Top
Best
New

Posted by ribtoks 23 hours ago

Google Cloud Fraud Defence is just WEI repackaged(privatecaptcha.com)
679 points | 345 commentspage 3
DonThomasitos 20 hours ago|
We see the fundamental forces of capitalism at work: To justify valuation, Google needs to grow. When they feel a ceiling, they broaden their search to anything legal that makes customers pay - even if it contradicts their longterm interests. This created countless attack angles for startups. The good news: we already have a solution! Monopoly laws. In case of the internet, no company should be able to have this much power.

The bad news: US decided to weaponize big tech’s leverage over the world and does not enforce these laws anymore that fix vanilla capitalism.

Gagarin1917 19 hours ago|
>We see the fundamental forces of capitalism at work: To justify valuation, Google needs to grow.

You’re confusing markets with capitalism.

Market Socialism (the only reasonable kind) would have these same issues. If Google was owned by the workers instead of capitalists, it would still have incentive to grow. The worker owners would have the exact same incentives as current owners. The only difference would be who the owners are.

Capitalism is not actually “the final boss” that internet leftists make it out to be. Socialism is not the panacea that leftists make it out to be. Surveillance is not a “capitalist only” thing.

DonThomasitos 15 hours ago||
I agree, thanks for clarification. I did not want to argue in favor of Socialism - my criticism here is that „free market correction instruments“ like antitrust, monopoly etc are absent.
everdrive 20 hours ago||
No one should ever browse the web on a smart phone. Not joking.
jeroenhd 19 hours ago||
This API also works on the desktop. In fact, you can't use this system without a phone if your browser isn't Google enough.

We are going to see sooooo many scams out there. No wonder Google is locking down third party Android apps outside of their control, getting a user to install "device verification.apk" will become super trivial after people have clicked through these popups a couple times.

CharlesW 20 hours ago|||
That war was lost in the 2010s, around the same time as the vertical video war.
llbbdd 20 hours ago|||
Phone is small computer
everdrive 19 hours ago|||
Sure, and the north korean Linux distro also runs on a computer. I still wouldn't touch it.
llbbdd 19 hours ago||
Is it just a matter of not trusting the OS? I'm trying to figure out why "smart phone" is the discriminator here.
everdrive 19 hours ago||
A smart phone _could_ be legitimate and free and open, but in practice it's not. This is a constraint based on the reality of the market, not really based on what is strictly possible with the technology. I don't get too deep into this, but at a very high level, this is what I dislike about smartphones.

- Touchscreen user interface is objectively worse than a mouse and keyboard. Portability is the the only benefit to this interface, but this also works strongly to attack impulse control. It's always on you, just a moment away.

- Smartphones are significantly worse for privacy. In a LOT of ways. We can discuss this if you're interested.

- Many smartphone apps exist solely because a website would be less addicting and would also not be able to collect as much data as an app. ie, it's a choice that's worse for you and better for the company.

- They're significantly less open. Yes, grapheneOS and other alternatives exist, however it's not like a computer where I can just install whatever I want without asking the provider permission to unlock the device.

- I touched on this in two other bullets, but it's worth highlighting here: they're built intentionally to be addictive.

- The operating system and hardware are effectively interlocked. (yes, I know grapheneOS exists) but for any modern thing you might actually require a smartphone for (banking app, OTP app, etc) you must be using Apple or Google.

- Providers don't produce security updates well enough; Apple is "better" here, but my 10-15 year old computer can run modern Linux. People brag about 7 years of support on an iPhone. I'm under the impression that Android is better than it used to be, but in the old days any random vendor would give you about 1 year of update support and then you'd be hosed running old Android until you bought a new phone.

- Nobody cares if I own a desktop computer or not, but it's getting to the point that businesses will not work with me unless I have a modern smartphone.

I could probably go on, but I really hate these things.

8note 18 hours ago|||
> Touchscreen user interface is objectively worse than a mouse and keyboard

au contraire, touch screen is objectively better, and i dont buy laptops where the screen isnt a touch screen. cursors and mice and focus on laptop+mouse UXs is just horrible, and for keyboard only even worse.

the touch screen is much simpler, in that you touch or swipe on the thing, and it makes the motion in direct response to what you touched. the input is physically linked into the interaction, rather than some changing relative position.

llbbdd 19 hours ago|||
Yeah I'm aware of all of this, it's just the framing that confused me. A lot of these boil down to "nobody should own or use a smart phone to do anything" which is a bit of a different and less specific pitch than "nobody should browse the web on a smart phone".
tremon 19 hours ago||||
It is, just like a calculator is a small computer. It's not a personal computing device though, in the sense that the user can't develop and deploy their own software/tools on it.
llbbdd 19 hours ago||
Even if that were true, that has nothing to do with browsing the web on it
mindslight 20 hours ago|||
No one should ever browse the web from an ESP32 either. Like seriously the dark patterns are bad enough from a desktop where you've actually got the screen real estate to see the whole page, have other sites open for comparison, have a keyboard to type your own notes, etc. Most browsing can simply wait, especially the adversarial-commercial type we're talking about here.
triceratops 19 hours ago|||
And also don't install apps? What's left then?
everdrive 19 hours ago||
A device I have no choice in owning because modern employers assume you have sometime to install an authenticator app on. That's what it is for me. Also, sadly, it's an anchor for Signal. Otherwise I don't use the stupid thing.
stronglikedan 20 hours ago|||
well that just seems counterproductive and unreasonable but it's Friday so what do I care

-- sent from Chrome on Android

theamk 18 hours ago||
and it seems Google wants to support people like you!

That entire QR barcode thing is so that you can browse the web on your laptop/desktop, and _still_ rely on smart phone's attestation, no mobile browser needed.

VBprogrammer 21 hours ago||
In a world where everything is shit, could I at least take away some solace in this helping to reduce Cloudflares hegemony?
omnifischer 7 hours ago|
No. They have more in common. I would assume this is an internal joint project.
HackerThemAll 21 hours ago||
We do need to abandon the reality where we use the same few companies on a daily basis and get back to what's now hidden the under-the-surface: forums, blogs, personal websites. We need to re-discover the "free" internet we used to have before Facebook and smartphone dystopia happened.
mafriese 18 hours ago||
I posted a comment on the announcement when it was posted here:

>As someone who is working in incident response and malware analysis I have to say that is one of the worst ideas I have ever seen. A lot of companies have issues with ClickFix [1] and other social engineering campaigns and now Google wants to teach users that they should scan QR codes to proceed on a website.

>How should we realistically teach Susan from HR the difference between a real Google Captcha QR code and a malicious phishing QR code - you (realistically) can't. I wish we could - but those people don't work in tech, they will never know and I can't really blame them because at the end of the day they are just happy that they don't have to deal with tech after work.

>We have spent years of behavioural conditioning to prevent QR-code based phishing attacks (some people call it Quishing but I hate that term) and since the QR code is being scanned from a mobile device (99.99% of the time the private device), we have no EDR visibility on those devices and can't track what's happening if people scan it.

>This is more of an invitation for threat actors than it is something that holds them back.

[1] https://www.kaspersky.com/blog/what-is-clickfix/53348/

AlienRobot 20 hours ago||
I think the idea is good if it could actually curb bot traffic that currently plagues the Internet.

However, a lot of recent bot traffic are sophisticated scrappers called "LLM's." You can tell claude to "research X from this www.example.com" and will automatically scrape it and summarize it, something that a LLM is perfect for. Gemini tends to share links instead, presumably because most of Google's revenue comes from ads served on those websites, so if it completely killed the traffic to those websites it would just make less money. Incidentally, I wonder if Claude/Gemini use an search engine-like "index" of all websites or it refuses to cache anything to always fetch "fresh" data.

If this is employed, I don't think the web is only going to be gatekept to Google devices. I think it will also be gatekept to Google's AI's.

Google would be able to display a captcha that no LLM could defeat, and then just let its own LLM pass through.

The same could be said about its other bots, such as the web crawler. Google's bot could crawl webpages that no other crawler would ever be able to simply because it has free pass to captcha-gated GETs. Although the same could be true already today.

jeroenhd 19 hours ago|
Their product page is full of info about how this works with "agentic" cruft. They're still permitting your regular old scrapers and bots for as long as they like you. Hope you're not thinking of running an independent system instead of a large cloud platform!
cynicalsecurity 20 hours ago||
This is security theatre. This isn't going to help against bots in any way.
sylware 20 hours ago||
I keep banning gogol Ipv4 ranges because of scanners, script kiddies (and maybe worse). Yes, I am self-hosted, and without paying the DNS mob.
ChrisArchitect 21 hours ago||
Related:

Google Cloud fraud defense, the next evolution of reCAPTCHA

https://news.ycombinator.com/item?id=48039362

GranPC 21 hours ago|
Wrong link. https://news.ycombinator.com/item?id=48039362
dang 16 hours ago||
Thanks! I've s/48061938/48039362/'d the GP.
23062192 16 hours ago|
Hello
More comments...