Top
Best
New

Posted by anonymousiam 17 hours ago

Google broke reCAPTCHA for de-googled Android users(reclaimthenet.org)
Related: Google Cloud fraud defense, the next evolution of reCAPTCHA - https://news.ycombinator.com/item?id=48039362

also: Google Cloud Fraud Defence is just WEI repackaged - https://news.ycombinator.com/item?id=48063199

1071 points | 370 commentspage 2
varenc 11 hours ago|
I have a good friend who doesn't own a cell phone. He's a math professor. Every year he keeps living life without a smartphone, I continue to be more impressed. Things like this makes me feel like he might have to eventually give in. https://archive.is is now serving, via Cloudflare, this QR code backed CAPTCHAs. There seems no way to get past them without a smartphone. Sad times. I wonder at what point even basic government services will essentially require a smartphone.
gruez 10 hours ago||
> https://archive.is is now serving, via Cloudflare

It looks like a cloudflare page but it's not hosted by them. eg. https://bgp.he.net/dns/archive.is#_ipinfo It's hosted by AS49505 JSC Selectel

j027 10 hours ago||
To add onto this, cloudflare switched away from recaptcha a while ago. https://blog.cloudflare.com/moving-from-recaptcha-to-hcaptch...

I think they now use their own Cloudflare turnstile if I remember correctly, but back then they switched to hcaptcha.

phyzome 9 hours ago||
I don't have one either. No plans to get one, even with this.
buzzwords 13 hours ago||
Given the way Google is going I'm not sure if my next phone will be Android. I am fully aware that I am probably in the minority here. For me the trust is entirely gone.
fluidcruft 13 hours ago||
There really isn't much of an option. Apple's just as bad if not worse.
queenkjuul 13 hours ago|||
At least with an Android i have the option of Graphene, and have access to a terminal, and for now can sideload apps.

With apple there's no choices, so I'll continue to take my chances with Android

fluidcruft 12 hours ago|||
Possibly... but the extension of this to Android and Apple is going to be the entire internet shuts you out. And everything else will be a giant Dead Internet crawling with bots.
tardedmeme 10 hours ago|||
The sites that require you to log in are precisely the same ones that are crawling with bots. The personal internet or "small web" is, and still will be, full of real content. There are also lots of bot websites that are trying to be small web, but since it's an actual social network and not a giant pool everyone pours stuff into, they don't get traction. If you do find a website that seems to be human but links to a thousand AIslop sites, you'll stop following that guy's links.
duskdozer 57 minutes ago||
It's less about those sites than it is about government services, banking, healthcare, employment, etc
microtonal 6 hours ago|||
I have to see. As much as I don't like Murena and /e/OS, they seem to have some clout with the EU/EC. Given that they are using microG and also hit by this, they might be able to nudge the EC to act on this.

Also, personally I care less and less. As long as my banks and government apps work, I'll just not use somebody's service if they put up barriers like this.

palata 2 hours ago||
> Also, personally I care less and less. As long as my banks and government apps work

If most people care less and less, the result would be that banks and government apps will also work less and less.

Look, companies have to prioritise. And the obvious way to prioritise is to say "users are requesting X A LOT and nobody requests Y, so we will do X". Companies never, EVER say "it would be more ethical to do Y, let's do Y".

As people, we can do two things:

* Push our governments to regulate that shit. That means, complain a lot to the government.

* Be vocal to companies and complain when they don't support your system. If enough people do that, it will be prioritised.

lxgr 12 hours ago|||
Can Graphene OS pass this kind of Google attestation challenge, though?
palata 2 hours ago||
No.

The hardware attestation (which is used by strict Play Integrity) checks the signature on your OS. It is totally possible to allow signatures other than Google, but Play Integrity doesn't do that.

Companies could totally decide to use hardware attestation and accept systems signed not only by Google, but also other systems (like GrapheneOS). But they don't care because not enough users complain to them.

Users of alternative Androids typically silently move to another service or stop using it entirely. Which is understandable but doesn't help the cause.

chadgpt2 13 hours ago||||
Both are terrible for privacy so it comes down to which one has a nicer screen now. :(

I'd rather have Google check an Apple phone attestation than have Google check a Google phone attestation, and vice versa, though, because you can assume each company is trying to keep as much information private to themselves instead of giving it to the other. Google is probably just getting "yes it's an Apple phone" and some kind of temporary token, instead of my IMEI, IMSI, phone number, all signed in accounts, biometrics and so on.

LeoPanthera 10 hours ago|||
> Apple's just as bad if not worse.

Could you justify that? Because to me it seems like Apple isn't doing anything even like this.

microtonal 6 hours ago|||
https://httptoolkit.com/blog/apple-private-access-tokens-att...

Also, Apple sells themselves as a privacy company, but often pick (possibly intentionally) insecure defaults. E.g. you might use end-to-end encrypted chats, but by default iCloud backups are not end-to-end encrypted, so law enforcement can just request your backups/chats from Apple. If you are vigilant and enable Advanced Data Protection for E2E iCloud backups, it probably still doesn't matter because the people that you communicate with probably do not have ADP enabled.

Besides that, they are enshittifying in the same way as Google. Ads in Maps, Ads in applications that you get with the OS (Apple Creator Studio ads in Keynote, etc.), Ads in your system settings for Apple Fitness+ (really).

At least Pixel phones and soon some Motorola models have the option of installing GrapheneOS.

bigyabai 6 hours ago|||
Apple never allowed custom ROMs to begin with, so their device attestation feels more seamless: https://support.apple.com/en-us/102591
cyklosarin 13 hours ago|||
Motorola + GrapheneOS next year could be an alternative. So far they've been relatively insulated from the changes that have been coming down from Google.
palata 2 hours ago|||
Motorola won't change a thing about hardware attestation. GrapheneOS is locked out from reCAPTCHA because GrapheneOS is signed by GrapheneOS and not by Google.

The way it's going, by the time the Motorola + GrapheneOS phone is out, it will be a lot more painful to use GrapheneOS than today. Not because of GrapheneOS of course, but because everybody accepts that bullshit Google is doing.

If you're waiting for Motorola + GrapheneOS, you could start complaining to banks and other apps that don't support GrapheneOS :-). If enough people did that, maybe those companies would consider it.

doctor_radium 9 hours ago||||
I'll be waiting.

In the meantime, I'm currently using a low end Motorola moto g 5G 2023 which lets me turn off Play Services. Chrome and the Google Calendar don't run (really do need to find a replacement calendar), and I couldn't be happier. Motorola's interest in GrapheneOS makes me wonder if they did this on purpose.

t_mahmood 59 minutes ago||
For calendar, I now have my own local setup, with Tailscale

Calendar server: https://radicale.org/v3.html Sync: https://manual.davx5.com/

So, you run Radicale server, you can import Google Calendar.

Set up Davx5 on mobile to sync with the local server

Access from anywhere with Tailscale.

microtonal 5 hours ago||||
Or if you need it now, Pixel + GrapheneOS. Pixel A-series are really affordable. E.g. the 9A is 350 Euro here, have great device security (Google Titan M2 hardware security processor, CPU that supports MTE, etc.), pretty good cameras/camera processing, etc.
pillefitz 8 hours ago|||
https://motorolanews.com/motorola-three-new-b2b-solutions-at...
ryukoposting 11 hours ago|||
You won't be alone. I've resolved that this will be my last Googled phone.

My dad runs the family domain/emails/etc. The hard part will be convincing him to degoogle the whole family.

drpixie 11 hours ago|||
I'm inclined towards keeping an ancient android for those apps that require it, and maybe something open for actual use. Or perhaps a crappy old android for android and a small non-android tablet/laptop for daily-driver stuff, which always works better as a computer anyway!

I'm also becoming open to using software that lies to google about what it is :) Google will treat us like sh*t, why shouldn't we reciprocate.

nosioptar 9 hours ago|||
I've been getting asked more and more how to degoogle stuff by non-nerds.
drnick1 10 hours ago||
Android yes, but Graphene is the answer.
lxgr 13 hours ago||
Almost completely unrelated, but I recently helped out a very confused family member with deleting not one, but two Google Cloud accounts they had no idea existed, and that they only learned about from an email referencing reCAPTCHA getting integrated into some other Google product offering.

I have absolutely no idea what happened there. My best theory so far is that they clicked on some really, really wrong buttons when solving a captcha themselves while logged in to their Google account in the same browser. Bizarre.

brunocvcunha 13 hours ago|
AI Studio playground maybe? It seems all integrated.
lxgr 13 hours ago||
They almost certainly didn't use that.

The projects were named after a Google Doc they'd recently worked on (or a .docx attachment they'd received?) though, so my other guess is that they somehow created a Google Docs macro or similar by accident?

arccy 11 hours ago||
probably Google Doc Apps Script, those create so many Google cloud projects
koala-news 8 hours ago||
The internet increasingly feels like “prove you’re using the approved computer” instead of “prove you’re human”.
balamatom 3 hours ago|
Those two add up to "prove that you allow computer vendors to teach you what 'human' means".
drnick1 10 hours ago||
So Stallman was right, after all?
quantummagic 9 hours ago||
Everyone, including Linus Torvalds, who rejected Stallman as too political or ideological, and advocated for "pragmatism" instead, is part of the reason we're where we are today. And it's going to get a lot worse, before it ever gets better.
palata 2 hours ago|||
I disagree. The reason we are where we are today is the lack of antitrust.
quantummagic 1 hour ago||
Even if we accept your premise, laws don't just appear; they are an organized response to a recognized problem. But everyone has been sleeping on the problem lurking in our infrastructure, undermining any impetus to enact such laws. And the people screaming from the mountain top (like Stallman), trying to raise awareness, were routinely mocked and marginalized by those all too happy to accept convenience and expediency, over more sustainable values.
drewfax 4 hours ago|||
I wish Linus had adopted GPL v3. He had the power to stop this madness from big tech, but he sided with them. It just reveals that he never fully understood the reason for the existence of GPL in the first place.
palata 2 hours ago|||
GPLv3 would not prevent remote attestation AT ALL.
rvz 3 hours ago|||
> He had the power to stop this madness from big tech, but he sided with them.

He (Torvalds) had no power to do anything and sold out. Even if he did, big tech would just go and use BSD.

For over a decade both Torvalds, and Stallman sold everyone out. They don't make their money directly from "free software" or "open source" in the first place.

Stallman was right in that he knew digital surveillance was going to happen, but he was incorrect in believing that FLOSS was ever sustainable economically and especially with AI replacing the developer and that big tech and startups are weaponising that against them.

Even when Stallman is against AI, he doesn't care. He knows he doesn't make money from "free software"; but only by speaking about it. Torvalds is the same but likes AI.

Can any other developer do exactly that in 2026?

xethos 10 hours ago|||
One thing I hope we've all discovered by now is that, if Stallman hasn't been proven right at the present moment, on any topic that touches on libre computing, is that it's only a matter of time until he is
sunshine-o 3 hours ago||
Yes he was.

But his vision/prophecy is about 50 years old and while still valid it probably needs an update.

We are now dealing with a fully networked world where AI/bots have become dominant. I am not sure he did / could go as far in his vision.

pzmarzly 12 hours ago||
Does anyone know what changed in iOS 16.5 that made Google stop requiring the app? To me it seems to correlate with Private Access Tokens, aka remote attestation by Apple. https://developer.apple.com/videos/play/wwdc2022/10077/
rippeltippel 6 hours ago|
Possibly. And possibly the fact that breaking experience for iOS users would result in a massive backlash, while the volume of non-iOS/non-Android users is negligible in comparison. Some of them will convert to mainstream OSes, the rest will succumb.
himata4113 11 hours ago||
I did something unpopular and just didn't have a captcha, I just read up on creepjs etc and rolled out my own which is just browser state analysis, basic ip check (abuse lists only) and PoW. Haven't had an issue with a single bot registration (yet).
grishka 2 hours ago|
A simple captcha with distorted characters + some hidden form fields would stop every single "opportunistic" bot.

There's hardly anything you can do to stop someone determined enough to spend money to spam your specific website. These kinds of captchas do raise the bar somewhat, but every single one of them is ultimately bypassed by paying people to solve them for you.

orblivion 8 hours ago||
I imagine GrapheneOS is thinking carefully about their statement on this. I look forward to reading it.
riffraff 6 hours ago|
I mean, they could sue for non competitive behavior, but good luck beating Google's lawyers
palata 2 hours ago||
GrapheneOS users (and actually just citizen who care) in the EU should complain to the DMA team [1]. As with everything: the more people complain, the higher priority it gets.

[1]: https://digital-markets-act.ec.europa.eu/contact-dma-team_en

db48x 2 hours ago||
I long ago stopped using any webpage that uses a captcha. If the website uses one, I bounce.
kyrofa 14 hours ago|
I don't even have a smart phone, I assume there is some sort of fallback behavior?
mzajc 14 hours ago|
The fallback is that you get redirected to a website helpfully demanding you buy a Google- or Apple-vetted smartphone: https://support.google.com/recaptcha/answer/16609652.

You will also see this page if your smartphone is degoogled and you try to open the reCAPTCHA attestation URL in a web browser instead of in Google Play Services.

More comments...