From 772e4470c599c2992a88031b16e1f05c718f0f05 Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Wed, 21 Oct 2026 06:15:30 -0700 Subject: register: check the reCAPTCHA v3 score, action and hostname; cap signups per network siteverify answers success for any validly minted v3 token, so success alone let scripted signups through. Signup now needs the register action and a 0.5 score, and login 0.3. A token minted for another site is refused. The web signup page must send a token. Signups are capped per IPv4 /16 or IPv6 /48, hourly and daily, and those keeping the auto-filled animal+NN username are capped site-wide per hour. Turnstile is verified and logged only, on trial. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01NfM8zA4DdKvW1316z4zCaD --- lib/default-names.ts | 63 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 63 insertions(+) create mode 100644 lib/default-names.ts (limited to 'lib') diff --git a/lib/default-names.ts b/lib/default-names.ts new file mode 100644 index 00000000..e36dcde0 --- /dev/null +++ b/lib/default-names.ts @@ -0,0 +1,63 @@ +// Usernames the web signup page fills in by default: an animal from +// unique-names-generator plus a number 10-99 (coinos-ui src/lib/random.ts). +// Real users rarely keep one (~8/day); signup farms always do. +const animals = new Set([ + "aardvark", "aardwolf", "albatross", "alligator", "alpaca", "amphibian", + "anaconda", "angelfish", "anglerfish", "ant", "anteater", "antelope", + "antlion", "ape", "aphid", "armadillo", "asp", "baboon", "badger", + "bandicoot", "barnacle", "barracuda", "basilisk", "bass", "bat", "bear", + "beaver", "bedbug", "bee", "beetle", "bird", "bison", "blackbird", "boa", + "boar", "bobcat", "bobolink", "bonobo", "booby", "bovid", "bug", + "butterfly", "buzzard", "camel", "canid", "canidae", "capybara", + "cardinal", "caribou", "carp", "cat", "caterpillar", "catfish", "catshark", + "cattle", "centipede", "cephalopod", "chameleon", "cheetah", "chickadee", + "chicken", "chimpanzee", "chinchilla", "chipmunk", "cicada", "clam", + "clownfish", "cobra", "cockroach", "cod", "condor", "constrictor", "coral", + "cougar", "cow", "coyote", "crab", "crane", "crawdad", "crayfish", + "cricket", "crocodile", "crow", "cuckoo", "damselfly", "deer", "dingo", + "dinosaur", "dog", "dolphin", "donkey", "dormouse", "dove", "dragon", + "dragonfly", "duck", "eagle", "earthworm", "earwig", "echidna", "eel", + "egret", "elephant", "elk", "emu", "ermine", "falcon", "felidae", "ferret", + "finch", "firefly", "fish", "flamingo", "flea", "fly", "flyingfish", + "fowl", "fox", "frog", "galliform", "gamefowl", "gayal", "gazelle", + "gecko", "gerbil", "gibbon", "giraffe", "goat", "goldfish", "goose", + "gopher", "gorilla", "grasshopper", "grouse", "guan", "guanaco", + "guineafowl", "gull", "guppy", "haddock", "halibut", "hamster", "hare", + "harrier", "hawk", "hedgehog", "heron", "herring", "hippopotamus", + "hookworm", "hornet", "horse", "hoverfly", "hummingbird", "hyena", + "iguana", "impala", "jackal", "jaguar", "jay", "jellyfish", "junglefowl", + "kangaroo", "kingfisher", "kite", "kiwi", "koala", "koi", "krill", + "ladybug", "lamprey", "landfowl", "lark", "leech", "lemming", "lemur", + "leopard", "leopon", "limpet", "lion", "lizard", "llama", "lobster", + "locust", "loon", "louse", "lungfish", "lynx", "macaw", "mackerel", + "magpie", "mammal", "manatee", "mandrill", "marlin", "marmoset", "marmot", + "marsupial", "marten", "mastodon", "meadowlark", "meerkat", "mink", + "minnow", "mite", "mockingbird", "mole", "mollusk", "mongoose", "monkey", + "moose", "mosquito", "moth", "mouse", "mule", "muskox", "narwhal", "newt", + "nightingale", "ocelot", "octopus", "opossum", "orangutan", "orca", + "ostrich", "otter", "owl", "ox", "panda", "panther", "parakeet", "parrot", + "parrotfish", "partridge", "peacock", "peafowl", "pelican", "penguin", + "perch", "pheasant", "pig", "pigeon", "pike", "pinniped", "piranha", + "planarian", "platypus", "pony", "porcupine", "porpoise", "possum", + "prawn", "primate", "ptarmigan", "puffin", "puma", "python", "quail", + "quelea", "quokka", "rabbit", "raccoon", "rat", "rattlesnake", "raven", + "reindeer", "reptile", "rhinoceros", "roadrunner", "rodent", "rook", + "rooster", "roundworm", "sailfish", "salamander", "salmon", "sawfish", + "scallop", "scorpion", "seahorse", "shark", "sheep", "shrew", "shrimp", + "silkworm", "silverfish", "skink", "skunk", "sloth", "slug", "smelt", + "snail", "snake", "snipe", "sole", "sparrow", "spider", "spoonbill", + "squid", "squirrel", "starfish", "stingray", "stoat", "stork", "sturgeon", + "swallow", "swan", "swift", "swordfish", "swordtail", "tahr", "takin", + "tapir", "tarantula", "tarsier", "termite", "tern", "thrush", "tick", + "tiger", "tiglon", "toad", "tortoise", "toucan", "trout", "tuna", "turkey", + "turtle", "tyrannosaurus", "unicorn", "urial", "vicuna", "viper", "vole", + "vulture", "wallaby", "walrus", "warbler", "wasp", "weasel", "whale", + "whippet", "whitefish", "wildcat", "wildebeest", "wildfowl", "wolf", + "wolverine", "wombat", "woodpecker", "worm", "wren", "xerinae", "yak", + "zebra", +]); + +export const isDefaultName = (username: string) => { + const m = /^([a-z]+)\d\d$/.exec(String(username || "").toLowerCase()); + return !!m && animals.has(m[1]); +}; -- cgit v1.2.3