WebHashcash — The End of Comment Spam

I am pleased today to announce WebHashcash (based on Hashcash by Adam Back), a fundamentally new mechanism for preventing spam on web sites of all kinds: blogs, discussion forums, wikis, and more. It guards against automated content posting, fake user registration, and ballot stuffing.

Astute visitors to my blog may have noticed for the past month a subtle little doodad on the comment submission form. That's WebHashcash functioning. While it's running, your CPU is maxed out, and when it's done (after a couple seconds), it will have generated an invisible "stamp" which it attached to your message, proving that your computer invested effort in generating the stamp. It is computationally infeasible to fake such a stamp — its presence proves an investment in CPU time.

The basic idea is that spammers only spam because it's so cheap to do so. The value of a spam posting to a spammer is far below the value of a legitimate posting to its author. Thus, it's possible to set a "postage" that's well below the value of legitimate postings, but above the value of spam. You therefore destroy the economics of spamming by requiring a negligible but real expenditure for each message.

This is qualitatively different from every other anti-spam mechanism in existence today. The basic concept behind virtually all other systems is to create some sort of "Turing test" which humans can pass but computers fail at. This typically involves optical character recognition, or responses to challenge questions. The problem with this approach is that it entails a constant arms race — as spambots become more intelligent, the anti-spam programs must be improved as well. There is no clear winner, and the trend seems to be favoring the spammers.

Enter WebHashcash. Unlike traditional anti-spam mechanisms, no attempt is made to actually prevent spammers from posting. But they have to pay the cost. And no spammer will, because it would bankrupt them to do so.

Since I introduced WebHashcash on my blog one month ago, it has blocked 670 out of 734 spam comments. The remaining 64 comments were exceptionally easy to delete as they all came from the same source. Furthermore, the spammers spent several minutes of CPU time in total in order to post the comments. If WebHashcash were in widespread use, spammers would quickly run out of CPU power attempting to post on WebHashcash-powered sites.

Please check out the WebHashcash web site for more information and for instructions on how to install it onto your web site.

I'm also interested in hearing your thoughts. Please post them here!

Just passing through, so I figured I'd give my $.02.

I disable Java at all times. It makes webpages load significantly slower and generally serves no purpose in normal web surfing. Don't get me wrong, some applets are useful, but there's still people using those lame ripple applets *shudder*. On top of that, the JRE that Netscape/Mozilla/Opera/etc. use frequently has security vulnerabilities.

That said, I think the detection and progression status is well done. After enabling Java and reloading the page, the applet was finished doing its thing well before I was done writing my comment.

But, how do you handle people who don't have Java+JavaScript? Do you just tell them to go away? Before you say "well every standard's supporting browser supports them", there have been a number of times where I was forced to use Lynx because our unix machines were the only ones able to reach the internet.

I agree that gratuitous use of Java is incredibly annoying, however I believe that Java or something analogous is going to become increasingly pervasive and clients should support it where possible.

On the other hand, it isn't always possible, as you say. On my blog, if a WebHashcash stamp is not submitted for whatever reason (usually because the user's browser does not have Java support), the comment goes into a moderation queue, and is displayed once approved by a moderator. In this way, a minimum amount of inconvenience is created for users without Java, but the vast majority of users who have it can post instantly.

Great idea. I hate to complain about Java, but it still stinks embedded in the browser after nearly a decade. Reloading this page crashed Firefox (1.0.2 winxp, java 1.5) for me the first time in weeks. A javascript-only implementation should be possible.

Also, perhaps the hashcash should be generated upon submitting a comment rather than upon page load. For the vast majority of page loads no comment will be left, and it's annoying to have to generate a new stamp after previewing a comment in order to submit.

A JavaScript-only implementation is possible (I experimented with it), but at speeds several orders of magnitude slower than Java. You're talking 20+ minutes of maxed out CPU usage just to generate one stamp.

As far as preserving stamps that weren't spent (such as when you preview a comment), or only generating stamps after clicking Submit, I'll add those features to my to-do list. Thanks for the suggestions.

As a mere Slimy Mollusc in the TTLB Ecosystem, I'm afraid that I don't have a comment spam problem (yet). But I like your solution -- simple and elegant.

I've posted about your solution here.

OK, that "here" link isn't right. Try here. Too much Scotch, I guess.

Thanks for the link!

Too bad this doesn't stop human spammers.

Yes. :) And it doesn't totally stop Java-enabled spambots either. But it costs them both enough that it's not worth their time.

中联石化不锈钢管销售公司,专业经营各种不锈钢管,不锈钢板,高镍合金不锈钢管等,是国内知名的不锈钢管材料供应商,公司不锈钢管生产技术力量雄厚,经验丰富,是广大不锈钢管消费者的首选