meshbay.git/packages/meshbay-hub/src/meshbay_hub/static/captcha.js, branch mainMeshBay — read-only public mirrorhttps://git.meshbay.org/meshbay.git/atom?h=main2026-10-14T11:34:47Zfeat(hub): replace reCAPTCHA with a self-hosted proof of work2026-10-14T11:34:47ZChristophe Bessoncbesson@gmail.com2026-10-14T11:34:47Zurn:sha1:51705056a578d2649a989bf14a056fbcfae58a6b
Sign-up and passphrase reset sent every visitor's address and browser
details to Google, which needed a consent the sign-up form could not ask
for freely. The hub now issues its own challenge (ALTCHA's scheme, signed
with a key derived from the hub's private key, single-use, 30 minutes)
and the page solves it with SubtleCrypto while the form is filled in.
- GET /v1/users/captcha issues a challenge; 404 captcha_disabled when off.
- [captcha] enabled / max_number replace site_key / secret_key, which are
now ignored with a warning; MESHBAY_CAPTCHA_ENABLED replaces the old
variables.
- No Google origin left in the CSP of the hub, the desktop shell or the
Android shell; captcha_site_key leaves /v1/hub/info.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>