From 51705056a578d2649a989bf14a056fbcfae58a6b Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Wed, 14 Oct 2026 13:34:47 +0200 Subject: feat(hub): replace reCAPTCHA with a self-hosted proof of work Sign-up and passphrase reset sent every visitor's address and browser details to Google, which needed a consent the sign-up form could not ask for freely. The hub now issues its own challenge (ALTCHA's scheme, signed with a key derived from the hub's private key, single-use, 30 minutes) and the page solves it with SubtleCrypto while the form is filled in. - GET /v1/users/captcha issues a challenge; 404 captcha_disabled when off. - [captcha] enabled / max_number replace site_key / secret_key, which are now ignored with a warning; MESHBAY_CAPTCHA_ENABLED replaces the old variables. - No Google origin left in the CSP of the hub, the desktop shell or the Android shell; captcha_site_key leaves /v1/hub/info. Co-Authored-By: Claude Opus 5.5 --- packages/meshbay-hub/src/meshbay_hub/static/keyderive.js | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'packages/meshbay-hub/src/meshbay_hub/static/keyderive.js') diff --git a/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js b/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js index edf4df9..bd5282c 100644 --- a/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js +++ b/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js @@ -401,9 +401,9 @@ async function registerUser(username, email, password, recoveryMnemonic, captcha // appends it to the verification e-mail and stores it nowhere // (docs/MESHBAY_DESIGN.md ยง3.6). Omitted when they chose to save it themselves. if (recoveryMnemonic) payload.recovery_key = recoveryMnemonic; - // reCAPTCHA response, when the hub has a captcha configured. The widget lives - // in RegisterPage (auth-page.js); this function just forwards its token. A - // hub with no captcha configured sends nothing and the server does not check. + // The proof-of-work answer, when the hub asks for one. RegisterPage + // (auth-page.js) works it out; this function just forwards it. A hub with + // the check turned off gets nothing and does not look. if (captchaToken) payload.captcha_token = captchaToken; const resp = await hubCall('/v1/users/register', { -- cgit v1.2.3