Google Cloud fraud defense, the next evolution of reCAPTCHA • Hacker News Board

Re: Google Cloud fraud defense, the next evolution of reCAPTCHA

#51

Post by kccqzy » Wed, May 06, 2026, 8:30 PM UTC

LoganDark wrote: post #34

Human verification via QR code does not mitigate labor farms.

Does reCAPTCHA ever claim to detect or block labor farms? From its old name it just seems to block bots only. (Bots are nowadays called agents.)

Re: Google Cloud fraud defense, the next evolution of reCAPTCHA

#52

Post by deepsun » Wed, May 06, 2026, 8:31 PM UTC

driverdan wrote: post #37

Any company that requires me to scan a QR code to make a purchase is losing my purchase.

Many sit-in restaurants enforce QR codes ordering. Started during covid, but keeps happening, especially outside US in my experience.

Re: Google Cloud fraud defense, the next evolution of reCAPTCHA

#53

Post by EA-3167 » Wed, May 06, 2026, 8:32 PM UTC

tech234a wrote: post #50

The QR code feature looks like it could be spoofed to become a Pegasus deployment method once people get used to them.

Overall it’s a reason to sigh deeply and thank our fellow “visionary leaders” for making everything that little bit worse. At least we’re getting an AI paradise out of the deal right?

Right?

Re: Google Cloud fraud defense, the next evolution of reCAPTCHA

#54

Post by lucb1e » Wed, May 06, 2026, 8:32 PM UTC

hellojesus wrote: post #12

bramhaag wrote: post #8

The requirements for the mobile devices are listed here: https://support.google.com/recaptcha/answer/16609652 So it seems that you will need a modern Android device with Google Play Services installed or a modern iPhone/iPad to be allowed to browse the web in the future. No mention of device integrity verification yet, but the writing is on the wall.

This is going to make my grapheneos journey a bit more exciting. How wild to force users through an official google identification for web browsing. Does the iPhone recaptcha app force you to login with a Google account? Seems we didn't need ID verification for the web to lose all anonymity.

I'd rather have to do ID verification at a government site that gives out blindable RSA signatures to browse the web with using open source software, than this overseas tech company needing to lock down the whole device and tech stack and not have to 'show ID' at all. One of these two holds elections...

Music/movie corporations and game developers must look forward to an age where people can't access the cache files or hook up a debugger to their apps anymore

Re: Google Cloud fraud defense, the next evolution of reCAPTCHA

#55

Post by kccqzy » Wed, May 06, 2026, 8:32 PM UTC

amazingamazing wrote: post #21

How are people stopping bots reliably?

Before the age of AI, most bots aren’t sophisticated at all. They might be a script running curl in a loop, or at best some standard browser automation tool like selenium or playwright. People couldn’t stop bots reliably but they could easily stop 99% of bots. That is of course no longer true which is why reCAPTCHA had to evolve.

Re: Google Cloud fraud defense, the next evolution of reCAPTCHA

#56

Post by luma » Wed, May 06, 2026, 8:33 PM UTC

dredmorbius wrote: post #26

xacky wrote: post #3

The fact that mobile devices are now mandatory to prove "humanness" means that Google no longer trusts desktop/open platforms anymore.

Where is this specified? I don't see that in TFA.

The example they give in TFA is having the user scan a QR code, presumably from a mobile device.

Re: Google Cloud fraud defense, the next evolution of reCAPTCHA

#57

Post by comboy » Wed, May 06, 2026, 8:35 PM UTC

driverdan wrote: post #37

Any company that requires me to scan a QR code to make a purchase is losing my purchase.

You would not last long in China ;)

(you pay by scanning QR code in .. well, everywhere)

Re: Google Cloud fraud defense, the next evolution of reCAPTCHA

#58

Post by comboy » Wed, May 06, 2026, 8:36 PM UTC

mayama wrote: post #4

The site doesn't mention this. But, are they locking down QR code auth for only safetynet authenticated devices and with mobile number verification?

Just show us your face and transactions history, it's about the kids.

Re: Google Cloud fraud defense, the next evolution of reCAPTCHA

#59

Post by basch » Wed, May 06, 2026, 8:37 PM UTC

Is this why google was repeatedly telling me I was displaying patterns of being a bot yesterday because I click too fast? I've never gotten the error message as many times as I did yesterday.

Re: Google Cloud fraud defense, the next evolution of reCAPTCHA

#60

Post by nonamesleft » Wed, May 06, 2026, 8:38 PM UTC

Hizonner wrote: post #9

bramhaag wrote: post #8

The requirements for the mobile devices are listed here: https://support.google.com/recaptcha/answer/16609652 So it seems that you will need a modern Android device with Google Play Services installed or a modern iPhone/iPad to be allowed to browse the web in the future. No mention of device integrity verification yet, but the writing is on the wall.

... or you'll need to stop using reCAPTCHA if you want to get any traffic on your Web site. I know, people will slavishly knuckle under, but let me dream for a few minutes.

I have blocked it for years with ublock origin, if a site doesn't work, ctrl-w. Nowadays i cannot even use google search because of this, any search will trigger a captcha, hilarious (atleast on chromium-based browsers, firefox lets me get a page or two).