Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google broke reCAPTCHA for de-googled Android users

reclaimthenet.org

Post reply on HN
Print view View original

501–510 of 618 posts

Re: Google broke reCAPTCHA for de-googled Android users

#501

Post by thayne »

pixel_popping wrote: post #450
stavros wrote: post #435

Earlier quoted context omitted.

If you don't understand something, the first thing to do is try to understand it, before going to "the people who use this are incompetent". In this case, the answer is right there in the question: You have to pay to bypass it.

Sometimes, people just do dumb choices, there is nothing to understand except plain lazyness, there is better captchas, free, non-invasive, more secure, GDPR compliant and so-on that are also not covered by captcha-solving providers, so what's the positive argument about reCaptcha?

I was involved in evaluating captcha solutions. The only recaptcha alternative that met the requirements that we were able to find has hcaptcha, but it wasn't any cheaper (for us), and would require going through the vendor approval process, whereas google was already an approved vendor. There wasn't really a compelling reason to switch.

Maybe there is a better option out there, but if so, it has the disadvantage of being hard to find.

Re: Google broke reCAPTCHA for de-googled Android users

#502

Post by thayne »

pixel_popping wrote: post #468
stavros wrote: post #451

Earlier quoted context omitted.

A very strong brand?

You really think it's the reason? I've worked with many developers, and they use reCaptcha just because they are used to it and did it in the past, I doubt customers love the "reCaptcha branding", to the contrary, nicer captchas (or even invisible ones, even better) improve retention.

> or even invisible ones

reCaptcha is "invisible" by default. Although if you use a non-cheomium browser and/or block tracking, you are more likely to trigger a non-invisible prompt. Annoying as that is for people like me and maybe you, that isn't the experience most users have.

Re: Google broke reCAPTCHA for de-googled Android users

#503

Post by clort »

tardedmeme wrote: post #423
duskdozer wrote: post #421

Earlier quoted context omitted.

Does it work if you spoof the user agent? > -Use of developer or inspection tools Gotta love it.

Developer tools are easily detected by looking for the viewport to resize a certain amount.

I just opened the developer tools, then chose 'Separate Window' from the menu. The developer tools are now on my other screen, and then I clicked Reply to your message. The developer tools window that I had open is not relating to this tab, but when I opened Developer Tools for this tab, it remembered that I wanted it in a separate window and did so again. The viewport should not have changed at all..?

Re: Google broke reCAPTCHA for de-googled Android users

#504

Post by wasmitnetzen »

medvidek wrote: post #380
duskdozer wrote: post #368

Earlier quoted context omitted.

That's great until it's some essential government, medical, educational, etc. service that you have either no alternative to or no alternative that isn't also using the same thing. I'm already being slowly and incrementally softlocked out of some (fortunately non-essential so far) sites either by cloudflare or other more subtle "anti-bot" networks as time goes on, including some like I've listed above. I can only exp…

For some reason, I'm softlocked from booking tickets from Deutsche Bahn. The website errors out with a cryptic "Your browser's behavior resembles that of a bot." message with no option to try again or pass a captcha or whatever. The website itself described several possible solutions but none helped (I tried using different computers, different internet connections, even a phone connected to internet using a SIM from…

DB has been finicky for me from abroad as well, using a VPN to Germany usually helped. Still sucks though.

Re: Google broke reCAPTCHA for de-googled Android users

#505

Post by clort »

tardedmeme wrote: post #48
thaumasiotes wrote: post #44

Earlier quoted context omitted.

Can they present themselves as... web browsers?

Yes, and then they'll get served a QR code that you have to scan on a phone Google approves of.

In the UK, the Department of Education guidance is that schools should be mobile-phone free. Students use computers to access the web fairly regularly. Guess that would be problematic then, since many schools policies is that mobile phones should be turned off and stored in your bag during the day.

Re: Google broke reCAPTCHA for de-googled Android users

#507

Post by jollymonATX »

palata wrote: post #345
coppsilgold wrote: post #4

My understanding is that this new reCAPTCHA is basically just remote attestation. Remote attestation doesn't use blind signatures (as that would be 'farmable') so tying the device to the 'attestee' is technically possible with collusion of Google servers: EK (static burned-in private key) -> AIK (ephemeral identity key in secure enclave signed by a Google server) -> attestation (signed by AIK). As you can see if the…

> Much like age verification Age verification as a technical concept can be done in a privacy-preserving manner! Whether or not we want age verification is another debate, but let's stop making wrong technical claims about that: it doesn't help.

Exactly the mindset that got us to this current reality..

Re: Google broke reCAPTCHA for de-googled Android users

#508

Post by jollymonATX »

getpokedagain wrote: post #36
coppsilgold wrote: post #4

My understanding is that this new reCAPTCHA is basically just remote attestation. Remote attestation doesn't use blind signatures (as that would be 'farmable') so tying the device to the 'attestee' is technically possible with collusion of Google servers: EK (static burned-in private key) -> AIK (ephemeral identity key in secure enclave signed by a Google server) -> attestation (signed by AIK). As you can see if the…

Stop visiting sites and using services that use reCAPTCHA. Problem solved.

Removing recaptcha from my sites now actually. Its not much, but its something.

Re: Google broke reCAPTCHA for de-googled Android users

#510

Post by drewgross »

bpfrh wrote: post #367
palata wrote: post #345

Earlier quoted context omitted.

> Much like age verification Age verification as a technical concept can be done in a privacy-preserving manner! Whether or not we want age verification is another debate, but let's stop making wrong technical claims about that: it doesn't help.

Really, how? At some point someone will need to issue a key, which at some point will need to be verified against known good signatures. These signatures will also need to be kept in case of lawsuirs/enforcement, so if somebody gets access they will know you visited that site

It doesn't provide 100% privacy from everyone, but it does provide privacy from the web service: A worker at a physical store checks your ID, and if it says you are 18, they hand you a token with a unique key on it, which they have a stack of behind the counter. You put the unique key into the web service. It's not necessarily one time use, but if you don't want to risk correlation, you can use each one only once. It's just like alcohol sales, and has all the same failure modes as alcohol sales, but if it's good enough for alcohol sales it's good enough for web services.
Post reply on HN