Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google broke reCAPTCHA for de-googled Android users

reclaimthenet.org

Post reply on HN
Print view View original

531–540 of 618 posts

Re: Google broke reCAPTCHA for de-googled Android users

#531

Post by YourDadVPN »

coppsilgold wrote: post #523
palata wrote: post #345

Earlier quoted context omitted.

> Much like age verification Age verification as a technical concept can be done in a privacy-preserving manner! Whether or not we want age verification is another debate, but let's stop making wrong technical claims about that: it doesn't help.

As far as I know no currently proposed age verification method does this in practice. The only way to implement truly privacy preserving age verification is through zero knowledge proofs (or blind signatures) but what that would allow is undetectable token forging.

The EU's proposed system uses ZK proof. You get a PGP signed message from "someone" who knows your identity (government or private agency) then store it on your phone to pass to websites that need your age. It does have an obvious flaw in that whoever you give the token to has no proof it's actually yours.

https://ageverification.dev/av-doc-technical-specification/d...

Re: Google broke reCAPTCHA for de-googled Android users

#532

Post by fsflover »

cyklosarin wrote: post #112
fsflover wrote: post #65

Earlier quoted context omitted.

TPMs can also be based on free software and our own keys. It works well with Heads and Librem Key.

TPM with things like Heads are borderline zero security and theater compared to actually decent implementations on Android/iOS platforms, I doubt the big companies would rely on that. TPM in general on non Mac/Chromebook PCs is mediocre even from big OEMs.

Do you have any evidence if this? Qubes team disagrees with you.

Re: Google broke reCAPTCHA for de-googled Android users

#533

Post by palata »

quantummagic wrote: post #376
palata wrote: post #362

Earlier quoted context omitted.

I disagree. The reason we are where we are today is the lack of antitrust.

Even if we accept your premise, laws don't just appear; they are an organized response to a recognized problem. But everyone has been sleeping on the problem lurking in our infrastructure, undermining any impetus to enact such laws. And the people screaming from the mountain top (like Stallman), trying to raise awareness, were routinely mocked and marginalized by those all too happy to accept convenience and expedien…

> laws don't just appear

Antitrust laws have existed for decades. They just have to be honoured.

Re: Google broke reCAPTCHA for de-googled Android users

#534

Post by palata »

hsbauauvhabzb wrote: post #404
palata wrote: post #351

Earlier quoted context omitted.

I said it already in another comment, but if you care enough to use GrapheneOS, I believe you should not only "do without it". You should also complain to those services. If enough people complain, those services will start caring. If all they see is "one user complains every 3 years", they will just ignore it. That's how it works.

Ah yes, google, the company who notoriously doesn’t offer any customer support will definitely make way for such complaints.

Not to Google, and not to any of the TooBigTech, obviously. For those, we need to enforce regulations (that already exist but are ignored). As a user, the only thing you can do against TooBigTech is to complain to your government (if they can listen, e.g. in the EU there is a DMA entity that you can and should contact).

But for companies that are not monopolies, you can complain to them, and you can give them a bad review on the Play Store. Most companies are not in the business of screwing you: if they screw you, it's just a collateral effect. If you want to be on their radar, you have to make noise.

If enough people complain, then the company sees a need, then they prioritise. If they believe that "it only affects 1 guy who complained 2 years ago", of course they won't do anything... and I don't even know if I would blame them for that.

Re: Google broke reCAPTCHA for de-googled Android users

#535

Post by phyzome »

SJMG wrote: post #511
phyzome wrote: post #246

Earlier quoted context omitted.

I don't have one either. No plans to get one, even with this.

No cell phone period or no smart phone? I'm not sure how people manage the former. Do you have a home with a land line? What do you do when you travel?

Ah, I have a cell phone, not a smartphone. (Didn't notice that the parent comment referred to both.)

Re: Google broke reCAPTCHA for de-googled Android users

#536

Post by palata »

YourDadVPN wrote: post #531
coppsilgold wrote: post #523

Earlier quoted context omitted.

As far as I know no currently proposed age verification method does this in practice. The only way to implement truly privacy preserving age verification is through zero knowledge proofs (or blind signatures) but what that would allow is undetectable token forging.

The EU's proposed system uses ZK proof. You get a PGP signed message from "someone" who knows your identity (government or private agency) then store it on your phone to pass to websites that need your age. It does have an obvious flaw in that whoever you give the token to has no proof it's actually yours. https://ageverification.dev/av-doc-technical-specification/d...

> It does have an obvious flaw in that whoever you give the token to has no proof it's actually yours.

Which isn't necessarily a flaw, depends on the threat model. For actual age verification that we care about (e.g. make it harder for kids to access social media), it may be good enough.

Re: Google broke reCAPTCHA for de-googled Android users

#537

Post by palata »

Arch-TK wrote: post #394
bpfrh wrote: post #367

Earlier quoted context omitted.

Really, how? At some point someone will need to issue a key, which at some point will need to be verified against known good signatures. These signatures will also need to be kept in case of lawsuirs/enforcement, so if somebody gets access they will know you visited that site

It should be possible with zero knowledge proofs. The problem is that while you might be able to trust the crypto, the government won't trust you to do the crypto entirely by yourself. And this introduces avenues for deanonymisation. Moreover, collusion between the government and the entity making the age check can also theoretically deanonimize. It's a complicated problem. We continue to seek a technological solutio…

> Moreover, collusion between the government and the entity making the age check can also theoretically deanonimize.

Hmmm... no? That's not how zero knowledge works.

Re: Google broke reCAPTCHA for de-googled Android users

#538

Post by palata »

brookst wrote: post #480
bpfrh wrote: post #367

Earlier quoted context omitted.

Really, how? At some point someone will need to issue a key, which at some point will need to be verified against known good signatures. These signatures will also need to be kept in case of lawsuirs/enforcement, so if somebody gets access they will know you visited that site

Look at Apple’s PAT: the website knows the service that did the attestation, but not the user. The service knows the user, but not the website. If you controlled both you can link the user, but otherwise you can’t.

Yes, but they can still collude. It's possible to do age verification in a way that prevents that. Look e.g. at Privacy Pass.

Re: Google broke reCAPTCHA for de-googled Android users

#539

Post by palata »

Scaled wrote: post #375
bpfrh wrote: post #367

Earlier quoted context omitted.

Really, how? At some point someone will need to issue a key, which at some point will need to be verified against known good signatures. These signatures will also need to be kept in case of lawsuirs/enforcement, so if somebody gets access they will know you visited that site

Parental controls on device are a better solution that work today and don't carry a risk of data breach.

Zero knowledge proofs don't carry a risk of data breach, because they are zero knowledge.

Re: Google broke reCAPTCHA for de-googled Android users

#540

Post by palata »

JoshTriplett wrote: post #520
sumeno wrote: post #486

Earlier quoted context omitted.

You haven't tried to use parental controls much have you? They are all terrible. They are insanely difficult to get set up properly and even when you do there are a lot of tradeoffs that come with it.

> even when you do there are a lot of tradeoffs that come with it Absolutely, but those are nothing compared to the tradeoffs of putting attestation or identity verification (sometimes incorrectly described as "age" verification) on numerous sites and inflicting them on everyone.

> but those are nothing compared to the tradeoffs

And my whole point is that it's possible to do age verification in a privacy-preserving manner, and before complaining about the tradeoffs, you should get informed about what they are.

Post reply on HN