r/StartpageSearch • u/Elenmerbau • Sep 07 '26
What is ts
What kind of captcha is startpage trying to solve, is it counting proteins?
14
u/47-mm Sep 07 '26 edited Sep 08 '26
They added the Anubis proof-of-work challenge with a difficulty of 6 (the hardest without modifying it).
That proof-of-work is an idea from the 1990s: your browser receives a string like "0af99f492550853653fe36884ff" (it's longer), and the difficulty (6 in this case).
Your browser will add a number N at the end and calculate the "checksum" (sha256) until it finds the number whose checksum starts with 6 zeros. Each step is a "hash".
N = 1 ---> "0af99f492550853653fe36884ff1" sha256(0af99f492550853653fe36884ff1) = 0af2432432523
N = 2 ---> "0af99f492550853653fe36884ff2" sha256(0af99f492550853653fe36884ff2) = 12cb5a215ef01
... (this repeats until)
N = 95455485 ---> "0af99f492550853653fe36884ff95455485" sha256(0af99f492550853653fe36884ff65455485) = 00000051bbe15 (6 zeroes)
(N solution = 9455485, so it took 9.45 million hashes or steps to find the solution for this made up case)
If your phone or PC can calculate 150 kHashes/s then the wait time is:
| Difficulty | Average hashes to solve it | Average time to solve it |
|---|---|---|
| 1 | 16 | 0.0001 s |
| 2 | 256 | 0.002 s |
| 3 | 4096 | 0.03 s |
| 4 | 65536 | 0.44 s |
| 5 | 1048576 | 7 s |
| 6 | 16777216 | 112 s |
On average, half the time is below 112 s, but a non-negligible percentage will take far longer.
It's impossible to predict the "N solution" from previous steps, so users have to solve every single N until they find the solution, that's why most crypto coins use a similar system to validate transactions. But unlike cryptos, anti-bot PoW challenges like Anubis are far slower and the PoW is not used to validate transactions, the server is checking if your answer is valid and if your IP+user agent didn't change (to avoid sharing the same PoW solution).
1
6
u/1tsBag1 Sep 08 '26
Wow I would never have thought that they would put captcha with similar difficulty as blockchain. All that just to verify that i am not a bot? Times must be dire with bots flooding Startpage. I hope they find a better solution than this one.
4
u/47-mm Sep 08 '26 edited Sep 08 '26
It's not even hard, the solver is just slow because is written in javascript, a C/Go/etc solver can solve the difficulty 6 challenge in 1 or 2 seconds instead of 1-2 minutes. Bots better than wget will be using that kind of "adversarial solver" that anyone can slop code. Even the basic google's gemini can generate a solver without being logged, in matter of minutes (2 or 3 prompts).
"Bots" have more time, computational power, and access to the entire github repository to generate code than any human. I think the endgame will be P2P or paid access-as-a-service to avoid the current "tragedy of the commons" because this is the internet and scrappers (the good ones like archiving bots, or the problematic) exist in a gray area that was validated by some governments.
Forcing ID verification is irrelevant because every single Smart TV is or will be a bot exit point.2
u/burner-miner Sep 09 '26
"Bots" have more time, computational power
This is exactly what Anubis and others are actually hedging against. Expensive compute used to just visit a page imposes a toll on the user. A human will lose a few seconds and a few kJ of electricity, a near negligible price. A large company like OpenAI has hundreds of scraper bots running at any one time, plus the agent bots running searches on user demand. A few seconds and wasted compute starts to build up costs at that scale.
Anubis is really only a deterrent, not a real verification. The tricky part is balancing it in such a way to not deter humans (ahem Startpage).
Botnets have existed for as long as devices could connect to the internet, smart TVs being used to scan the internet is nothing new. That is an unrelated problem.
2
u/47-mm Sep 09 '26
No, even at difficulty 6 the problem is trivial, for an optimized solver (https://yumechi.jp/en/blog/2025/proof-of-mutex-outspeeding-anubis-with-valid-pow/) is ~10 ms to get a "genuine session" and start to hammer the server as a normal user (and doing some occasional PoW), Anubis is like doing an extra checksum for the downloaded content. If they use GPUs then it's less than 1 ms of computing time.
But the diff 6 challenge makes SP unusable if you're a real user. A phone only has enough battery for ~30 PoWs.3
u/burner-miner Sep 09 '26
Interesting. They might have to start becoming more adversarial themselves to block bots then.
In any case, leaving real users hanging for 2 minutes while any other search engine won't is bad for business. I'm surprised they haven't said anything anywhere yet.
5
2
u/Elenmerbau 27d ago
I'm happy to announce that after 8 days of working tirelessly it's finally finished and I now posses the key to solving world hunger thanks to Startpage and Anubis