kaPoW plugins: protecting web applications using reputation-based proof-of-work

Abstract

Comment spam is a fact of life if you have a blog or forum. Tools like Akismet and CAPTCHA help prevent spam in applications like WordPress or phpBB. However, they are not devoid of shortcomings. CAPTCHAs are getting easier to solve by automated adversaries like bots and pose usability issues. Akismet strives to detect spam, but can't do much to reduce it. This paper presents the kaPoW plugin and reputation service that can complement existing antispam tools. kaPoW creates disincentives for sending spam by slowing down spammers. It uses a web-based proof-of-work approach wherein a client is given a computational puzzle to solve before accessing a service (e.g. comment posting). The idea is to set puzzle difficulties based on a client's reputation, thereby, issuing "harder" puzzles to spammers. The more time spammers solve puzzles, the less time they have to send spam. Unlike CAPTCHAs, kaPoW requires no additional user interaction since all the puzzles are issued and solved in software. kaPoW can be used by any web application that supports an extension framework (e.g. plugins) and is concerned about spam.