News for hackers. Stuff that matters.

A comment on Cloudflare Turnstile solver library (no headless browser required). Parent comment

Re:Cloudflare Turnstile solver library (no headless browser ... by aftbit on Saturday October 31, 2026 @10:43AM (#50316647)
Fast forward to the end? Okay - only validated devices running an attested secure boot chain with first-party Safari, Chrome, or MS Edge are allowed to connect to the web. Live ID verification is required for all account creation. Attested PassKeys are the only accepted login tool, and they must be bound to your device and stored in its TPM.
[ Parent | on HN ]
Re:Cloudflare Turnstile solver library (no headless browser ... by threatofrain on Saturday October 31, 2026 @11:49AM (#50317266)
This very might be the only real solution to the cat and mouse game.
[ Parent | on HN ]
Re:Cloudflare Turnstile solver library (no headless browser ... by Vaushite on Saturday October 31, 2026 @04:06PM (#50319607)
That's not the end because you can solder wires to an attested device to make it do unattested things.
[ Parent | on HN ]
Re:Cloudflare Turnstile solver library (no headless browser ... by aftbit on Saturday October 31, 2026 @08:17PM (#50321559)
The analog hole remains a problem (or opportunity, depending on your mindset). Even if you don't solder wires to the device, you can mount it in a plotter frame that pokes the screen and uses vision models to understand the screen. That won't be closed until they figure out how to mount the attested devices in your brain (see NeuraLink).
[ Parent | on HN ]
Re:Cloudflare Turnstile solver library (no headless browser ... by nextaccountic on Saturday October 31, 2026 @05:27PM (#50320407)
The actual end has all cryptographic keys used for remote attestation released to the public

Open source software will not embed them, but maybe ask you to download yourself

[ Parent | on HN ]
Re:Cloudflare Turnstile solver library (no headless browser ... by aftbit on Saturday October 31, 2026 @08:18PM (#50321567)
Perhaps - I know some of the Widevine keys are out in the wild, but I'm not sure that all of the L1 keys have been leaked. It seems like at least in theory, they could bake unique keys into the hardware and revoke them once they leak.
[ Parent | on HN ]