The token should only be valid for one IP, so the scraper has to keep solving challenges if it rotates IPs.

OK, but that doesn't change anything. You have a large pool of IPs, each of which only needs to expend a handful of extra milliseconds of work to get unlimited access to the protected resource.

Even if you had to solve a L6 challenge for every request it's faster than the total RTT time of most servers. In other words not a meaningful barrier. And L6 is already a level which severely interferes with human usage of a site.

a $5000 ASIC-based device can hash SHA256 at 200TH/s or more.

▲

inigyou 3 hours ago | parent | next [-]

The way they're internally implemented doesn't allow pinning an IP. They buy a rotating proxy service from a vendor, and don't get to choose their source IP.

▲

dspillett 2 hours ago | parent | prev | next [-]

> In other words not a meaningful barrier.

And yet many report it works, at least for now, and the excess load due to scraping activity falls precipitously when Anubis or similar solutions are used. Maybe once this sort of challenge is used almost everywhere we'll see concerted attempts to get around it, but for now it is easier for them to just move on to another target.

> a $5000 ASIC-based device can hash SHA256 at 200TH/s or more

Peanuts for the big players, but many (almost all?) running smaller scale scraping operations are going to find $5000 rather prohibitive, and they are unlikely to be able to integrate it as they are probably running a “stock” scraper that they didn't write themselves.

▲

LatticeAnimal 4 hours ago | parent | prev [-]

Some of the asymmetry might be regained if anubis had thousands of variations of PoW algorithms, each different enough that they must be solved independently.

I wonder if AI might be able to come up with new PoW algorithms in a nightly CI job so every day is a different puzzle...

▲

inigyou 3 hours ago | parent | next [-]

You can do this on yours. Just have the client and server add an extra "2" after the challenge key or something. A different client which extracts the challenge key and does its own processing will only generate invalid responses.

	▲	LatticeAnimal 20 minutes ago \| parent [-]
		Cool, so then that invalidates the ASIC problem, right?

▲

CursedSilicon 2 hours ago | parent | prev [-]

...That sounds like entropy? As in, the thing computers are bad at (truly random numbers) and /dev/urandom in your kernel already spits out an approximation of?