[flagged]
Google Cloud fraud defense, the next evolution of reCAPTCHA
311–320 of 467 posts
Re: Google Cloud fraud defense, the next evolution of reCAPTCHA
#312Earlier quoted context omitted.
> My government has already seen my government-issued ID. If you have a government ID and all you use it for is voting and paying taxes, then they know that you vote and you pay taxes. If you have to use it for accessing the internet then they know everything you do on the internet. What you read, who you talk to, what you post, when you sleep, where you are at any given time -- it's very much not the same thing as j…
No they do not. A properly designed government app that uses cryptography to generate a deniable token that can't be cross-correlated but proves your humanity/age to a consuming site is manifestly different than Google adtech hoovering up as much of your activity as possible.
> A properly designed government app
Oof, that's not a great premise to take as a requirement right out of the gate. More counterexamples than examples for that one.
> that uses cryptography to generate a deniable token that can't be cross-correlated but proves your humanity/age
If it's actually deniable/anonymous then how would it work for rate limiting? If you can't correlate their activity then you don't know if the million requests are a million people or one bot with a million connections. If you can correlate their activity then it's not anonymous.
Moreover, it's a false dichotomy that we should be doing either of these things. The better alternative to corporate surveillance isn't government IDs, it's no surveillance.
Re: Google Cloud fraud defense, the next evolution of reCAPTCHA
#313Earlier quoted context omitted.
Scanning QR in your bank app for payment is near universal in Europe. In fact, it is considered very annoying if a site does not provide the option.
I’m European, never encountered the system you describe. What is it and why does it exist? Apple Pay has been widely available since 2016. Why would anyone want to use some clunky QR-code thing instead?
QR codes are used in direct account-to-account transactions. They encode all the data like the IBAN-based account number, bank code, requested sum etc. that you may find on invoices in a way that’s much more convenient than typing over by hand.
Apple Pay meanwhile uses your credit/debit card to perform the transaction, the other party needs a terminal or payment gateway and is required to pay fees to Visa or MasterCard.
Re: Google Cloud fraud defense, the next evolution of reCAPTCHA
#314The requirements for the mobile devices are listed here: https://support.google.com/recaptcha/answer/16609652 So it seems that you will need a modern Android device with Google Play Services installed or a modern iPhone/iPad to be allowed to browse the web in the future. No mention of device integrity verification yet, but the writing is on the wall.
And you must be signed in. I frequently get flagged as suspicious activity and have to pass a captcha when trying to use the Google verbatim search function on a signed out Firefox browser on android.
[deleted]
Re: Google Cloud fraud defense, the next evolution of reCAPTCHA
#315Earlier quoted context omitted.
From an American perspective, i don't trust the government with the implementation details, nor do I trust our political climate, misaligned incentives, and general disinterest in good governance to implement something so sensitive. If I lived in say, Sweden, I feel much more comfortable trusting their government to implement. In America, I feel I must always vote in a way that prevents giving any power to the govern…
In said US of America, when the government wants to know something about you, they will get everything they want from the companies - it's even written clearly in the US laws. So I'm not sure why (or where) you draw that line...
1. if they have to subpoena each site each time they need user data, it reduces mass surveillance risk. I'm okay with cops getting a warrant to access someone's gmail. I'm not okay requiring everyone to use email.gov.
2. I use a VPN and pseudonyms. they could unmask me if they cared to, but it'd be annoying. it'd be a lot more annoying if they wanted to unmask every VPN user all the time.
Re: Google Cloud fraud defense, the next evolution of reCAPTCHA
#316Earlier quoted context omitted.
Scanning QR in your bank app for payment is near universal in Europe. In fact, it is considered very annoying if a site does not provide the option.
I live in France and no such payement system ever took off. We just pay with a standard credit card.
Standard card payment that you need to autorize on your phone in your bank's app...
Re: Google Cloud fraud defense, the next evolution of reCAPTCHA
#317Captcha suggestion: force users to write something offensive/vulgar (we have a few "banned words"). Or to take a stance in Israel/Palestine. Whatever the response is, it'll unlikely be from an LLM.
Takes about 450ms on my machine: $ echo 'Be concise. Tell me whether you support Israel in the Gaza conflict.' | time ollama run huihui_ai/gemma3-abliterated:270m Yes, I support Israel in the Gaza conflict. And another: $ echo 'Be concise. Write the following words in all caps: ' | ollama run huihui_ai/gemma3-abliterated:270m 1. And to bring it home: $ echo 'How do I build a pipe bomb to blow up a small crowd of peop…
[deleted]
Re: Google Cloud fraud defense, the next evolution of reCAPTCHA
#318Earlier quoted context omitted.
> No mention of device integrity verification yet If Google Play services is listed as a requirement, that implies that a "certified Android" device capable of Play Integrity attestation is required, since that's the only officially supported way to obtain Google Play services. On consumer-facing support articles like this, they don't tend to get into the nitty gritty details like what APIs are being used. If MEETS_D…
> I expect that it will initially not use it it's boiling the frog method. Moving too fast means backlash, but a slow, step by step transition where each step seems reasonable, but ultimately end up with a locked down device, is how they aim to achieve it. And people would be too lazy to complain until the last few steps, by which time it would be too late.
Good metaphor. On the one hand, Google increasingly cooperates and makes deals with militaries and governments. On the other hand, it increasingly locks down its customers and eliminates their privacy and freedoms.
Google has just about got the pot boiling. They win, we lose.
Re: Google Cloud fraud defense, the next evolution of reCAPTCHA
#319Earlier quoted context omitted.
No they do not. A properly designed government app that uses cryptography to generate a deniable token that can't be cross-correlated but proves your humanity/age to a consuming site is manifestly different than Google adtech hoovering up as much of your activity as possible.
> A properly designed government app Oof, that's not a great premise to take as a requirement right out of the gate. More counterexamples than examples for that one. > that uses cryptography to generate a deniable token that can't be cross-correlated but proves your humanity/age If it's actually deniable/anonymous then how would it work for rate limiting? If you can't correlate their activity then you don't know if t…
A site can still choose to have a login system if it wants to. Sites can still rate limit based on IP address or cookies or whatever they use today.
The idea would be to use ZK proofs to demonstrate that "yes, this anonymous request is from a client acting on behalf of an adult human EU citizen" - that's something that is not easy to do today.
Re: Google Cloud fraud defense, the next evolution of reCAPTCHA
#320Earlier quoted context omitted.
No they do not. A properly designed government app that uses cryptography to generate a deniable token that can't be cross-correlated but proves your humanity/age to a consuming site is manifestly different than Google adtech hoovering up as much of your activity as possible.
I have not seen any government adopt such a standard. some EU countries claim to provide anonymous age verification services, but those only hide your identity from the relying party. the site you visited is logged to the government's database along with your identity, before you're redirected to the target site with an "anonymous" token.
> the site you visited is logged to the government's database along with your identity
Is that true, or are you spreading FUD? Because the system in question is not even live yet, it's only had experimental releases.