Google Cloud Fraud Defence is just WEI repackaged • Hacker News Board

Re: Google Cloud Fraud Defence is just WEI repackaged

#391

Post by account42 » Mon, May 11, 2026, 11:20 AM UTC

somat wrote: post #201

spankalee wrote: post #18

Given all the negative comments here - what is anyone's alternate solution for AI-driven fraudulent activity? CAPTCHAs are increasingly ineffective. Services are either going to go offline or implement some kind of system like this. PII like credit cards or SSNs aren't enough because those are regularly stolen. So where do things go? Fewer services and infinite fraud?

CAPTCHA is sort of a flawed concept in the first place. a machine to test if another agent is a machine. But I figure the future of this is give the test, but discard the answer, the truth is in how it is answered, behavioral analyses, see if their access patterns are human or machine like. A simple version of which is how fast they type, or speed items are clicked. A surveillance process that really creeps me out. I…

Behavioral analysis is not the future of CAPTHAs, it's how they have worked for years.

Re: Google Cloud Fraud Defence is just WEI repackaged

#392

Post by crazygringo » Mon, May 11, 2026, 11:51 PM UTC

walletdrainer wrote: post #387

crazygringo wrote: post #130

Earlier quoted context omitted.

Me. I think the idea is sad and tragic , but also that we are at the point where we have no choice but to do something. AI/LLM's have created a vector for abuse that previous tools are failing to protect against, and the problem is only getting worse. I'm sick of the increase of LLM slop on websites in comments and posts. I'm sick of how fraud and spam and abuse can be increasingly automated in ways current tools can…

>I don't realistically see any alternative but for some kind of reliable signal that a web request is most likely coming from a real person (not a perfect guarantee, but something good enough). Which means some kind of attestation that it's a real hardware device that costs at least a few bucks and is making human-level numbers of requests (not millions per day), or else some kind of digital ID attestation system. Af…

Hashcash was a really intriguing idea. But it fell completely apart once it was realized that spammers could use botnets to do all the proof of work for free.

Plus Hashcash isn't a great solution for mobile devices especially, as it uses up battery and low-end devices particularly suffer. And obviously challenges have to get harder every year to keep up with high-end hardware, which makes older hardware become increasingly unusable even faster for web browsing.

So unfortunately it is not a solved problem. That's why device attestation still seems like the least-bad solution right now.

Re: Google Cloud Fraud Defence is just WEI repackaged

#393

Post by walletdrainer » Tue, May 12, 2026, 7:52 AM UTC

crazygringo wrote: post #392

walletdrainer wrote: post #387

Earlier quoted context omitted.

>I don't realistically see any alternative but for some kind of reliable signal that a web request is most likely coming from a real person (not a perfect guarantee, but something good enough). Which means some kind of attestation that it's a real hardware device that costs at least a few bucks and is making human-level numbers of requests (not millions per day), or else some kind of digital ID attestation system. Af…

Hashcash was a really intriguing idea. But it fell completely apart once it was realized that spammers could use botnets to do all the proof of work for free. Plus Hashcash isn't a great solution for mobile devices especially, as it uses up battery and low-end devices particularly suffer. And obviously challenges have to get harder every year to keep up with high-end hardware, which makes older hardware become increa…

Why would we stick to hashcash when we have decades of work built on it?

You can trivially substitute device attestation with e.g. proof of burn.

Instead of tying attestation to specific hardware manufacturers and configurations, it can be trivially tied to monetary value.

Re: Google Cloud Fraud Defence is just WEI repackaged

#394

Post by Worf » Wed, May 13, 2026, 5:24 PM UTC

fsflover wrote: post #381

Worf wrote: post #312

Earlier quoted context omitted.

From what I've seen no such solution guarantees privacy to the user if the signing body (or the government) and the website collude to deanonymize the user.

What if the the government signs your private key but doesn't store the list of people who requested this?

Can you elaborate on how that would work exactly? What would the flow be - which party would request what from whom? Would there be technical assurances that no list is stored by the government?