Frequently Asked Questions

General

What is ALTCHA and how does it work?

ALTCHA is an open-source protocol and JavaScript widget designed to combat spam and abuse on websites and web applications. It utilizes a Proof of Work (PoW) mechanism instead of user testing or puzzles.

ALTCHA Sentinel is and addition commercial product that adds and extra layer of security.

How does the Proof of Work (PoW) mechanism in ALTCHA work?

PoW requires users to complete a computational task to validate their interactions. This task is resource-intensive, making it difficult for unsophisticated bots to bypass.

What role does the Sentinel play in ALTCHA?

The Sentinel enhances ALTCHA’s effectiveness by incorporating IP verification, blacklist checking, and advanced content analysis to detect and block spam and malicious actors.

How does ALTCHA handle IP verification and blacklist checking?

ALTCHA Sentinel analyzes IP addresses to identify those from data centers or TOR proxies and checks these IPs against known blacklists to prevent spam from known malicious sources.

Is ALTCHA compliant with privacy regulations?

Yes, ALTCHA is fully compliant with data protection laws worldwide. It operates as a cookie-less solution and respects user privacy without relying on intrusive tracking mechanisms.

Is ALTCHA compliant with accessibility regulations?

Yes, ALTCHA is WCAG AA+ compliant.

How does ALTCHA improve user experience compared to traditional CAPTCHAs?

ALTCHA enhances user experience by minimizing friction and accommodating automation. Unlike traditional CAPTCHAs, which can be tedious and disruptive, ALTCHA provides a smoother interaction.

Can ALTCHA be customized for different security needs?

Yes, ALTCHA is highly flexible and can be tailored to various scenarios. It allows for server-side enhancements and integration with additional mechanisms such as email or phone verification.

How does ALTCHA compare to reCAPTCHA and other solutions?

ALTCHA excels in privacy compliance, user experience, and adaptability compared to reCAPTCHA and other solutions. It offers stronger privacy protections, better support for automation, and effective spam reduction.

Technical

How do I integrate ALTCHA with my server?

ALTCHA can be integrated with your server using official libraries for various programming languages or through the official API. For detailed integration instructions, refer to the official libraries.

What are the key steps in the PoW verification process for ALTCHA?

The PoW verification process involves:

1. User initiates verification.
2. Widget requests challenge data from challengeurl.
3. Widget solves the challenge.
4. User submits the form with the solved challenge.
5. Server validates the submitted payload against the expected solution.

How does ALTCHA handle challenge complexity and verification?

ALTCHA uses SHA-hashing to manage challenge complexity, requiring three passes of SHA computation for both challenge generation and verification. The difficulty of the computational task can be adjusted using the maxnumber parameter.

What is the recommended method for validating the ALTCHA solution on the server?

The validation process includes:

1. Decoding and parsing the Base64-JSON-encoded payload.
2. Verifying the algorithm, challenge, and signature.
3. Ensuring all checks pass to confirm the request as valid.

See Server Integration.

How can I prevent replay attacks with ALTCHA?

To prevent replay attacks, implement measures to invalidate previously solved challenges. Maintain a registry of solved challenges and reject any submissions that attempt to reuse a challenge that has already been solved.

See Security Recommendations.

Enterprise

Is ALTCHA suitable for large organizations and enterprises?

Yes. ALTCHA is built to meet the needs of large-scale organizations, including enterprises and government agencies. It adheres to high security and compliance standards and offers enterprise-grade support options.

For more information, see our Enterprise Documentation.

Does ALTCHA offer enterprise support plans?

Yes. We provide enterprise support packages that include SLAs (Service Level Agreements), priority bug fixes, dedicated onboarding assistance, and regular health checks of your integration to ensure optimal performance and security.

How easy is it to integrate ALTCHA into existing systems?

ALTCHA offers integration libraries and detailed API documentation for popular platforms such as Node.js, PHP, Python, and others. You can secure web forms, login pages, comment sections, and API endpoints with minimal code changes.

Check out our Migration Guides for seamless transition from reCAPTCHA or other CAPTCHA services.

Can we use ALTCHA in mobile apps or backend services?

Yes. ALTCHA is platform-agnostic and works seamlessly across websites, mobile applications, and backend APIs. It supports both frontend interactions and server-to-server communication models.

How does ALTCHA scale in high-traffic enterprise environments?

ALTCHA is designed to be stateless and highly efficient, making it ideal for horizontal scaling across large infrastructures. Whether you handle thousands or tens of millions of requests per day, ALTCHA scales effortlessly without performance degradation.

Is ALTCHA compliant with GDPR, HIPAA, or other regulatory standards?

Yes. Since ALTCHA does not collect or store personal data of any kind, it significantly reduces your compliance burden. This makes it a safer and more privacy-friendly alternative for regulated industries such as healthcare and finance.

Can we audit the source code or customize ALTCHA for internal policies?

Absolutely. ALTCHA and its associated libraries are open-source under the MIT license. This allows for complete transparency, customization, and internal governance. You can review, modify, and deploy the code to align with your organization’s specific requirements.

Please note that ALTCHA Sentinel is a closed-source commercial software component designed for advanced threat detection and enterprise management. It is available under a separate commercial license agreement.