The problem they try to solve is real, but I don't think that 'hacking minigames' are the correct direction to be looking to solve this, and ultimately end up making mandatory human identity verification seem more palatable as the less annoying option
games and challenges like this are more annoying / resource consuming to humans (i.e., time, patience), and can imagine it ends up excluding humans who cannot complete the challenge due to extenuating circumstances, like i have no idea if someone who uses sight assistance accessibility tooling can complete this challenge reasonably, and if this style of challenge takes off I am pretty sure the challenges will continue to exclude many humans who use accessibility tools
I worry this approach ends up being the next cookie banners (which were always malicious compliance in the saltiest, pettiest way)
anubis-style cycle burning approaches seem to be best, but have not looked for research on the efficacy of this approach. if it does have a positive impact for operators though, a method like that seems better
edit: to be clear, I do not want mandatory identity verification -- not at all it's awful, and my fear is that tools like this will only serve to make that option seem more palatable in comparison
Accessibility is a big concern with all kinds of CAPTCHAs it seems. Even without any disabilities, I've seen some that I cannot solve because it's illegible.
edit: The page links to [1], but [1] has none of the information I'm really looking for -- why should somebody use this tool?
A human would be incredibly suspicious of this.
but this is fun!
Captcha are already expensive at scale due to escalating checks when abuse is detected. You have to orchestrate and pay for residential proxies, containers with different fingerprints, different behavioural data, clean IP rep, emulate device performance to avoid revealing youre running on a server... A 1-shot doesn't scale against this.
"And to be clear: it checks that someone is playing, not who they are. Keep your real checks behind it."
It's just a game, not a CAPTCHA.
I could see a real version that sends the inputs to the backend where some analysis is done, but right now an adversary can just run the onVerify callback as "bypass".
Also when you move the claw left and right, it "leans" in the wrong direction.
Fun idea though
It requires you to solve a mate-in-one puzzle to, e.g., post on the forums.
(Sorry, don't have a better link, there wasn't any non-technical I could find about it).
https://www.reddit.com/r/chess/comments/q19wgq/til_lichess_d...
Like when games detect aimbots, they don't ban people, but put them in an aimbot bracket, so everyone you play with is a cheater.
Provide a captcha that is essentially harder for a human to solve, but trivial for either a human or an AI, and transparently separate them into two communities.
https://github.com/user-attachments/assets/0b80b07b-d88f-414...
Imagine you get pwned for trying this out in your home project and the APT escalates to your company repos and infects your company assets, and then the post mortem comes in and you have to explain this is what infected the company it stack
Coworkers on project: "Containers? Not running things as root? Hah, you're overengineering things: Just follow the readme where it says to install the daemons and run all code and plugins on your dev-box. It works fine, then we can show how we're using AI!"
(Yeah, not as good as completely separate computer, diminishing returns, but still...)
The only dependency is the 'motion' library.
I'm seeing this from npm, which is a bit different:
https://www.npmjs.com/package/playcaptcha
Not saying the package is malicious, (although it might be, but it's a more likely threat that the devs themselves become infected by a supply chain worm and spread it downstream.) just saying, if you are going to audit it, actually audit it as if you were up against an attacker.
phpboard added captchas back in 2004.
If it is DNA then why would I need a claw machine? (Note that this defnition on DNA, which in itself is mega-odd since DNA differs, would mean that via synthetic biology one could yield humans - according to such a definition. But this does not have to be correct, so the definition would be flawed.)
If it is not DNA, how else to prove it?