Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google broke reCAPTCHA for de-googled Android users

reclaimthenet.org

Post reply on HN
Print view View original

401–410 of 618 posts

Re: Google broke reCAPTCHA for de-googled Android users

#401

Post by Velocifyer »

dakolli wrote: post #250
alexspring wrote: post #218

Earlier quoted context omitted.

Yep. They got hacked in the past, 1k+ smartphones reported. The cost is the attestation keys of a real phone. Once it gets burned, the phone is useless to them. https://www.penligent.ai/hackinglabs/inside-the-ai-phone-far...

Interesting article, thanks. I've done a bit of small scale phone farming (for my own cheap mobile proxies). In all reality the phones aren't that expensive, I went with Moto 5gs that cost $130 (retail), so in their case the phones pay for themselves in the first month. Probably a decent amount of compute cost for video generation, but I'm sure they have access to free compute and inference for being in bed with a16z…

If you are OK with carrier locks (eg if you don't need cell service) and are in the USA, you can actually get mot 5Gs for $30 at walmart. https://www.walmart.com/ip/Straight-Talk-Motorola-Moto-g-202...

Re: Google broke reCAPTCHA for de-googled Android users

#402

Post by mekoka »

getpokedagain wrote: post #36
coppsilgold wrote: post #4

My understanding is that this new reCAPTCHA is basically just remote attestation. Remote attestation doesn't use blind signatures (as that would be 'farmable') so tying the device to the 'attestee' is technically possible with collusion of Google servers: EK (static burned-in private key) -> AIK (ephemeral identity key in secure enclave signed by a Google server) -> attestation (signed by AIK). As you can see if the…

Stop visiting sites and using services that use reCAPTCHA. Problem solved.

[dead]

Re: Google broke reCAPTCHA for de-googled Android users

#403

Post by yard2010 »

BloodyIron wrote: post #222
gonzalohm wrote: post #121

Earlier quoted context omitted.

What's the best alternative for Google drive? I also went this route but Samba is a bit annoying sometimes

Nextcloud, Samba serving SMB isn't really equivalent.

I don't get how Samba is not there yet. We already have everything in the OS, the UI, the mental model, the protocols, how come it's such a terrible experience that we need to re-invent the wheel in web 2.0.. Maybe we need a Jarred Sumner to fix it.

Re: Google broke reCAPTCHA for de-googled Android users

#404

Post by hsbauauvhabzb »

palata wrote: post #351
drnick1 wrote: post #210

Earlier quoted context omitted.

My setup is similar and nearly 100% self-hosted, including email, files, AI. If something does not work on Graphene, I will do without it. I also have a Google profile, mostly for testing purposes.

I said it already in another comment, but if you care enough to use GrapheneOS, I believe you should not only "do without it". You should also complain to those services. If enough people complain, those services will start caring. If all they see is "one user complains every 3 years", they will just ignore it. That's how it works.

Ah yes, google, the company who notoriously doesn’t offer any customer support will definitely make way for such complaints.

Re: Google broke reCAPTCHA for de-googled Android users

#405

Post by JoshTriplett »

harshreality wrote: post #377
Scaled wrote: post #375

Earlier quoted context omitted.

Parental controls on device are a better solution that work today and don't carry a risk of data breach.

They would be a solution if almost all parents used them, but parents don't want to socially isolate their kids since a lot of "social" activity is now on social media. It's kind of a prisoner's dilemma. There's not necessarily wrong. Despite the vapid and damaging nature of most popular online media, isolating a child from it might have even worse social consequences when their real-life peer groups discover that th…

> They would be a solution if almost all parents used them

No, they are a solution for parents who want to use them, and that's all they should be. Their existence demonstrates that it's possible to handle this without regulation, other than the desire of some people to inflict their preferences onto other people's kids.

Re: Google broke reCAPTCHA for de-googled Android users

#406

Post by JoshTriplett »

duskdozer wrote: post #368
getpokedagain wrote: post #36

Earlier quoted context omitted.

Stop visiting sites and using services that use reCAPTCHA. Problem solved.

That's great until it's some essential government, medical, educational, etc. service that you have either no alternative to or no alternative that isn't also using the same thing. I'm already being slowly and incrementally softlocked out of some (fortunately non-essential so far) sites either by cloudflare or other more subtle "anti-bot" networks as time goes on, including some like I've listed above. I can only exp…

> That's great until it's some essential government, medical, educational, etc. service

At which point you should contact your attorney general, and work to ensure such efforts face legal challenges at every turn.

Re: Google broke reCAPTCHA for de-googled Android users

#407

Post by chmod775 »

michaelt wrote: post #379
bpfrh wrote: post #367

Earlier quoted context omitted.

Really, how? At some point someone will need to issue a key, which at some point will need to be verified against known good signatures. These signatures will also need to be kept in case of lawsuirs/enforcement, so if somebody gets access they will know you visited that site

The trick is to define "privacy-preserving age verification" in an extremely narrow way that ignores any other privacy concerns. For example, imagine you put the same private key into the 'secure element' of every single iphone. You use code signing so that key is only unlocked when the phone is running unmodified iOS with all security updates. You use encryption and remote attestation for the front-facing camera and…

That key will get leaked. A key that has to go into every phone, even if done at the manufacturer and onto the TPM chip, will get out.

Also even if it doesn't get leaked directly, the security of TPM chips is not absolute. Secrets from them can theoretically be extracted given an attacker with sufficient means and motivation. Normally nothing that's on a typical TPM chip would warrant a project of that magnitude, but a widely used private key can change that equation.

Plus a TPM chip doesn't really have means to tell the phone isn't being lied to. You could swap out the actual phone camera hardware and sensors for a custom board that feeds the entire phone camera data of your choosing and it would be none-the-wiser.

Re: Google broke reCAPTCHA for de-googled Android users

#408

Post by daneel_w »

tuzakey wrote: post #261
xerox13ster wrote: post #213

Earlier quoted context omitted.

How have you managed to accomplish self-hosted email? I tried similar in 2022 and found it damn near impossible without business static IP or a cloud provider.

You can't do it reliably without a static IP in a non residential subnet that lets you set reverse dns. If you have a static residential IP and they don't filter inbound SMTP you can make it work with a smarthost/relay like mailgun. Its not the insurmountable obstacle everyone makes it out to be, but its not going to be free unless you already have an IP that meets the criteria. If you don't have a static IP you need…

My approach is to run a VPS with multiple static IPs that I (using Wireguard) tunnel to a number of virtual machines I host at home on a microserver. Likewise, the virtual machines' primary view of the Internet starts on the opposite side of the tunnel.

Re: Google broke reCAPTCHA for de-googled Android users

#409

Post by andrepd »

bpfrh wrote: post #367
palata wrote: post #345

Earlier quoted context omitted.

> Much like age verification Age verification as a technical concept can be done in a privacy-preserving manner! Whether or not we want age verification is another debate, but let's stop making wrong technical claims about that: it doesn't help.

Really, how? At some point someone will need to issue a key, which at some point will need to be verified against known good signatures. These signatures will also need to be kept in case of lawsuirs/enforcement, so if somebody gets access they will know you visited that site

All states/governments have basic records on their citizens and residents, including at least a name, dob, address, etc, at least for a passport, driver's license, if not an actual id card. Let's assume this is acceptable.

Then it's technically possible (and really not that difficult) for states to provide a service that issues zero-knowledge proofs of facts like "age > X".

Re: Google broke reCAPTCHA for de-googled Android users

#410

Post by IshKebab »

getpokedagain wrote: post #36
coppsilgold wrote: post #4

My understanding is that this new reCAPTCHA is basically just remote attestation. Remote attestation doesn't use blind signatures (as that would be 'farmable') so tying the device to the 'attestee' is technically possible with collusion of Google servers: EK (static burned-in private key) -> AIK (ephemeral identity key in secure enclave signed by a Google server) -> attestation (signed by AIK). As you can see if the…

Stop visiting sites and using services that use reCAPTCHA. Problem solved.

Or stop spreading this extraordinarily naive view of how the world works.
Post reply on HN