Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google broke reCAPTCHA for de-googled Android users

reclaimthenet.org

Post reply on HN
Print view View original

551–560 of 618 posts

Re: Google broke reCAPTCHA for de-googled Android users

#551

Post by perching_aix »

gorgonian wrote: post #284
deIeted wrote: post #278

Earlier quoted context omitted.

worth noting that google/twitter/facebook/reddit/others colluded to combine sessions, identifiers, so that any person getting identified on any one session / ip would be identified on all so while this comment is apt, i would ask them what they think of the previous chicxulub impact of the 2012 era collusion - which to this day has not been reported on (just realized emacs bindings work in comments, nice, no ctrl-x t…

Colluded how?

By exchanging and correlating data presumably? For example, anything I send or receive on Discord, I see reflected in my YouTube recommendations shortly after. It's downright egregious at times.

Re: Google broke reCAPTCHA for de-googled Android users

#552

Post by fc417fc802 »

palata wrote: post #547
echelon wrote: post #416

Earlier quoted context omitted.

All so kids can't access PornHub? Jesus Christ. 14 year old me ran into porn on the internet all the time. It didn't turn me into a serial killer. Meanwhile we let kids have exposure to algorithms that pervert their sense of self worth, get them addicted to dopamine and gambling, and make them feel inferior to their peers. We have the wrong priorities as a society. And this bullshit is going to turn us into a complet…

Dude, a big reason for age verification is to prevent kids from accessing those "algorithms" you describe. They will always be able to access porn, e.g. over torrent. It will just be a little less accessible, and maybe it won't hurt.

"Think of the children" is the stated reason but not the actual reason. We've seen this pattern so many times that it's perplexing that people continue to fall for it.

If the children were the actual reason there are much less invasive solutions that enable reliable parental controls such as mandating self classification of content and fining service operators for inaccuracies.

Think for yourself and consider what the possible ulterior motives might be.

Re: Google broke reCAPTCHA for de-googled Android users

#553

Post by fc417fc802 »

zyx321 wrote: post #525
michaelt wrote: post #379

Earlier quoted context omitted.

The trick is to define "privacy-preserving age verification" in an extremely narrow way that ignores any other privacy concerns. For example, imagine you put the same private key into the 'secure element' of every single iphone. You use code signing so that key is only unlocked when the phone is running unmodified iOS with all security updates. You use encryption and remote attestation for the front-facing camera and…

OR: The website sends a request for age verification. The app[1] on the user's device[2] forwards that request to the chip on the user's ID card. The user authorizes themselves with their 6 digit PIN stored on the card. The chip produces a signed reply containing the following payload fields: `issuing_country:string` and `over_18:bool` [1] https://github.com/Governikus/AusweisApp [2] iPhone, Android, Windows, MacOS,…

What happens when I set up a tor hidden service that (in conjunction with some client software) stands in for a visitor's device and will proxy any requests back to my personal card? After all the payloads are anonymous so what's the risk to me?

Re: Google broke reCAPTCHA for de-googled Android users

#554

Post by fc417fc802 »

drewgross wrote: post #510
bpfrh wrote: post #367

Earlier quoted context omitted.

Really, how? At some point someone will need to issue a key, which at some point will need to be verified against known good signatures. These signatures will also need to be kept in case of lawsuirs/enforcement, so if somebody gets access they will know you visited that site

It doesn't provide 100% privacy from everyone, but it does provide privacy from the web service: A worker at a physical store checks your ID, and if it says you are 18, they hand you a token with a unique key on it, which they have a stack of behind the counter. You put the unique key into the web service. It's not necessarily one time use, but if you don't want to risk correlation, you can use each one only once. It…

Well it probably needs a bit more complexity to avoid being trivially broken. Codes are one time use; the service has them attested by the token provider behind the scenes, and the provider is in turn under contract with the government. Tokens are also activated at the point of purchase similar to gift cards in order to prevent bulk theft and resale. A law in the vein of HIPAA prevents collusion between the retail establishment and the token provider.

Re: Google broke reCAPTCHA for de-googled Android users

#555

Post by hsbauauvhabzb »

dwedge wrote: post #418
hsbauauvhabzb wrote: post #404

Earlier quoted context omitted.

Ah yes, google, the company who notoriously doesn’t offer any customer support will definitely make way for such complaints.

Drop your sarcasm for long enough to see that "I won't use your app if I have to use Google" is not a complaint _to_ Google. The bank I was talking about were the worst net loser of customers in the UK last year (around -8000) They are making excuses but maybe they would care about why.

The consumers of google captcha will not care if on occasion some failing business attempts to enable graphene or linage users, the userbase of those users is not enough for most companies to care and the ones that do probably aren’t cared for by google.

I hate that this is the way it is, I’m a graphene user too, and I see a pretty bleak future for any unsigned OS, followed by a pretty bleak and authoritarian future for humanity.

Re: Google broke reCAPTCHA for de-googled Android users

#556

Post by fluidcruft »

tardedmeme wrote: post #524
duskdozer wrote: post #392

Earlier quoted context omitted.

It's less about those sites than it is about government services, banking, healthcare, employment, etc

Your online banking will be overrun with bots? Your healthcare will be overrun with bots? What does that even mean?

What they mean is those are the sites that will require attestation. It's pretty quaint to think that people who don't like bots would rather play wackamole with bots when they can just flip a switch and they're gone.

Re: Google broke reCAPTCHA for de-googled Android users

#557

Post by fc417fc802 »

palata wrote: post #540
JoshTriplett wrote: post #520

Earlier quoted context omitted.

> even when you do there are a lot of tradeoffs that come with it Absolutely, but those are nothing compared to the tradeoffs of putting attestation or identity verification (sometimes incorrectly described as "age" verification) on numerous sites and inflicting them on everyone.

> but those are nothing compared to the tradeoffs And my whole point is that it's possible to do age verification in a privacy-preserving manner, and before complaining about the tradeoffs, you should get informed about what they are.

I have yet to see a scheme that would robustly preserve privacy and freedom floated by any of the major efforts. I think the onus is on you to present a workable scheme, but even then I'm not going to support the major efforts which at present are malicious.

Re: Google broke reCAPTCHA for de-googled Android users

#558

Post by andrepd »

AdrianB1 wrote: post #424
andrepd wrote: post #409

Earlier quoted context omitted.

All states/governments have basic records on their citizens and residents, including at least a name, dob, address, etc, at least for a passport, driver's license, if not an actual id card. Let's assume this is acceptable. Then it's technically possible (and really not that difficult) for states to provide a service that issues zero-knowledge proofs of facts like "age > X".

> Let's assume this is acceptable. (partly off-topic rant) One can argue this is a false premise fallacy. For most of the time states did not have this information about their citizens and the world progressed quite nicely. The only argument to know stuff about citizens that don't drive (increasing numbers) nor travel abroad (different problem altogether) is to tax them? One of the foundational differences between hu…

The discussion was about age verification, not about the (rather more extreme) position that it's illegitimate for the state to hold information about its citizens.

> For most of the time states did not have this information about their citizens and the world progressed quite nicely.

This is quite untrue. State bureaucracies far predate the modern era.

Re: Google broke reCAPTCHA for de-googled Android users

#560

Post by cyberax »

qiine wrote: post #481
cyberax wrote: post #82

I think it's possible to run the Play Services in an emulator, faking the device type. Google doesn't seem to use the platform attestation for now.

Really that seem almost too easy ?

For now. They'll likely start requiring device attestation in future, and the emulator can't pass it.
Post reply on HN