News for hackers. Stuff that matters.
Re:Building a WebAuthn Click Farm by geocar on Wednesday June 16, 2021 @05:40AM (#27526624)
> You sure can replace toString (which can be detected as-well)

Are you sure? You can make “native code” functions with .bind(null)

    (function(){ var a=function(){};a.prototype.toString=navigator.credentials.create.toString.bind(navigator.credentials.create); return new a();})().toString()
Re:Building a WebAuthn Click Farm by sometimesshit on Wednesday June 16, 2021 @08:22AM (#27527671)
Yes, I'm. For the record, your code can be detected easily using,

toString.name

Which results "bound toString" wheres real one results "toString"

Re:Building a WebAuthn Click Farm by geocar on Wednesday June 16, 2021 @09:56AM (#27528537)
You can set toString.name
Re:Building a WebAuthn Click Farm by sometimesshit on Wednesday June 16, 2021 @12:56PM (#27530730)
You can of course, but how about these?

(function(){ var a=function(){};a.prototype.toString=navigator.credentials.create.toString.bind(navigator.credentials.create); return new a();})().toString == Function.prototype.toString

yields false where

navigator.credentials.create.toString == Function.prototype.toString

yields true

Re:Building a WebAuthn Click Farm by geocar on Wednesday June 16, 2021 @01:13PM (#27530928)
Of course you can "just" modify Function.prototype.toString as well. And so on.
Re:Building a WebAuthn Click Farm by sometimesshit on Thursday June 17, 2021 @01:58AM (#27536498)
You know what that can be detected as-well. I'm trying to prove my point that it's endless cat and mouse game.
Re:Building a WebAuthn Click Farm by geocar on Thursday June 17, 2021 @04:51AM (#27537474)
I think we're talking past each other then.