How to enable Private Access Tokens in iOS 16 and stop seeing CAPTCHAs

Re:How to enable Private Access Tokens in iOS 16 and stop se... by runnerup on Friday September 23, 2022 @09:07AM (#32951387)

What confuses me is that at the end of the day the challenge and response need to be sent over HTTP.

Why can’t you copy the response from the real device and “play” (not replay) it from a fake device?

[ Parent | on HN ]

Re:How to enable Private Access Tokens in iOS 16 and stop se... by g_p on Friday September 23, 2022 @06:34PM (#32957883)

I believe you could do relaying like this, if suitably determined. You would need to do it in near real-time, and no doubt the endpoint giving PATs will be rate-limited.

At some point the amount of manual effort to automate this (do you have an API to retrieve the token programmatically from another app?) will exceed what it is worth to avoid a captcha!

I suspect you will find it is hard to gwt the real response out from the trusted browser.

[ Parent | on HN ]