Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google broke reCAPTCHA for de-googled Android users

reclaimthenet.org

Post reply on HN
Print view View original

571–580 of 618 posts

Re: Google broke reCAPTCHA for de-googled Android users

#571

Post by baranul »

tjpnz wrote: post #441
Scaled wrote: post #375

Earlier quoted context omitted.

Parental controls on device are a better solution that work today and don't carry a risk of data breach.

Parental controls are intentionally gimped. They do the bare minimum while providing more than enough wiggle room for a tech savvy teenager. To implement a robust parental control scheme you need network level filtration which isn't something the average parent will know anything about.

I disagree with that, because the teenager should be the parent's responsibility, regardless of how smart or savvy they are. Parents should be talking to their children, communicating what their and society's expectations are. If the parents are attempting to exert technical control over their children, by home router for example, there should be websites or computer shops they can go to. If the parents don't care or are not smart enough to keep up with their teenager, then no type of state mandated gimmick will either.

Teenagers, at that level of intelligence or are that determined, will find ways to circumvent whatever control mechanisms a parent or school is attempting to use. At some point, it is a matter of the teenager respecting their parents and rules. Same for if you told a teenager do not drink and drive. You can setup all kinds of technical barriers to block drunk teenagers from driving, but if they are that "smart", those committed to bad behavior or law breaking will find ways.

Re: Google broke reCAPTCHA for de-googled Android users

#572

Post by rvz »

surajrmal wrote: post #462
rvz wrote: post #334

Earlier quoted context omitted.

> He had the power to stop this madness from big tech, but he sided with them. He (Torvalds) had no power to do anything and sold out. Even if he did, big tech would just go and use BSD. For over a decade both Torvalds, and Stallman sold everyone out. They don't make their money directly from "free software" or "open source" in the first place. Stallman was right in that he knew digital surveillance was going to happ…

What do you define as selling out? Having a different perspective from your own? There are many legitimate reasons for why someone can believe the opposing view points. Devolving into us vs them rhetoric is not conducive to a reasonable conversation.

> What do you define as selling out?

I think you need to read the comment again:

>> They don't make their money directly from "free software" or "open source" in the first place.

>> He (Stallman) knows he doesn't make money from "free software" but only by speaking about it. Torvalds is the same...

My (unanswered) question:

> Can any other developer do exactly that in 2026?

To avoid repeating myself, the point is the majority of these typical developers do not have the level of influence that both Stallman, and Torvalds have to make a lot of money from their open source projects, especially in the age of AI; making it pointless to maintain such projects.

Re: Google broke reCAPTCHA for de-googled Android users

#573

Post by drewfax »

palata wrote: post #363
drewfax wrote: post #315

Earlier quoted context omitted.

I wish Linus had adopted GPL v3. He had the power to stop this madness from big tech, but he sided with them. It just reveals that he never fully understood the reason for the existence of GPL in the first place.

GPLv3 would not prevent remote attestation AT ALL .

GPL v3 specifically requires the vendor distributing the GPL v3 components to allow the user to change the software on the end user device. This means no more locked bootloader. We would have had choice to install custom Android distributions and thus less Google monopoly.

Re: Google broke reCAPTCHA for de-googled Android users

#574

Post by palata »

drewfax wrote: post #573
palata wrote: post #363

Earlier quoted context omitted.

GPLv3 would not prevent remote attestation AT ALL .

GPL v3 specifically requires the vendor distributing the GPL v3 components to allow the user to change the software on the end user device. This means no more locked bootloader. We would have had choice to install custom Android distributions and thus less Google monopoly.

It was always possible to install Android alternatives, GPLv3 has nothing to do with it. I have nothing against GPLv3 of course, but this is just not true.

Remote attestation is the thing preventing the app from running on your Android alternative, whether it's GPLv3 or not does not matter. GPLv3 does not say "it's illegal to do remote attestation".

Re: Google broke reCAPTCHA for de-googled Android users

#575

Post by rstuart4133 »

palata wrote: post #568
rstuart4133 wrote: post #565

Earlier quoted context omitted.

>> A law in the vein of HIPAA prevents collusion > > No need if you use cryptography. True for age verification, but not true in general. If you have something that can be used illegally, it's very handy to allow firms to rent / hire it out anyway but make the hirer responsible for any illegal activity. An example is hiring a car, and the car is used to ram-raid a shop. Today this is solved by handing over a governme…

> But I don't think just yelling "just use ZK" is helpful. Agreed. I am just very frustrated, because I feel it is an important topic. And I wish I saw adult discussions about it. And instead, people who claim to be "tech-savvy" keep whining about the fact that it will fundamentally leak their ID everywhere. Like they somehow understood the point for E2EE, and repeat it here confidently. If tech-savvy people can't be…

> If tech-savvy people can't be bothered to understand how this works

You underestimate your own abilities. Tech savvy doesn't mean they think much about crypto.

To get a feel for this I asked Gemini "If you were to survey a group of people who would be called "Tech Savvy", what percentage of them would be aware you could construct a zero knowledge proof for a person's age that revealed nothing beyond they were older than a given threshold?". The answer was 5%..10%. That rises to a surprising low 20%..30% for Software Engineers. It's only once you get to Software Engineers who write security systems that you get above 50%.

Gemini didn't give any references so those figures could be complete rubbish, but in my experience they seem on the high side. Many very experienced engineers I interact with clearly have not thought very deeply about how crypto systems interact with human trust. Granted understanding the implications of crypto is yet another step beyond understanding the maths, but I'm amazed at how many technology curious people haven't bothered to take that step.

The good pollies on the other hand probably have a very good intuitive feel for human trust systems and how to navigate them. They rely on engineers to tell them what is possible of course, and they won't care about the details. But what they will care about is whether the engineers can deliver the system they promised, and there I have to admit our track record is appalling. How many government IT initiatives have you seen deliver what was promised on time and on budget? So when you tell them you can build a ZK system that delivers in all these privacy promises, expect a very sceptical reception.

Re: Google broke reCAPTCHA for de-googled Android users

#576

Post by eks391 »

phyzome wrote: post #246
varenc wrote: post #189

I have a good friend who doesn't own a cell phone. He's a math professor. Every year he keeps living life without a smartphone, I continue to be more impressed. Things like this makes me feel like he might have to eventually give in. https://archive.is is now serving, via Cloudflare, this QR code backed CAPTCHAs. There seems no way to get past them without a smartphone. Sad times. I wonder at what point even basic go…

I don't have one either. No plans to get one, even with this.

I envy you. Before I degoogled my life, I tried going all in to no smart phone. It didn't last very long. I still would like to get there, but considering how difficult and slow it was just to degoogle, I anticipate that it may be a long time before I can operate without a smart phone.

Re: Google broke reCAPTCHA for de-googled Android users

#577

Post by zyx321 »

fc417fc802 wrote: post #553
zyx321 wrote: post #525

Earlier quoted context omitted.

OR: The website sends a request for age verification. The app[1] on the user's device[2] forwards that request to the chip on the user's ID card. The user authorizes themselves with their 6 digit PIN stored on the card. The chip produces a signed reply containing the following payload fields: `issuing_country:string` and `over_18:bool` [1] https://github.com/Governikus/AusweisApp [2] iPhone, Android, Windows, MacOS,…

What happens when I set up a tor hidden service that (in conjunction with some client software) stands in for a visitor's device and will proxy any requests back to my personal card? After all the payloads are anonymous so what's the risk to me?

To prevent this sort of abuse, the server would have to request the `pseudonym` field, which contains a hash across the server identity and the card's secret salt, allowing the server to detect abuse but not to track the user across multiple services.

Re: Google broke reCAPTCHA for de-googled Android users

#578

Post by echelon »

palata wrote: post #561
fc417fc802 wrote: post #552

Earlier quoted context omitted.

"Think of the children" is the stated reason but not the actual reason. We've seen this pattern so many times that it's perplexing that people continue to fall for it. If the children were the actual reason there are much less invasive solutions that enable reliable parental controls such as mandating self classification of content and fining service operators for inaccuracies. Think for yourself and consider what th…

What is perplexing is that people still don't realise that it is possible to do age verification in a privacy-preserving manner. > Think for yourself and consider what the possible ulterior motives might be. Sure, and in the meantime try to think and read about how privacy-preserving age verification actually works.

> Sure, and in the meantime try to think and read about how privacy-preserving age verification actually works.

This requires you build a whole apparatus around controlling what people can see, say, and do.

The concept of "slippery slope" is often called a logical fallacy, but in reality it's more than often not a fallacy at all. It's the manner in which you boil the frog.

I think it's something like over 50% of adults do not have kids now. Why should we put the majority of people - for the majority of their lives - at risk for a mere 20% of the population to "not see boobs", when good parenting will suffice?

Let's not put a cage around our freedoms. Let's ask parents to be more responsible. In the edge cases where that isn't sufficient, is that really as bad as what could happen to all of our liberties should we go down that path?

We're burning down the whole village because someone saw a cockroach.

Re: Google broke reCAPTCHA for de-googled Android users

#579

Post by overflowcat »

omnifischer wrote: post #306
djfergus wrote: post #141

What happens with Chinese Huawei phones that don’t have Google services?

People can install Google Services in them. Once you sign into google account then you self-certify the device. https://www.google.com/android/uncertified/?pli=1

[dead]

Re: Google broke reCAPTCHA for de-googled Android users

#580

Post by surajrmal »

rvz wrote: post #572
surajrmal wrote: post #462

Earlier quoted context omitted.

What do you define as selling out? Having a different perspective from your own? There are many legitimate reasons for why someone can believe the opposing view points. Devolving into us vs them rhetoric is not conducive to a reasonable conversation.

> What do you define as selling out? I think you need to read the comment again: >> They don't make their money directly from "free software" or "open source" in the first place. >> He (Stallman) knows he doesn't make money from "free software" but only by speaking about it. Torvalds is the same... My (unanswered) question: > Can any other developer do exactly that in 2026? To avoid repeating myself, the point is the…

I did read your comment, but making money from speaking about software is not selling out to me. Is that what you meant?

I think open source works best when folks don't expect to make money off of it. I don't think Linus or Stallman expected to make money off of their free software. In some cases you might be lucky and able to get consulting contracts from firms related to your open source code but it's not reasonable to assume that will happen. It's possible it's harder to get lucky today than before but it was always unlikely.

Post reply on HN