good alternative to reCaptcha. I have a couple of questions:

1. Am I understanding correctly that the workload is only initiated when the verify checkbox is ticked? So say I have a landing page that contains a form with mCaptcha - will the initial page load time / page RPS be affected at all? I'm assuming it won't be and that the rate limiting is only applied when the user interacts with the checkbox, but I just want to confirm.

2. What are the time periods for "Average traffic", "Maximum traffic" and "Traffic that broke your website"? Is is visits per hour, day or month?

3. When developing sites for clients, it's often difficult to know how much traffic their sites receive. Not everyone uses analytics and I normally don't have time to track and fine-tune things per-client. Can you suggest a good general setting for "Average traffic", "Maximum traffic" and "Traffic that broke your website" that would work for most average sites?

Thanks!

[SebastianGode]

Maybe I can answer as well.

1. Yes, only if the checkbox is checked. Initial load time might be affected if you load the iFrame not asynchronous. But that wouldn't be the default browser behavior.
2. You can specify those periods by yourself in this line: https://github.com/mCaptcha/mCaptcha/blob/master/config/default.toml#L42
3. That is also my question. Generally you can specify it also on per-site-basis when creating the sitekey, but I also haven't found a good value yet. For a contact formular it can in my opinion take 5s (as long as it can be auto-triggered Feature Request: Autostart solving captcha with a trigger (React) glue#73) and that will already be quite significant for spam reduction. The default values would be way too low for that imo

[realaravinth]

Thanks for the response @SebastianGode <3

I have some additions:

2. As mentioned above, the duration is configurable by the sysadmin only. If you'd like to control it, then kindly switch to the advanced option

3. As @SebastianGode suggests, I recommend using a high difficulty factor for now. There's a lot of confusion regarding configuring mCaptcha. It makes me wonder if adding an algorithm to auto-configure and self-optimize will be useful.

[binaryfire]

@SebastianGode @realaravinth Thanks for the info guys!

@realaravinth I'm also working on a website builder platform and that's where I'd be most interested in using mCaptcha. New sites will be provisioned using automation and it won't be easy to customize / monitor / fine-tune individual site's settings. So an auto-configure option or a decent "one-size-fits-all" setting that works for the majority of sites would be great.

My concern with auto-configuration / self-optimization is scalability and the impact on page speed. Tracking the number of page visits for 100s of sites would require much higher server resources. And analytics scripts that do this (eg. Google Analytics) can have a negative impact on page speed, so adding another one that does the same thing to every page wouldn't be good.

It'd be interesting to know how FriendlyCaptcha handles this, since they're also using PoW.

[realaravinth]

mCaptcha has all the necessary bits to self-optimize, so it won't be too demanding on the server resources.

[SebastianGode]

The thing is, what exactly is a "high difficulty factor"? So what would be like 5s solve time?
Also do I need to set it on both the .toml file (or environment for Docker) and the sitekey or is one setting enough?

[realaravinth]

I understand your frustrations. I conducted some experiments to measure difficulty factors' behavior in general:

large graph (image file)

Raw data used to plot the graph above

and how they vary across devices on the internet:

large graph (image file)

I'll publish a docs and blog posts based on these experiments soon, which I hope will help people work with difficulty factors efficiently.

---

Additionally, I'm also thinking of adding time based configurations. mCaptcha currently logs PoW performance and is able to do some basic analysis on it (for example: find difficulty factor whose 90th percentile of all logged solution times is <= 5s). But this requires further thought.

[SebastianGode]

@realaravinth Thanks for the research! Could you try reuploading the first picture? It isn't loading for me.

Also what I noticed is that the actual compute time for the captchas varies significantly even on the same device. If I enter 10000000 as diffculty factor, sometimes it is solved in a second and sometimes it takes 5s. Seems like the factor might not be used on each request for me, like some kind of bug.

[realaravinth]

The above files are available for your reference here

Also what I noticed is that the actual compute time for the captchas varies significantly even on the same device. If I enter 10000000 as diffculty factor, sometimes it is solved in a second and sometimes it takes 5s. Seems like the factor might not be used on each request for me, like some kind of bug.

AFAIK, there isn't any bug in the PoW logic. There are multiple tests to verify that PoW compute time increases proportionally to difficulty factor. But recent experiments suggested that PoW time is affected by challenge phrase as well --- something the tests don't account for.

I computed PoWs for difficulty factors ranging from 5,000 to 50 million and the result showed that wildly varies too. While the results are very spread out, the mean of the results show that there is a steady increase in compute time.

In real world scenarios, where we have to rotate salt frequently, and use unique challenge phrases for every request, PoW compute time becomes very difficult to predict. I'm investigating ways to stabilize this, but I don't have any ideas at the moment.