Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google broke reCAPTCHA for de-googled Android users

reclaimthenet.org

Post reply on HN
Print view View original

561–570 of 618 posts

Re: Google broke reCAPTCHA for de-googled Android users

#561

Post by palata »

fc417fc802 wrote: post #552
palata wrote: post #547

Earlier quoted context omitted.

Dude, a big reason for age verification is to prevent kids from accessing those "algorithms" you describe. They will always be able to access porn, e.g. over torrent. It will just be a little less accessible, and maybe it won't hurt.

"Think of the children" is the stated reason but not the actual reason. We've seen this pattern so many times that it's perplexing that people continue to fall for it. If the children were the actual reason there are much less invasive solutions that enable reliable parental controls such as mandating self classification of content and fining service operators for inaccuracies. Think for yourself and consider what th…

What is perplexing is that people still don't realise that it is possible to do age verification in a privacy-preserving manner.

> Think for yourself and consider what the possible ulterior motives might be.

Sure, and in the meantime try to think and read about how privacy-preserving age verification actually works.

Re: Google broke reCAPTCHA for de-googled Android users

#562

Post by palata »

fc417fc802 wrote: post #554
drewgross wrote: post #510

Earlier quoted context omitted.

It doesn't provide 100% privacy from everyone, but it does provide privacy from the web service: A worker at a physical store checks your ID, and if it says you are 18, they hand you a token with a unique key on it, which they have a stack of behind the counter. You put the unique key into the web service. It's not necessarily one time use, but if you don't want to risk correlation, you can use each one only once. It…

Well it probably needs a bit more complexity to avoid being trivially broken. Codes are one time use; the service has them attested by the token provider behind the scenes, and the provider is in turn under contract with the government. Tokens are also activated at the point of purchase similar to gift cards in order to prevent bulk theft and resale. A law in the vein of HIPAA prevents collusion between the retail es…

People, you have to read about zero knowledge proofs. Look at e.g. Privacy Pass.

> A law in the vein of HIPAA prevents collusion

No need if you use cryptography. This thing that, you know, works well for encrypting stuff? Spoiler: it can be used for age verification.

Re: Google broke reCAPTCHA for de-googled Android users

#563

Post by palata »

fc417fc802 wrote: post #557
palata wrote: post #540

Earlier quoted context omitted.

> but those are nothing compared to the tradeoffs And my whole point is that it's possible to do age verification in a privacy-preserving manner, and before complaining about the tradeoffs, you should get informed about what they are.

I have yet to see a scheme that would robustly preserve privacy and freedom floated by any of the major efforts. I think the onus is on you to present a workable scheme, but even then I'm not going to support the major efforts which at present are malicious.

I keep mentioning it. Read about Privacy Pass, there is a goddamn RFC for it.

Re: Google broke reCAPTCHA for de-googled Android users

#564

Post by rockskon »

treis wrote: post #73
thecatapps wrote: post #40

I'm failing to see why they didn't just adopt Private Access Tokens (not that they're great either), where they could have at least: - pretended that it wasn't all about invading peoples' privacy. - done a good ol' fashioned "but Apple does it" - pretended to be standards-oriented - advertised it as something completely transparent to the end-user Seems like that would've caused a lot less backlash while still achiev…

It doesn't fundamentally solve anything. You want to be able to identify a specific person or at least a relatively expensive device so that if you ban them they stay banned.

As others in this thread have commented - there are scammer hubs where a single person controls hundreds if not thousands of phones at a time.

The people who this method is most hoping to stop are the least likely to be impacted by it in the long run.

Re: Google broke reCAPTCHA for de-googled Android users

#565

Post by rstuart4133 »

palata wrote: post #562
fc417fc802 wrote: post #554

Earlier quoted context omitted.

Well it probably needs a bit more complexity to avoid being trivially broken. Codes are one time use; the service has them attested by the token provider behind the scenes, and the provider is in turn under contract with the government. Tokens are also activated at the point of purchase similar to gift cards in order to prevent bulk theft and resale. A law in the vein of HIPAA prevents collusion between the retail es…

People, you have to read about zero knowledge proofs. Look at e.g. Privacy Pass. > A law in the vein of HIPAA prevents collusion No need if you use cryptography. This thing that, you know, works well for encrypting stuff? Spoiler: it can be used for age verification.

>> A law in the vein of HIPAA prevents collusion > > No need if you use cryptography.

True for age verification, but not true in general. If you have something that can be used illegally, it's very handy to allow firms to rent / hire it out anyway but make the hirer responsible for any illegal activity.

An example is hiring a car, and the car is used to ram-raid a shop. Today this is solved by handing over a government ID to the rental company. Commit a crime in the car and they hand that over to police, but it has the sad side effect of handing over information to the car rental they can use to track you, and worse sell to others.

Using a zero knowledge proof for a valid driver's licence fixes the privacy problem, but at the expense of the hire company not being able to transfer responsibility for illegal activity onto the hirer. I suspect if that happened no one would hire out cars any more.

You can easily design something that is Zero Knowledge to the car hire firm, but includes an opaque token they can hand over to the government on lawful demand. It contains all the details needed to pursue the law breaking hirer. Thus there is still a role for the law here - you can't always do everything with crypto.

This is a very minor quibble - I agree completely with what I think is your main point. This Google change is a privacy disaster. It's a step towards an enshittified internet with the gateways onto it controlled by a few big tech firms.

But I don't think just yelling "just use ZK" is helpful. It's much harder than that - ZK is only part of the puzzle. Passkeys are currently caught up in the same attestation trap, and there is no workable solution in the offing. Banks and other high trust applications need some assurance your FIDO private key is being handled securely. The solutions on the table are Apple not doing attestation, or Google who does at the low low price of selling your true name to Google. Both "solutions" suck, horribly.

ZK proofs of things like licences and age have to solve the attestation problem, and solve extra stuff as well. I'm not holding my breath.

Re: Google broke reCAPTCHA for de-googled Android users

#567

Post by flossposse »

neilv wrote: post #190

After all the surveillance capitalism abuses over the last 2-3 decades of Web, it's a little late to be pushing back, but... should we start shunning individuals from companies who implement this? Whether it's from companies that create the tech, or companies that use it. In the orgy of money, we've had a kind of industry-wide sociopathic convention of individual engineers considering it perfectly OK to further surve…

We cannot rely on millions of individual workers to take expensive stands on principle. And they shouldn't have to. It's an essential duty for lawmakers and regulators to design the rules of the marketplace in such a way that wealth flows to those who do genuine good for the populace, and to designate certain tools and practices as off-limits because they are incompatible with our society's core values. Google's actions here are a clear antitrust violation and should be blocked/punished. If our representatives don't do so, then they should be punished.

Re: Google broke reCAPTCHA for de-googled Android users

#568

Post by palata »

rstuart4133 wrote: post #565
palata wrote: post #562

Earlier quoted context omitted.

People, you have to read about zero knowledge proofs. Look at e.g. Privacy Pass. > A law in the vein of HIPAA prevents collusion No need if you use cryptography. This thing that, you know, works well for encrypting stuff? Spoiler: it can be used for age verification.

>> A law in the vein of HIPAA prevents collusion > > No need if you use cryptography. True for age verification, but not true in general. If you have something that can be used illegally, it's very handy to allow firms to rent / hire it out anyway but make the hirer responsible for any illegal activity. An example is hiring a car, and the car is used to ram-raid a shop. Today this is solved by handing over a governme…

> But I don't think just yelling "just use ZK" is helpful.

Agreed. I am just very frustrated, because I feel it is an important topic. And I wish I saw adult discussions about it. And instead, people who claim to be "tech-savvy" keep whining about the fact that it will fundamentally leak their ID everywhere. Like they somehow understood the point for E2EE, and repeat it here confidently. If tech-savvy people can't be bothered to understand how this works, why should politicians?

I have the same frustration with the anti-5G crowd yelling that it will boil your blood. There are many valid reasons to criticise 5G and have a constructive debate, but they choose to be wrong anyway.

Re: Google broke reCAPTCHA for de-googled Android users

#569

Post by palata »

JoshTriplett wrote: post #543
palata wrote: post #540

Earlier quoted context omitted.

> but those are nothing compared to the tradeoffs And my whole point is that it's possible to do age verification in a privacy-preserving manner, and before complaining about the tradeoffs, you should get informed about what they are.

I'm well aware of those possibilities. The two biggest problems with them are that 1) they still apply to everyone, rather than only to those who opt into them and 2) governments and companies are in practice going to push for the versions that identify people and provide more information. If you make it possible for governments to decide what content is "limited to adults", they can and will abuse that capability. "…

Yep, I think this would be a totally valid debate. But my frustration is that it's not there at all. We're at "people make it sound like it's technologically impossible, like the ChatControl for E2EE".

It feels like trying to debate about whether 5G is good or not, and the debate is stuck at people claiming that 5G boils your blood. There are valid reasons to oppose 5G, but if people choose to be so wrong that it sounds like bad faith, they surely won't convince me of anything.

Re: Google broke reCAPTCHA for de-googled Android users

#570

Post by palata »

pdntspa wrote: post #492
palata wrote: post #345

Earlier quoted context omitted.

> Much like age verification Age verification as a technical concept can be done in a privacy-preserving manner! Whether or not we want age verification is another debate, but let's stop making wrong technical claims about that: it doesn't help.

Doesn't matter if it is privacy preserving, it is still an evil thing to do

That would be the interesting debate, if people could actually spend 5min learning how it works and stop claiming nonsense.
Post reply on HN