cross-posted from: https://lemmy.ml/post/47972724

i encountered this for the first time today while attempting to read something on archive.today.

i confirmed that decoding the qrcode using a computer and following the URL it contains is insufficient; the error it gave directed me here which is what the linked screenshot is of.

the old type of captcha remains available too, for now:

screenshot of text: Important: Mobile verification for Google Cloud Fraud Defense is an experimental challenge type in Preview. Visual and audio challenges are available as alternatives for users who can't complete mobile verification. To use them, click the Visual  or Audio  buttons.

screenshot of google support webpage with text: To complete the mobile verification, you must use a compatible mobile device. If verifying on iOS/iPadOS device with version 15.0-16.4, download the reCAPTCHA app in the App Store. After installation, return to the challenge to try again. If verifying on Android device with Google Play Services version older than 25.41.30, upgrade to the latest Google Play Services version. After upgrading, return to the challenge to try again. Scan to Verify You're Human. Use your phone's camera app to scan this QR code. This securely links your device. Mobile Verification. Verification will initialize the reCAPTCHA app on your device.

top 100 comments

sorted by: hot top controversial new old
[–] 219 points 5 months ago (19 children)
  1. People without a mobile device are fucked out of being able to pass a captcha

  2. As if this isn't a way for them to associate multiple sessions on multiple specific devices with one another, this is just another avenue for data collection, period. Hidden under the guise of "more secure."

  • source
  • hideshow 19 child comments
  • [–] 52 points 5 months ago (1 child)

    Captcha has been one of the greatest google acquisitions ever.

    They acquired it under the guise of improving OCR and have since morphed it into an AI data farm (how else is google lens gonna know what objects are what?) and now total insight into a users every single action from desktop to mobile, tying it all together into a surveillance nightmare.

    I can guess the permissions that the recaptcha app needs now. Probably something akin to root access with all datapoints and considerations you could think of.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 20 points 5 months ago*

    I used to always add one incorrect tile and skip one correct tile.(It would still pass)

    I thiught I was such a rebel lol

    Then I figured, they'd be stupid if they didn't show the same image to multiple people...

  • source
  • parent
  • [–] 17 points 5 months ago (6 children)
  • [–] 3 points 5 months ago (5 children)

    The point with captchas is not really that bots can't pass them, more that its too expensive to pass them consistently with a hurtfully large enough volume of bots.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 2 points 5 months ago* (last edited 5 months ago) (4 children)

    I'd heard of this strategy, like making it perform some kind of costly encryption that's irrelevant to a human user but restrictively expensive for a bot army.

    But does decoding a QR code apply? I never really thought about it. I guess it's an image, it's at least a little big by comparison... but it's also in a restricted, easy to capture spot and maybe could be minimized to a fairly small pixel set? Idk how many key pixels you need to parse a QR code... I guess I could Google

    *typo bit --> bot and bit --> big... I'm full of bit

  • source
  • parent
  • hideshow 4 child comments
  • [–] 2 points 5 months ago (1 child)

    I don't know much about this new captcha system, but I feel like the challenge wouldn't really be in the scanning of the qr code itself but more so on making the device you're scanning with seem legitimate. They could check usage patterns, what apps are installed, how many accounts are added and are they actively used, location and sensor data, are the hardware specifications really unusual, are they constantly trying to complete random captchas... Stuff like that to tell apart a real user's device from a bot or sandbox. The QR Code is probably just a random ID for which captcha instance the user is trying to pass.

    Also I just realised this but this is probably inconvenient as hell. Like I do NOT want to constantly be picking up my phone to scan QR codes when I'm trying to go around the Internet. What if my phone is on the other side of the house? I don't want to get up and walk all the way over there! If this gets fully rolled out there may actually be a small dip on the amount of desktop users of websites because they just leave when they are hit wth this captcha instead of bothering to scan a code.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 16 points 5 months ago (2 children)

    i have one. but it isn't android, or ios, or 'smart' in any way. it doesn't even text. it's just a telephone that fits in my pocket and connects to the cellular networks. it's all i want. it's all i use. it's all i've needed ever since i got my first one about 25 years ago.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 9 points 5 months ago (2 children)

    It really should be illegal to build systems that require a user's access to any unrelated technology. You shouldn't be forced to have a phone to pay a parking fee or to get on the bus. You shouldn't need an app to charge your car. You shouldn't need to use proprietary software from one spesific company to pass a captcha on a random site.

  • source
  • parent
  • hideshow 2 child comments
  • load more comments (-1 replies)
    [–] 113 points 5 months ago (2 children)

    Looks like a very good way to shoo actual humans off of your website.

  • source
  • hideshow 2 child comments
  • [–] 42 points 5 months ago (1 child)

    Sorry, my faith in users is basically zero. These dummies will go to websites that tell them to copy code and run it with win+r. They're morons and will do anything if a website promises them something.

  • source
  • parent
  • hideshow 1 child comment
  • [+] 1 point 5 months ago (1 child)
  • [–] 2 points 5 months ago*

    At work? Crowdstrike is kind of the training wheels for people who don't want to use application whitelisting or group policy that disables users running various terminals.

    Training isn't the answer, because training is basically an industry propped up by knowbe4 from convincing cybersecurity insurance that it's the right thing. We do training where I work and everyone falls for the same old shit, raise information, pay information, promotion information and performance review content. Doesn't matter how many indicators of compromise are hidden in the message, but they'll gladly just keep clicking along or running code that is prompted because the desire sensor overrides the training.

    Anywho, nowadays not giving users admin rights is simply not enough. The script creating people often know how to use privilege escalation exploits without issue to gain control even when a user can't. Really need a tool that can detect behavior and block it, or lock the system down somehow.

  • source
  • parent
  • load more comments (-1 replies)
  • [–] 85 points 5 months ago (1 child)

    Nice captcha. Would be a shame if someone intentionally injected malicious code that had users scan a QR code under the guise of security.

  • source
  • hideshow 1 child comment
  • [–] 67 points 5 months ago (4 children)

    There's no way this is ADA compliant.

  • source
  • hideshow 4 child comments
  • [–] 29 points 5 months ago (2 children)

    Clicking the headphone icon to hear the audio option is the way to bypass this if you get one.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 62 points 5 months ago (10 children)

    Verifying you have a phone doesn't verify that you're human.

  • source
  • hideshow 10 child comments
  • [–] -3 points 5 months ago (9 children)
  • [–] 17 points 5 months ago (5 children)

    Android emulators exist and are usable by bots.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 1 point 5 months ago (3 children)

    So they SS the QR code, scan it and continue?

  • source
  • parent
  • hideshow 3 child comments
  • [–] 4 points 5 months ago

    May have to stream a video of the screen into a scanner app, but shouldn't be difficult anyway.

    One of the forms of digital ID in use in my country now has a new way to use it, which the government websites use now. You always needed a mobile device for this one anyway (phone holds the private keys and you have to enter the PIN 1 or PIN 2 depending on whether you're authenticating or authorizing something), but it used to be that you could enter your ID code and get prompted for the PIN (with a verification number to make sure you're responding to the prompt you think you're responding to), now it's either on-device from the default browser to the app, OR on desktop you have to scan a QR code that's a moving target, it changes a couple of times a second so you couldn't send a screenshot to someone else to scan. This is meant to prevent scams where someone gets you to just enter your PIN over a phone call.

    I don't know if the google thing is similar though or if it's a static QR there.

  • source
  • parent
  • [–] 0 points 5 months ago (2 children)

    My cat once jumped on keybard and wrote "ghfhghgghhfjgfhf" on Discord chat. The first non-human with acces to computer.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 58 points 5 months ago (3 children)

    I once saw fake captcha scam that reuired scaning QR code to infect device. It looks exactly like that.

  • source
  • hideshow 3 child comments
  • [–] 8 points 5 months ago (2 children)

    I once made QR code stickers that placed people on a website warning them to stop trusting QR codes.

    I spent a year traveling and everywhere I saw a QR code my sticker QR code went over it.

    You target the right locations and spoof the website and you can get credit card, phone, email, address. Svan this QR code for 20% off blah blah blah.

    Do use them.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 56 points 5 months ago (1 child)

    Without a google account there will be many sites I can't visit. I'll look at such sites the same way as I look at paywalled sites.

  • source
  • hideshow 1 child comment
  • [–] 51 points 5 months ago (2 children)
    1. Hype up AI.

    2. Everyone starts scraping the internet to obtain training data for their AI.

    3. To block the scrapers, countless sites implement stricter bot detection tools.

    4. The owners of the bot detection tools now effectively hold all of the internet by its throat, deciding who can access what and extorting more and more data from you to verify you're human.

    Fucking genius.

  • source
  • hideshow 2 child comments
  • [–] 44 points 5 months ago (1 child)

    No malicious site would ever fake this kind of flow in order to get someone to scan a dangerous QR code. Nope, that would never happen.

  • source
  • hideshow 1 child comment
  • [–] 9 points 5 months ago

    It's already happening. They tell you to scan a QR code that links to a website where they ask you to log in with your Google account (but it's just a phishing page).

    Good job Google!

  • source
  • parent
  • [–] 43 points 5 months ago

    One more reason to not use google anything

  • source
  • [–] 41 points 5 months ago (1 child)

    If you haven’t already divested from Google and its related services then now is the time.

  • source
  • hideshow 1 child comment
  • load more comments (-1 replies)
    [–] 40 points 5 months ago (1 child)
  • [–] 39 points 5 months ago (7 children)

    Any website that chooses to use this service will simply not get my traffic. If enough people feel the same, those websites will lose clicks and eventually tell Google to pound sand.

    Imagine the utter hubris on these fuckers to think that people will get a google device just to access a website.

    Or to think that an average user sitting at home would run to another room to grab their phone so they can verify themselves on the desktop just to visit blackcougar.com

  • source
  • hideshow 7 child comments
  • [–] 21 points 5 months ago* (last edited 5 months ago) (2 children)

    They're using the fact that everyone else both already owns a Google or iOS device, and does everything on those devices, to punish desktop and alt mobile OS users.

    The fact that this is going on right as AluminumOS is down the pipes, and right as rigged parts prices threaten to kill desktops as an option to begin with makes this especially sus.

    The way things are going right now, I won't be surprised if we see a computing future where you're either on a Google or Apple-controlled device, or you're on a thin client tied to a cloud subscription, and you won't own your tech anymore.

    Bezos' 'Give up your PC and rent from our cloud' threat is sounding less and less like a threat and more and more likely to become reality.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 31 points 5 months ago
    [–] 31 points 5 months ago (10 children)
  • [+] -25 points 5 months ago (9 children)

    No; they said you can use Android.

  • source
  • parent
  • hideshow 9 child comments
  • [–] 30 points 5 months ago (2 children)

    Android ≠ Linux

    Android is based on a modified version of Linux, and owned by Google. Linux is independent.

  • source
  • parent
  • hideshow 2 child comments
  • [+] -10 points 5 months ago (1 child)

    Android is Linux. Not all Linux systems are Android, but all Android systems are Linux.

    It’s not necessarily helpful to those on desktop Linux, but it is Linux if someone wants to be a purist about which operating systems run on their hardware.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 11 points 5 months ago (5 children)

    So, throw an android image into a virtual machine?

  • source
  • parent
  • hideshow 5 child comments
  • [+] -8 points 5 months ago (2 children)

    Seems a little round-about. But if you want, I guess you could do that for some reason.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 28 points 5 months ago (9 children)

    Many humans don't have smart phones

  • source
  • hideshow 9 child comments
  • [–] 11 points 5 months ago (5 children)

    So those humans will go buy the cheapest they can find which is, surprise, Android + Google Play Services.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 6 points 5 months ago (3 children)

    No. More likely those people just won't visit that website and will very easily get the information that they were looking for from the next link down on the search results.

    Google are fucking idiots if they think otherwise.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 3 points 5 months ago (2 children)

    the next link down on the search results

    Assuming we'll have that at all or just AI summaries replacing the results.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 5 months ago* (1 child)

    Yup, and they are being cut out of society everyday. Just losing your phone or even breaking it can be a figurative death sentence. Want to check your email from another device? Did you set up 2 factor with your phone?

    Yeah sorry, can't access your email.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 5 months ago

    I'm at the point where I'm fine with it. If you want to cut me out for such a silly reason, I don't want to be included in your dumb thing. I'll find an alternative that treats me with respect.

  • source
  • parent
  • [–] 28 points 5 months ago (1 child)

    Oh boy! Another way to fingerprint your devices! Scammer are sleeping good tonight with these new verifications

  • source
  • hideshow 1 child comment
  • [–] 27 points 5 months ago

    Fuck absolutely everything about this.

  • source
  • [–] 27 points 5 months ago

    LOL, fuck off. How about instead I move on to somewhere less hostile toward the user instead?

  • source
  • [–] 26 points 5 months ago (1 child)

    We are making side loading harder because scammers are using "these" tactics to install malware on your devices.

    It's totally fine when we use the same tactics to install malware on your device.

  • source
  • hideshow 1 child comment
  • [–] 25 points 5 months ago*

    How soon before reCAPTCHA-encumbered sites are blocked on desktops entirely unless you're on ChromeOS or the upcoming AluminumOS?

  • source
  • [–] 23 points 5 months ago
    [–] 20 points 5 months ago (1 child)

    Is an android emulator able to bypass this? Just curious - I haven't started the degoogle process.

  • source
  • hideshow 1 child comment
  • load more comments
    view more: next ›
    25 comments in c/privacy@programming.dev view that post
    4 comments in c/google@lemdro.id view that post
    1 comment in c/badnews@lemmy.ml view that post