CAPTCHA on registration (Altcha, self-hosted) — bot deterrent that keeps data in CH #32

New issue

Open

opened 2026-08-25 02:07:00 +00:00 by Cordy · 0 comments

Cordy commented

2026-08-25 02:07:00 +00:00

Owner

Add a CAPTCHA to /v1/register (and optionally password-reset) to blunt automated signup floods.

Choice: Altcha (self-hosted, proof-of-work)

The sovereignty brand rules out the usual options: Google reCAPTCHA (data → Google) and Cloudflare Turnstile (data → Cloudflare US, Schrems II ambiguity) both phone home and break "nothing leaves the VPS / Switzerland." Altcha is self-hosted, GDPR/cookie-free, sends no external requests — it runs a small invisible proof-of-work in the browser and the server verifies the solution. No third party, nothing leaves the box.

Behaviour (answers "does it trigger every time?")

Risk-scoring CAPTCHAs (Turnstile / reCAPTCHA v3) only show a challenge when the request looks bot-like; invisible otherwise.
Altcha shows no visible challenge ever — it runs a brief proof-of-work on every submit. Humans never see a puzzle; bots pay a per-attempt compute cost that makes mass registration expensive. Different mechanism, same "no friction for real users" outcome, and it's the sovereignty-correct one here.

Implementation sketch

Server: generate an Altcha challenge (HMAC over a random salt + difficulty), embed in the register form; verify the returned solution server-side before creating the account. Pure stdlib (crypto/sha256, crypto/hmac) — no dependency needed; Altcha's algorithm is simple PoW.
Frontend: the Altcha widget (small JS) on enter.html register form, or a hand-rolled PoW to avoid any external script.
Tunable difficulty; raise it if a flood is detected.

Notes

Pairs with the email-verification issue: CAPTCHA slows the door, verification invalidates whatever gets through.
Keep it registration-only initially; login doesn't need it (rate limits already there).

Refs: Altcha https://github.com/altcha-org/altcha

Add a CAPTCHA to `/v1/register` (and optionally password-reset) to blunt automated signup floods. ## Choice: Altcha (self-hosted, proof-of-work) The sovereignty brand rules out the usual options: **Google reCAPTCHA** (data → Google) and **Cloudflare Turnstile** (data → Cloudflare US, Schrems II ambiguity) both phone home and break "nothing leaves the VPS / Switzerland." **Altcha** is self-hosted, GDPR/cookie-free, sends **no external requests** — it runs a small invisible proof-of-work in the browser and the server verifies the solution. No third party, nothing leaves the box. ## Behaviour (answers "does it trigger every time?") - Risk-scoring CAPTCHAs (Turnstile / reCAPTCHA v3) only show a challenge when the request looks bot-like; invisible otherwise. - Altcha shows **no visible challenge ever** — it runs a brief proof-of-work on every submit. Humans never see a puzzle; bots pay a per-attempt compute cost that makes mass registration expensive. Different mechanism, same "no friction for real users" outcome, and it's the sovereignty-correct one here. ## Implementation sketch - Server: generate an Altcha challenge (HMAC over a random salt + difficulty), embed in the register form; verify the returned solution server-side before creating the account. Pure stdlib (crypto/sha256, crypto/hmac) — no dependency needed; Altcha's algorithm is simple PoW. - Frontend: the Altcha widget (small JS) on `enter.html` register form, or a hand-rolled PoW to avoid any external script. - Tunable difficulty; raise it if a flood is detected. ## Notes - Pairs with the email-verification issue: CAPTCHA slows the door, verification invalidates whatever gets through. - Keep it registration-only initially; login doesn't need it (rate limits already there). Refs: Altcha https://github.com/altcha-org/altcha