Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google broke reCAPTCHA for de-googled Android users

reclaimthenet.org

Post reply on HN
Print view View original

81–90 of 618 posts

Re: Google broke reCAPTCHA for de-googled Android users

#81

Post by retired »

ranger_danger wrote: post #3

Sites that use reCAPTCHA/Turnstile/etc. have already been broken for me for years now due to neverending captcha/refresh loops. My ISP regularly changes everyone's IP, and I apparently share an ISP with people who suck, so I get flagged just trying to do all sorts of normal things. Some examples: - I've never bought anything from Etsy but I'm somehow banned from even viewing their site at all. - Discord immediately b…

I have not been able to visit AliExpress for months now. Just an endless reCAPTCHA loop.

I wonder if they are seeing a decrease in traffic and somehow find that acceptable.

Re: Google broke reCAPTCHA for de-googled Android users

#83

Post by tcoff91 »

rdedev wrote: post #69
coppsilgold wrote: post #4

My understanding is that this new reCAPTCHA is basically just remote attestation. Remote attestation doesn't use blind signatures (as that would be 'farmable') so tying the device to the 'attestee' is technically possible with collusion of Google servers: EK (static burned-in private key) -> AIK (ephemeral identity key in secure enclave signed by a Google server) -> attestation (signed by AIK). As you can see if the…

When companies like this exist, what is the point of relying of TPM? Looks like the future is bright for VC backed bots https://doublespeed.ai/

Wow that is so dystopian.

Re: Google broke reCAPTCHA for de-googled Android users

#84

Post by repelsteeltje »

cybercatgurrl wrote: post #68
ezekiel68 wrote: post #34

I don't know why reclaimthenet hasn't embraced the obvious answer: Simply create a new smart device operating system with a fully disentangled cosmos of programs, libraries, APIs, app SDKs, hardware partners, drivers, trust networks, carrier agreements, app stores, documentation, conferences...

and that is gonna be funded by who? anyone who is gonna fund that is gonna want their slice of the pie. we need regulation to keep big tech in line

How about consumers paying a little extra for their device? The way it's going, add sponsored big tech is dieing because click fraud detection is becoming too expensive. Either we give up privacy and track every user, or we let bots have at it, stop targeting ads to users and bill advertisers on bandwidth.

Re: Google broke reCAPTCHA for de-googled Android users

#85

Post by jbvlkt »

g-b-r wrote: post #53
tardedmeme wrote: post #46

Earlier quoted context omitted.

With the new reCAPTCHA this is going to happen because most human visitors will actually be unable to pass the CAPTCHA. It will be interesting to see whether this makes websites ditch reCAPTCHA or whether they literally just don't care about having customers, an attitude that seems to be getting more and more common every day.

One problem with these things is that businesses have minimal visibility on the amount of users they lose. On the opposite, if they see reports of many visitors not completing the captcha, they're likely to think "Wow so many bots!!! This defense nowadays is indispensable..!". Sometimes you need to pass a captcha even to contact them (if you want to tell them that you can't pass their captcha).

I wanted to give money to charity and they have whole form protected by recaptcha. So I would have to allow all my personal information and amount donated sent to google (and agree with google terms for data processing). I have contacted them but they did not understand why this is problem they just wanted to protect themself against bots. IMHO unless those things are not disallowed by antitrust laws we have lost.

Re: Google broke reCAPTCHA for de-googled Android users

#86

Post by retired »

brikym wrote: post #58
Worf wrote: post #49

I don't use Android right now and haven't used Google'd Android for almost a decade. And I won't. If this is the hill I die on, so be it. I'm not going to use any sort of hardware attestation, especially one controlled by Google. You shouldn't either, even if you have an unrooted Google-certified Android phone.

It's all fun until you can't get paid because some fintech app doesn't work. That's why we need regulations. I don't see politicians ever going against an advertising company when they're customers.

Already happening. The official German identification app, AusweisApp, is designed exclusively for Android and Apple mobile devices

Re: Google broke reCAPTCHA for de-googled Android users

#87

Post by dakolli »

rdedev wrote: post #69
coppsilgold wrote: post #4

My understanding is that this new reCAPTCHA is basically just remote attestation. Remote attestation doesn't use blind signatures (as that would be 'farmable') so tying the device to the 'attestee' is technically possible with collusion of Google servers: EK (static burned-in private key) -> AIK (ephemeral identity key in secure enclave signed by a Google server) -> attestation (signed by AIK). As you can see if the…

When companies like this exist, what is the point of relying of TPM? Looks like the future is bright for VC backed bots https://doublespeed.ai/

Why is every startup using that same Serif font now, Garamond or whatever. Is it an LLM design phenomenon? Its kinda ruining that font style for me.

Also $1,500 a month for 10 "influencers" is wild. This doesn't seem that sophisticated unless they're doing something special to increase trust scores of accounts. They say they have "in house warming algorithm" which honestly doesn't inspire confidence for me.

Whats funny is its almost a certainty (if they are doing things correctly) that they have literal farms of phones (probably in SEA). The only real way to keep trust high is to have a real mobile connection and unique devices. Proxies are okay, but you really need to use the apps on real hardware.

Re: Google broke reCAPTCHA for de-googled Android users

#88

Post by ranger_danger »

miladyincontrol wrote: post #54
ranger_danger wrote: post #3

Sites that use reCAPTCHA/Turnstile/etc. have already been broken for me for years now due to neverending captcha/refresh loops. My ISP regularly changes everyone's IP, and I apparently share an ISP with people who suck, so I get flagged just trying to do all sorts of normal things. Some examples: - I've never bought anything from Etsy but I'm somehow banned from even viewing their site at all. - Discord immediately b…

Almost would bet one or a few of your ISP's customers have their connections being used as residential VPNs. I know people like to think of suspicious android box setups but even a lot of "free" apps, extensions and other such services scarily seem to do that duty these days. I'm sure I'm preaching to the choir here, but its sad how many people will use some free of cost vpn and not even think why that might be.

Yes, I have even seen mobile android games that include notices about a BrightData SDK or HolaVPN etc. where their idle bandwidth is resold.

Re: Google broke reCAPTCHA for de-googled Android users

#89

Post by flatIronSteak »

g-b-r wrote: post #47
getpokedagain wrote: post #36

Earlier quoted context omitted.

Stop visiting sites and using services that use reCAPTCHA. Problem solved.

Yeah, live in a cave, and problem solved. However much I hate it, right now among the sites using reCAPTCHA there are many that I strongly want to use. Let's find a better solution please

> Let's find a better solution please

Is there an argument here that Google is creating a monopoly?

Could this be challenged on similar grounds that forced Microsoft to recommend other browsers to users on Windows?

Re: Google broke reCAPTCHA for de-googled Android users

#90

Post by papercruncher »

tardedmeme wrote: post #46
getpokedagain wrote: post #36

Earlier quoted context omitted.

Stop visiting sites and using services that use reCAPTCHA. Problem solved.

With the new reCAPTCHA this is going to happen because most human visitors will actually be unable to pass the CAPTCHA. It will be interesting to see whether this makes websites ditch reCAPTCHA or whether they literally just don't care about having customers, an attitude that seems to be getting more and more common every day.

I have been unable to give my money to Home Depot, REI and a growing list of online retailers because they use Akamai EdgeSuite, which just assumes I am a bot and 403s on protected API calls. This happens consistently on any IP and any browser on my Linux desktop/laptop.
Post reply on HN