Defence
Security of the check
Every puzzle is signed, timed, and single use, and repeat requests are rate limited.
The hosted service runs in Frankfurt, Germany.
Signature
HMAC-SHA256
The server signs the puzzle.
Verification rejects a token whose signature does not match.
Signed
Time
Expiry
A puzzle is valid only for a limited time.
An old token is not accepted.
Timed
Once
Single use
After a successful check the puzzle cannot be replayed.
No replay
Pace
Rate limiting
Addresses that request many puzzles receive harder work.
The limit uses a salted hash, not a profile of the person.
Harder when busy
Put the check on a real form
A sitekey from your account is enough to request the first puzzle.