[dead]
Google broke reCAPTCHA for de-googled Android users
131–140 of 618 posts
Re: Google broke reCAPTCHA for de-googled Android users
#132Earlier quoted context omitted.
The domain in the attestation would be yours, so that wouldn't work
How would the phone camera know the domain name of the website displaying the QR code it's scanning?
The camera isn't the part doing that verification. The google service serving that "reCAPTCHA" is what's doing that validation. Unless you're using a custom browser that is reporting a different domain to google than the one requesting the reCAPTCHA, google's service will know which domain is which.
Re: Google broke reCAPTCHA for de-googled Android users
#133My understanding is that this new reCAPTCHA is basically just remote attestation. Remote attestation doesn't use blind signatures (as that would be 'farmable') so tying the device to the 'attestee' is technically possible with collusion of Google servers: EK (static burned-in private key) -> AIK (ephemeral identity key in secure enclave signed by a Google server) -> attestation (signed by AIK). As you can see if the…
If you run a website, it seems trivial to forward the attestation to someone else by putting the same code up on your website, and getting their device banned from google instead of your own.
Realistically, what Google will do in such a scenario is collect data about the illicit service, enumerate the devices the farm uses and what other activities the devices participate in. What you suggested has far less control over the devices that generate the attestations and it will show.
Also, if the implementation is competently done the phone will show the website for which you scanned the QR code. A user would be able to see whether or not that matches the site where they observed the QR code and proceed accordingly. In time Google will probably integrate it into the Chrome browser where a proxied QR code cannot even be shown.
Re: Google broke reCAPTCHA for de-googled Android users
#134This is crossing the line where the governments should step in and ban/fine google heavilly for this monopol behavior
How you know this is a monopoly is that if you go on their documentation website half the video is how this rolls into Google Analytics.
This is using another product to reinforce the search and ads monopoly.
You can’t scrape content to build a better google or Gemini, you can’t make an OS to compete with Google or Apple, and you can’t make a Google Analytics competitor.
It’s plain anti competitive.
Re: Google broke reCAPTCHA for de-googled Android users
#135Sites that use reCAPTCHA/Turnstile/etc. have already been broken for me for years now due to neverending captcha/refresh loops. My ISP regularly changes everyone's IP, and I apparently share an ISP with people who suck, so I get flagged just trying to do all sorts of normal things. Some examples: - I've never bought anything from Etsy but I'm somehow banned from even viewing their site at all. - Discord immediately b…
This is why I ended up paying extra for a static IP from my ISP. While they always provided me with a public IP outside a CGNAT, I guess whole IP blocks were being targeted by these web security providers.
I guess my ISP allocates static IPs from a separate pool, and probably my IP block neighbors are better behaved (probably SMBs and other fellow nerds), aside from platforms learning that my IP is safe.
Captcha difficulties are way down now.
Re: Google broke reCAPTCHA for de-googled Android users
#136Earlier quoted context omitted.
How would the phone camera know the domain name of the website displaying the QR code it's scanning?
The camera isn't the part doing that verification. The google service serving that "reCAPTCHA" is what's doing that validation. Unless you're using a custom browser that is reporting a different domain to google than the one requesting the reCAPTCHA, google's service will know which domain is which.
How does the verification app on your phone know what's in the URL bar on your desktop?
Re: Google broke reCAPTCHA for de-googled Android users
#137Does anyone know what changed in iOS 16.5 that made Google stop requiring the app? To me it seems to correlate with Private Access Tokens, aka remote attestation by Apple. https://developer.apple.com/videos/play/wwdc2022/10077/
Re: Google broke reCAPTCHA for de-googled Android users
#138Earlier quoted context omitted.
If you run a website, it seems trivial to forward the attestation to someone else by putting the same code up on your website, and getting their device banned from google instead of your own.
The domain in the attestation would be yours, so that wouldn't work
Some people will notice, some will not
Re: Google broke reCAPTCHA for de-googled Android users
#139I've kept a spare cheap android for too long and recently went with Graphene instead. I have one Google profile and only use it for Uber, work's Google Chat and maps. One bank refused to work (even with Google services) so I moved bank. I've moved most of my mobile use to self hosted (freshrss full text, password manager, calendar, tasks) with no direct internet connection. It's a bit irritating but I'm glad I starte…
What's the best alternative for Google drive? I also went this route but Samba is a bit annoying sometimes
Syncthing is very nice.
Re: Google broke reCAPTCHA for de-googled Android users
#140Earlier quoted context omitted.
The camera isn't the part doing that verification. The google service serving that "reCAPTCHA" is what's doing that validation. Unless you're using a custom browser that is reporting a different domain to google than the one requesting the reCAPTCHA, google's service will know which domain is which.
How does the verification app on your phone know what's in the URL bar on your desktop?
The QR code/URL would be generated/requested by the javascript running on the website you're viewing, which knows what's in your address bar.