-
People without a mobile device are fucked out of being able to pass a captcha
-
As if this isn't a way for them to associate multiple sessions on multiple specific devices with one another, this is just another avenue for data collection, period. Hidden under the guise of "more secure."
post
Looks like a very good way to shoo actual humans off of your website.
Sorry, my faith in users is basically zero. These dummies will go to websites that tell them to copy code and run it with win+r. They're morons and will do anything if a website promises them something.
At work? Crowdstrike is kind of the training wheels for people who don't want to use application whitelisting or group policy that disables users running various terminals.
Training isn't the answer, because training is basically an industry propped up by knowbe4 from convincing cybersecurity insurance that it's the right thing. We do training where I work and everyone falls for the same old shit, raise information, pay information, promotion information and performance review content. Doesn't matter how many indicators of compromise are hidden in the message, but they'll gladly just keep clicking along or running code that is prompted because the desire sensor overrides the training.
Anywho, nowadays not giving users admin rights is simply not enough. The script creating people often know how to use privilege escalation exploits without issue to gain control even when a user can't. Really need a tool that can detect behavior and block it, or lock the system down somehow.
Nice captcha. Would be a shame if someone intentionally injected malicious code that had users scan a QR code under the guise of security.
There's no way this is ADA compliant.
Clicking the headphone icon to hear the audio option is the way to bypass this if you get one.
For now, yes.
Although having tried to use the audio recaptca before, it felt like a psychotic episode.
With the way the Trump admin is going I'm surprised they haven't totally dismantled the ADA already.
Verifying you have a phone doesn't verify that you're human.
Android emulators exist and are usable by bots.
I assume this is going to hook into Play Protect API, which verifies your hardware config as well.
So they SS the QR code, scan it and continue?
Something like that. Emulators also give the ability to emulate cameras using pictures or video feeds.
They just need to set up a Google play equipped emulator, set the picture as simulated camera input and put in the inputs to the emulator (also automatable)
May have to stream a video of the screen into a scanner app, but shouldn't be difficult anyway.
One of the forms of digital ID in use in my country now has a new way to use it, which the government websites use now. You always needed a mobile device for this one anyway (phone holds the private keys and you have to enter the PIN 1 or PIN 2 depending on whether you're authenticating or authorizing something), but it used to be that you could enter your ID code and get prompted for the PIN (with a verification number to make sure you're responding to the prompt you think you're responding to), now it's either on-device from the default browser to the app, OR on desktop you have to scan a QR code that's a moving target, it changes a couple of times a second so you couldn't send a screenshot to someone else to scan. This is meant to prevent scams where someone gets you to just enter your PIN over a phone call.
I don't know if the google thing is similar though or if it's a static QR there.
My cat once jumped on keybard and wrote "ghfhghgghhfjgfhf" on Discord chat. The first non-human with acces to computer.
I once saw fake captcha scam that reuired scaning QR code to infect device. It looks exactly like that.
I once made QR code stickers that placed people on a website warning them to stop trusting QR codes.
I spent a year traveling and everywhere I saw a QR code my sticker QR code went over it.
You target the right locations and spoof the website and you can get credit card, phone, email, address. Svan this QR code for 20% off blah blah blah.
Do use them.
Noticed parking meters here have prominent labels now stating they do not use QR codes. I'm sure that's just providing the spot to put the scam QR code, but it's better than nothing.
Sign: “Scan here for a trail map”
lemmylump: “I better vandalize this. Guys I’m tooootally helping people.”
Without a google account there will be many sites I can't visit. I'll look at such sites the same way as I look at paywalled sites.
-
Hype up AI.
-
Everyone starts scraping the internet to obtain training data for their AI.
-
To block the scrapers, countless sites implement stricter bot detection tools.
-
The owners of the bot detection tools now effectively hold all of the internet by its throat, deciding who can access what and extorting more and more data from you to verify you're human.
Fucking genius.
No malicious site would ever fake this kind of flow in order to get someone to scan a dangerous QR code. Nope, that would never happen.
If you haven’t already divested from Google and its related services then now is the time.
Any website that chooses to use this service will simply not get my traffic. If enough people feel the same, those websites will lose clicks and eventually tell Google to pound sand.
Imagine the utter hubris on these fuckers to think that people will get a google device just to access a website.
Or to think that an average user sitting at home would run to another room to grab their phone so they can verify themselves on the desktop just to visit blackcougar.com
You want me to scan a QR code to log onto your fuckin' website?!

They're using the fact that everyone else both already owns a Google or iOS device, and does everything on those devices, to punish desktop and alt mobile OS users.
The fact that this is going on right as AluminumOS is down the pipes, and right as rigged parts prices threaten to kill desktops as an option to begin with makes this especially sus.
The way things are going right now, I won't be surprised if we see a computing future where you're either on a Google or Apple-controlled device, or you're on a thin client tied to a cloud subscription, and you won't own your tech anymore.
Bezos' 'Give up your PC and rent from our cloud' threat is sounding less and less like a threat and more and more likely to become reality.
1 year later
Government website you have to use to pay your water bill: “Confirm you are a human…”
So Linux users are fucked?
No; they said you can use Android.
Android ≠ Linux
Android is based on a modified version of Linux, and owned by Google. Linux is independent.
Android is Linux. Not all Linux systems are Android, but all Android systems are Linux.
It’s not necessarily helpful to those on desktop Linux, but it is Linux if someone wants to be a purist about which operating systems run on their hardware.
So, throw an android image into a virtual machine?
Many humans don't have smart phones
So those humans will go buy the cheapest they can find which is, surprise, Android + Google Play Services.
So those humans will go buy the cheapest they can find
Hell no I won't.
No. More likely those people just won't visit that website and will very easily get the information that they were looking for from the next link down on the search results.
Google are fucking idiots if they think otherwise.
the next link down on the search results
Assuming we'll have that at all or just AI summaries replacing the results.
There are several superior search engines to Google.
Yup, and they are being cut out of society everyday. Just losing your phone or even breaking it can be a figurative death sentence. Want to check your email from another device? Did you set up 2 factor with your phone?
Yeah sorry, can't access your email.
Oh boy! Another way to fingerprint your devices! Scammer are sleeping good tonight with these new verifications
LOL, fuck off. How about instead I move on to somewhere less hostile toward the user instead?
We are making side loading harder because scammers are using "these" tactics to install malware on your devices.
It's totally fine when we use the same tactics to install malware on your device.
How soon before reCAPTCHA-encumbered sites are blocked on desktops entirely unless you're on ChromeOS or the upcoming AluminumOS?
Is an android emulator able to bypass this? Just curious - I haven't started the degoogle process.




top 100 comments