Discussion

The Hackers Who Tracked My Sleep Cycle

statements: One thing I excluded from the article was that we intentionally disabled several checks (like hCaptcha) to let them get to the stage of setting up the payment intents. This is not something I've done before, but basically I wanted to see what happens if in future an attacker is able to bypass all IP/captcha/altcaptcha, etc. restrictions and gets to something that actually does damage. This allowed to see how they are trying to bypass various rate limits/checks that we added specifically for that step. Somewhat an isolated experiment.

qmarchi: I would wonder if this could also be used as a kind of tripwire, where legitimate users won't present CAPCHA tokens, etc. But fake connections will.