Building a WebAuthn Click Farm: Bypassing Cloudflare's Attestation of Personhood

betterappsec.com