[sometimesshit]

This can be detected easily using

navigator.credentials.create.toString() != "function () { [native code] }"

Another way is to hook the Fetch API and log outgoing urls that are not authenticated by Cloudflare

Welcome to the start of another catch and mouse game.

[geocar]

> This can be detected easily using

> navigator.credentials.create.toString() != "function () { [native code] }"

Are you sure? If I can replace navigator.credentials.create then surely I can replace its toString as well.

[sometimesshit]

The author didn't do that in article. You sure can replace toString (which can be detected as-well).

[geocar]

> You sure can replace toString (which can be detected as-well)

Are you sure? You can make “native code” functions with .bind(null)

    (function(){ var a=function(){};a.prototype.toString=navigator.credentials.create.toString.bind(navigator.credentials.create); return new a();})().toString()

[sometimesshit]

Yes, I'm. For the record, your code can be detected easily using,

toString.name

Which results "bound toString" wheres real one results "toString"

[geocar]

You can set toString.name

[sometimesshit]

You can of course, but how about these?

(function(){ var a=function(){};a.prototype.toString=navigator.credentials.create.toString.bind(navigator.credentials.create); return new a();})().toString == Function.prototype.toString

yields false where

navigator.credentials.create.toString == Function.prototype.toString

yields true