Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Prove you're human by winning a claw machine

feralui.vercel.app

Post reply on HN
Print view View original

51–56 of 56 posts

Re: Prove you're human by winning a claw machine

#51

Post by TZubiri »

thunderbong wrote: post #32
TZubiri wrote: post #3

>npm install playcaptcha Imagine you get pwned for trying this out in your home project and the APT escalates to your company repos and infects your company assets, and then the post mortem comes in and you have to explain this is what infected the company it stack

If you see the code, that dependency just happens to be another file in the repository [0] The only dependency is the 'motion' library. [0]: https://github.com/mortspace/playcaptcha

does npm install pull code from that github repo, though? If not, auditing that repo is a huge blunder.

I'm seeing this from npm, which is a bit different:

https://www.npmjs.com/package/playcaptcha

Not saying the package is malicious, (although it might be, but it's a more likely threat that the devs themselves become infected by a supply chain worm and spread it downstream.) just saying, if you are going to audit it, actually audit it as if you were up against an attacker.

Re: Prove you're human by winning a claw machine

#52

Post by lemagedurage »

rendaw wrote: post #43
SweetSoftPillow wrote: post #38

The most important part that most commenters did not read: "And to be clear: it checks that someone is playing, not who they are. Keep your real checks behind it." It's just a game, not a CAPTCHA.

Both the submission title and the first sentence are: Prove you’re human by winning a claw machine.

They should make it more clear that it's a concept.

I could see a real version that sends the inputs to the backend where some analysis is done, but right now an adversary can just run the onVerify callback as "bypass".

Re: Prove you're human by winning a claw machine

#55

Post by IAmBroom »

csydas wrote: post #45

Cute but like a lot of captchas misguided at this stage The problem they try to solve is real, but I don't think that 'hacking minigames' are the correct direction to be looking to solve this, and ultimately end up making mandatory human identity verification seem more palatable as the less annoying option games and challenges like this are more annoying / resource consuming to humans (i.e., time, patience), and can…

Your lack of punctuation and capitallization impedes your communication.

Also, what is "anubis-style"? Google failed me (which is becoming more common).

Re: Prove you're human by winning a claw machine

#56

Post by IAmBroom »

rossvc wrote: post #34
arbol wrote: post #28

Earlier quoted context omitted.

It's just a concept, not a real test. Captcha are already expensive at scale due to escalating checks when abuse is detected. You have to orchestrate and pay for residential proxies, containers with different fingerprints, different behavioural data, clean IP rep, emulate device performance to avoid revealing youre running on a server... A 1-shot doesn't scale against this.

If the payoff is worth it, no captcha is too expensive.

OP said "already expensive"; you said "too expensive". Both can be true.
Post reply on HN