>As someone who is working in incident response and malware analysis I have to say that is one of the worst ideas I have ever seen. A lot of companies have issues with ClickFix [1] and other social engineering campaigns and now Google wants to teach users that they should scan QR codes to proceed on a website.
>How should we realistically teach Susan from HR the difference between a real Google Captcha QR code and a malicious phishing QR code - you (realistically) can't. I wish we could - but those people don't work in tech, they will never know and I can't really blame them because at the end of the day they are just happy that they don't have to deal with tech after work.
>We have spent years of behavioural conditioning to prevent QR-code based phishing attacks (some people call it Quishing but I hate that term) and since the QR code is being scanned from a mobile device (99.99% of the time the private device), we have no EDR visibility on those devices and can't track what's happening if people scan it.
>This is more of an invitation for threat actors than it is something that holds them back.
It’s also worth noting that the author of this article is selling a proof of work solution to the problem.
I am fairly skeptical that proof of work is the right way to go here. A lot of users of the web are using older hardware. Adding a computational toll booth doesn't solve the problem in a world where people have differing amounts of compute to spend.
On the other hand, a botnet might have access to thousands of computers and may not actually care about waiting an extra 10 seconds. Or worse, they will come up with a custom solution on an ASIC that solves your proof of work puzzle thousands of times faster than grandma‘s laptop.
There aren't many good ways to prove you're not a bot and there are even fewer that don't involve things like ID verification.
Their opt-in approach helps shift the blame to individual web stores for a while, so who knows if this will take off. But either way, in the long term, the open, human internet is either going away or getting locked behind proofs of attestation like this.
Apple built remote attestation into Safari years ago together with Cloudflare and Google is now going one step further, as Apple's approach doesn't work well against bots that can drive browsers rather than scripted automation tools.
Luckily, their current approach can be worked around because it's only targeting things like stores now and you can buy things from other stores. Once stores find out that click farms have hundreds of phones just tapping at remotely served content, uptake will probably be limited.
It'll be a few years before this is everywhere, but unless AI suddenly isn't widely available anymore, it's going to be inevitable.
good point... it's interesting how Captcha was initially popularized as a reverse Turing test, but it's just variants of Proof of Work today.
And it seemed clever at the time for Google to leverage this for improvement of their OCR models (it was!), and makes you wonder what utility is derived from the proven "work" today.
what does that bribe look like, as in, how much can one get? what all does that entail? is that a little box i connect to my network and forget about? does that mean if i unplug it unless another payment is received that will work out? i'm asking for a friend that's looking to avoid selling plasma to make ends meet.
> The following methods can be used to acquire residential IP addresses for a residential proxy network:
> Software development kit (SDK)2 partnerships: Proxy services convince mobile application developers to include their SDK in applications in exchange for payment for each person who downloads the application. Individuals download the application and accept the terms and conditions, allowing the SDKs to run in the background and route proxy traffic through users' devices.
> Virtual private network (VPNs)3 with hidden terms of service: Free VPN services may enroll users' devices in a residential proxy network, without obtaining their consent. The details are often hidden in the terms of service, which most users do not read prior to download, or the language is difficult for the user to understand.
> [malware and compromised IoT devices]
> Passive income schemes: Proxy services convince people to download applications on their device that promise to pay them for their internet bandwidth. People often do not realize that criminals use their internet connection to commit cyber attacks
insert You wouldn't bring a 40 Petabyte Zip Bomb to School, would you? meme
Their announcement is full of buzzwords about "agentic" things. Detecting LLMs is one thing, but imagine the power of being able to pick which LLM browsers are permitted and which aren't!
I think Google is being too early to the party with this. Cloudflare still has CAPTCHAs to throw at the wall. There are ways other than attestation to verify that someone is a real human, but they're getting more and more annoying to real users and harder and harder to implement on a small website.
Despite the massive implications, this is a simple system that just works for the 99% of people who use Chrome or Safari or at least have access to an Android phone or iPhone somewhere. It's quick, doesn't require installing apps or creating accounts, and it just works from both the website perspective and the user perspective.
Of course when you start thinking about people with disabilities things become problematic, but when have tech companies ever really cared about that sort of thing? Inclusiveness was fun and all for a while, but the clowns the American people elected banned that sort of thing for any company considering government contracts, and big tech licked that boot like it was made of honey.
The world becomes a lot easier if you just decide to ignore all edge cases and assume customers who disagree with you didn't matter anyway. And infuriating as it may be, for companies like Google, that business model works.
RMS has offered broadly solutions/alternatives since the beginning, along with reporting early on trends that other people ignore.
I don't think you've made a point about his abilities. I do think you've restated his proclivities, which reinforces the basis for the quip.
It's not just Google. It's governments, corporations, all around the world, simultaneously. The noose is being tightened gradually, then all at once. And it's coming for all of us:
https://community.qbix.com/t/increasing-state-of-surveillanc...
The threats above interlock by design or convergence: Identity layer (1-5) creates the prerequisite for the others. Once identity is established at SIM/account/device level, the carve-outs that make surveillance politically viable become possible (powerful users get exemptions; ordinary users get watched).
Device layer (10-12, 16-19) creates the surveillance endpoint. Once content is scanned on the device before encryption, the cryptographic protections at the communications layer become irrelevant.
Communications layer (6-9) is the most-defended. Mass scanning has been defeated repeatedly. This is the layer where the resistance has the best track record.
Reporting layer (13-15) is nascent. Direct OS-to-government reporting hooks haven't been built yet at scale. The UK's December 2025 proposal is the leading edge.
Platform control (20-24) determines whether alternatives can exist. Browser diversity, app distribution diversity, and engine diversity are the structural protections. All three are narrowing.
A society with all five layers complete has the technical infrastructure for total surveillance with elite carve-outs. We are roughly 40% of the way there. Whether that infrastructure becomes a dystopia depends on political choices, not technical ones.
HN as a whole is surprisingly oblivious to the noose tightening, because many here are super against decentralized distributed things, if they involve any sort of token. You can complain all you want, but downvoting and burying the decentralized alternatives just for groupthink makes you somewhat complicit in the erosion of our privacy and liberties. Even if you might disagree with a project, all the work that goes into it might be a good reason to upvote it instead, considering that without this work, we're basically doomed.
Always has been.
Google was creating cartels like the "Open Handset Alliance" literally decades ago.
Via their control of Chrome and Search which are both monopolies, Google holds absolute authority on how websites are rendered and if websites can be found.
How is Chrome, of all things, a monopoly? Have words just entirely lost all meaning and now monopoly just means "things which are popular that I dislike"?
Note, this is separate from a "so many things are just Chromium", which I agree is an issue, but isn't the same as a "Google Chrome is a monopoly". Because in the end there are still many non-Chrome browsers which support WebUSB which do not end up with a lot of the downsides of Chrome specifically about Google harvesting your data and what not.
You know full well what people mean when they say "Chrome"
Yeah, Chrome, the web browser made by Google that bugs you to sign in with your Google Account. Most people don't mean Microsoft Edge when you say "Chrome". Do you call Microsoft Edge "Chrome"?
Chrome is a product made by Google that is a web browser. If the argument is Chromium is too interwoven, that's a separate argument.
But even then, what does it mean that "Chromium is a monopoly"? Is Linux a monopoly as well? Why or why not?
Note you haven't actually given me any other ways one would be impacted like I asked. What are the other majorly missing features Chrome pushes that other browsers don't have that most sites require? What else am I missing by not using a non-Chromium-based browser?
As someone else said earlier, it is a monopoly by extending the internet in ways that force users into using their browser engine. Due to market share and Google's prevalence, they have the sway to introduce things that cannot meaningfully be avoided without extreme siloing.
> What are the other majorly missing features Chrome pushes that other browsers don't have that most sites require?
This is a different question, please don't move the goalposts.
And yet after multiple times of me asking you've yet to give me a single real feature lost.
> This is a different question
Its literally the thing we're saying is the problem, how is it a different question entirely?!
You're saying the problem is they're adding features that force Chromium, but asking about which features you're talking about is just bringing up unrelated and different questions.
Is Linux also a monopoly? In a way sure, but I think a big difference is they're not "doing evil" as people claim Google is, and all the development/decisions are still made out in the open in a democratic way.
Former Google execs have even compared their setup to "running the New York Stock Exchange while trading on it."
At least Linux isn't trying to tell people what to do with their software.
2 messages later that seems to be contradicted?
> It's not so much forcing people to Chrome/chromium for specific features
I might've misread.
> but trying to increase market share through more subtle means, like paying to have their search engine featured
This isn't Chromium, the open source basis of many web browsers. Now you're talking about Google the company.
> Is Linux also a monopoly?
Monopolies in the sense worth discussing are highly popular things that are held in place by things other than competition. If anything, Google props up Chrome's competitors to reduce this.
Seriously? That's our standard of what is a "monpoply"?
Words have no meaning anymore.
You can choose to use something different. The device you bought probably came with an alternative! Otherwise, the device next to it on the shelf on the store where you bought it likely would have had an alternative browser, because most devices on the store shelves outside of some hypothetical physical Google store don't come with Chrome.
For most, for the purposes of market share (the type of "monopoly" I believe they are referring to), I think they count it as one and the same.
How did the user manage to install Chrome on Windows if Chrome is a monopoly, the only serviceable browser around? They copy the source code from a magazine or something? Get a floppy disk in the mail?
Ever thought about just not using those apps if you want to avoid the Google ecosystem? Too bad there's just absolutely no mapping application available on iPhone but Google Maps. Too bad there's no way to send an email on an iPhone outside of Gmail.
What's that? A user has to once again go out of their way to install those apps as well? Well isn't that strange. I thought Google was a monopoly on iPhones.
I'm on Firefox and use DuckDuckGo.
I use Firefox right now. Occasionally I need to open a site in Chrome instead, but it's rare.
> Firefox usage share grew to a peak of 32.21% in November 2009, with Firefox 3.5 overtaking Internet Explorer 7, although not all versions of Internet Explorer as a whole;
Firefox was the browser that embraced open standards and was unseating IE. And ActiveX was used for corporate stuff, not general web sites, so the main reason it died was that Microsoft gave up.
People absolutely did like Google at the time, but the majority of its growth is actually shoveling hijackers into other software installs just like BonzaiBuddy.
There was a good, long period where Microsoft just decided to let the market run amok with malware for critical software, instead of providing something like Preview on macOS. As a result, the safest option for most lay people was to use Chrome, where they could quickly and easily view, and most important, save pdfs of websites, receipts, etc.
Then, once MacBook Airs were solidified + iPhone, I started recommending people use macOS simply because Preview could edit PDFs and easily allow signing them.
I haven't used Windows in a very long time, so I assume it's still the same situation.
the fact that this kind of comment gets downvoted proves my point. so what if you personally don't like WEI? it doesn't mean the problems aren't real...
that aside, i don't know how people say stuff like "malicious force" and then you go and use a bajillion Google-authored, completely free as in beer and often free as in freedom technologies that nobody obligates you to use at all. It's not like Apple, where their software is so shitty (Messages, Apple Photos, etc.) that the only reason people use it is because it is locked down and forced upon you. it's interesting to me that @dang worries about the tenor of conversation changing - he longs for that 2009 world of university-level math people hanging out and writing comments about LISP or whatever - when the real deficit is not intelligence about math but, at the very least, seeing that things are nuanced, to see more sides to a problem besides the most emotionally powerful and the most mathematically neutral ones.
That was true before this, but this indicates nothing will ever be enough. Google will always want to track more of everyone's activity online, and will use every tool at their disposal to do it.
We can all do our part, by using their products as little as possible, contribute to open alternatives (OpenStreetMap, Fediverse, Linux, Nextcloud...) and by stimulating our (non-techie!) friends and family.
But it is a lot of work :(
That's no better, and in many ways far worse, than the corpos doing it.
There should not be a requirement to verify identity, but if a website owner only wants to provide access to their website to people with verified identities, why is that not their right?
Verifying identity for specific services tied to your finances or body is a whole different topic.
> if a website owner only wants to provide access to their website to people with verified identities, why is that not their right?
I like the GDPR's general point of view that the right to privacy is more important than the right to trade privacy for access. An anonymous verification might be fine, but this system is not, and random websites needing your specific identity is not.
Phones. Your choice is Apple or Google.
As you said, YouTube. Again, they have users and creators in one place, so it’s hard for a new platform to compete.
There are also a lot of enterprise contracts that bundle many things together. Like cloud and their workplace apps (whatever it is now called).
But also, just their size is a problem. Look at their AI story. First off, many customers get forced into packages where they get Gemini included as part of the bundle (which means they’re paying for it automatically and have less of a reason to pay for something else). But also - Google was slow to build useful products here. Even though they are late and made many failed attempts like Bard, they can afford to take losses for years that no small company - or maybe even large companies that aren’t mega corps - can absorb. Those other competitors would go out of business and have to be careful and move slowly in spending. But Google’s capital lets them make mistake after mistake but still compete and eventually win. So it’s not a fair competition.
For an example, see EU's GDPR, DMA etc.
Whether it's targeted ads, or training AI on their data, or verifying their age and implicitly identity, or "fraud defense", most people happily take it in exchange for a convenient freebie which is why things keep escalating.
It's understandable, people are assaulted with all kinds of abuses from every direction. There are more immediate threats that they can grasp more easily so this stuff has to wait its turn.
Or don't approach the world with a fundamental mindset of having agency to (help) fix things they see as broken. Just because people see something as bad doesn't mean they inherently see a bright flashing line from that to "so I should do something about it rather than accept it".
Feelgood slactivism. They don't care about your boycott. They finance their own alternatives because they know what makes you shut up.
Search is still their workhorse for ad revenue. Less search, less users, in addition to users now just asking chatgpt and co, will hurt them well
This is an attestation scheme. Attestation is about controlling what software you are and aren't allowed to run. If a future version of this allows desktop browsers rather than just phones, it will almost certainly try to do similar forms of attestation, and prevent you from controlling your own software stack.
We really need brand new legislation that makes it much easier to break up companies that are too big, and also to tax mega corporations at a much higher rate than all other companies. Then we can have fair competition and the power of choice. But the existing laws end up with no real consequence for these companies, and even if there’s some slap on the wrist, it takes years in court. New laws must make it very fast and low cost for society to take action.
I know it is a small move, but as it happened when chrome started, this opens opportunities for other players
So now I'm back on Chrome.
hacker news when reading that google is doing the same thing for the rest of the userbase: "hello, human resources?"
(Edit: it looks like the new system is still private and still interlinked with the old system that lets you use any hardware? I think?)
Also I don't know how you could have missed the widespread criticism of apple and especially cloudflare on this site.
It'll just be more clunky because you have to install their app.
I don't know what technology they're using, but when I scanned the QR code it launched (downloaded?) an iOS app of sorts with one tap, similar to the way Google tried Instant Apps a few years back. Didn't even need to double tap the power button like usual.
This is detailed at https://support.google.com/recaptcha/answer/16609652
They also need to browse the web, and are more likely to be blocked by these measures than humans
In other words these measures work as intended...?
Why? What's LLM generated? How can you tell?
To me what's obvious is that our trust system is already breaking down. Commenters accusing each other of being AIs is also another example of this.
Not the guy you're responding to, but:
1. The high number of (em) dashes is suspect, though it's unclear whether they manually replaced the em dashes or is actually human generated.
2. "One additional failure worth noting: one incident response professional in the HN thread, raised a concern that operates independently of the bot problem" feels out of place for a content marketing piece. HN isn't popular enough to be invoked as a source, and referencing it as "the HN thread" seems even weirder, as if the author prompted "write a piece about how google cloud defense sucks, here are some sources: ..."
3. This passage is also suspect because it follows the chained negation pattern, though it's n=1
>No hardware identifier is transmitted. No attestation is required. No certification layer determines who may participate.
edit:
I also noticed there are 2 other comments that are flagged/dead expressing their reasons.
Human written, not generated.
> HN isn't popular enough to be invoked as a source
Excuse me, what do you mean there? The author happens to read HN too.
"One additional failure worth noting: one incident response professional in the HN thread, raised a concern that operates independently of the bot problem: …"
The ersatz Ted Talk meets LinkedInfluencer rhythm of sentences, the throat clearing fillers as connective tissue…
Or Wikipedia: https://en.wikipedia.org/wiki/Wikipedia:Signs_of_AI_writing
* "With Fraud Defense, there was no process to respond to. The product launched. The requirements page went live."
* "That is not a technical limitation waiting to be engineered around. It is the mechanism."
* "The defeat is mechanical. Bot operators point a camera at a screen, a trivial automation with off-the-shelf hardware."
I could be wrong, of course. Maybe humans are starting to write like LLM's, or maybe it's just confirmation bias on my part.
There's also a few cookie-cutter patterns that should immediately jump out at you if you're at all familiar with AI writing, such as:
> No hardware identifier is transmitted. No attestation is required. No certification layer determines who may participate. User privacy is structurally preserved, not promised.
> Google Cloud Fraud Defense is not a reCAPTCHA update. The QR code is the visible mechanism, but device attestation is the real product.
The bad news: US decided to weaponize big tech’s leverage over the world and does not enforce these laws anymore that fix vanilla capitalism.
You’re confusing markets with capitalism.
Market Socialism (the only reasonable kind) would have these same issues. If Google was owned by the workers instead of capitalists, it would still have incentive to grow. The worker owners would have the exact same incentives as current owners. The only difference would be who the owners are.
Capitalism is not actually “the final boss” that internet leftists make it out to be. Socialism is not the panacea that leftists make it out to be. Surveillance is not a “capitalist only” thing.
As a web-wide captcha replacement, not cool
We are going to see sooooo many scams out there. No wonder Google is locking down third party Android apps outside of their control, getting a user to install "device verification.apk" will become super trivial after people have clicked through these popups a couple times.
That entire QR barcode thing is so that you can browse the web on your laptop/desktop, and _still_ rely on smart phone's attestation, no mobile browser needed.
- Touchscreen user interface is objectively worse than a mouse and keyboard. Portability is the the only benefit to this interface, but this also works strongly to attack impulse control. It's always on you, just a moment away.
- Smartphones are significantly worse for privacy. In a LOT of ways. We can discuss this if you're interested.
- Many smartphone apps exist solely because a website would be less addicting and would also not be able to collect as much data as an app. ie, it's a choice that's worse for you and better for the company.
- They're significantly less open. Yes, grapheneOS and other alternatives exist, however it's not like a computer where I can just install whatever I want without asking the provider permission to unlock the device.
- I touched on this in two other bullets, but it's worth highlighting here: they're built intentionally to be addictive.
- The operating system and hardware are effectively interlocked. (yes, I know grapheneOS exists) but for any modern thing you might actually require a smartphone for (banking app, OTP app, etc) you must be using Apple or Google.
- Providers don't produce security updates well enough; Apple is "better" here, but my 10-15 year old computer can run modern Linux. People brag about 7 years of support on an iPhone. I'm under the impression that Android is better than it used to be, but in the old days any random vendor would give you about 1 year of update support and then you'd be hosed running old Android until you bought a new phone.
- Nobody cares if I own a desktop computer or not, but it's getting to the point that businesses will not work with me unless I have a modern smartphone.
I could probably go on, but I really hate these things.
-- sent from Chrome on Android
However, a lot of recent bot traffic are sophisticated scrappers called "LLM's." You can tell claude to "research X from this www.example.com" and will automatically scrape it and summarize it, something that a LLM is perfect for. Gemini tends to share links instead, presumably because most of Google's revenue comes from ads served on those websites, so if it completely killed the traffic to those websites it would just make less money. Incidentally, I wonder if Claude/Gemini use an search engine-like "index" of all websites or it refuses to cache anything to always fetch "fresh" data.
If this is employed, I don't think the web is only going to be gatekept to Google devices. I think it will also be gatekept to Google's AI's.
Google would be able to display a captcha that no LLM could defeat, and then just let its own LLM pass through.
The same could be said about its other bots, such as the web crawler. Google's bot could crawl webpages that no other crawler would ever be able to simply because it has free pass to captcha-gated GETs. Although the same could be true already today.
There's a good chance they're on HN FWIW. If you are and you're reading this: Fuck you. Reconsider which side you want to be on!
For example: > Bot operators point a camera at a screen, a trivial automation with off-the-shelf hardware. For operations that need Play Integrity attestation specifically, a compliant Android device costs approximately $30 at current market prices
A bot farm cannot bypass for long with a $30 phone. Do you seriously think that if Google sees the same hardware identifier 1000s of times a day they are not going to consider that usage to be fraud?
I appreciate that Google's made a real proposal to avoid the web becoming bottomless AI slop. This article hasn't come with a better alternative - I'd love to see one!
Phones are very cheap, especially refurbished phones. Just have the phones mimic real life sleep/wake cycles and take occasional breaks. Use 25% more devices to account for the loss in uptime.
Besides, some people (often unemployed or disabled, and possibly with sleep disorders or mania) actually don’t do anything other than scroll on their phone all day and night. So you can’t rely on this as a good signal without creating even more blowback. And you really don’t want too much blowback from troubled people who have infinite free time.
That's exactly what they are doing already, and it's not 30$/device but something like <5$/device. Remember they can buy the worst of the worst of the used market.
Betting on device attestation is really betting that smartphones will become less ubiquitous and more expensive to own. Sounds like it's not going to happen to me.
Of course courts will undo their current copyright stance as soon as someone "uncopyrights" Disney movies, which is of course coming, but for now ...
Will SOMEBODY think of the billions?
I wonder what you've done that might warrant harassment?
Look at how complicated CAPTCHAs are getting to try to be unsolvable with AI - it's a losing game. This and the WEI proposal are trying to solve a very, very real problem. If you continue to deny the problem, or every proposal solution without working towards an acceptable one, people will route around the blockage.
Given how important internet is to modern society, letting any one entity decide who should and should not have access is nearing a human rights issue.
Where are they? Where? Can you point me to one person in this thread who "disagrees with the idea that this is bad"? Apparently even you don't go that far.
I think the idea is sad and tragic, but also that we are at the point where we have no choice but to do something.
AI/LLM's have created a vector for abuse that previous tools are failing to protect against, and the problem is only getting worse.
I'm sick of the increase of LLM slop on websites in comments and posts. I'm sick of how fraud and spam and abuse can be increasingly automated in ways current tools can't catch. I'm sick of hosting costs exploding as hobby websites get hammered for no reason.
I don't realistically see any alternative but for some kind of reliable signal that a web request is most likely coming from a real person (not a perfect guarantee, but something good enough). Which means some kind of attestation that it's a real hardware device that costs at least a few bucks and is making human-level numbers of requests (not millions per day), or else some kind of digital ID attestation system.
And I much prefer device attestation that keeps you personally anonymous, as opposed to identity attestation that will inevitably allow the government to track your browsing.
So this seems like the lesser evil. If there are other ideas I'm very open to them as well, but I basically see something like this as a sadly necessary and inevitable evil. Something is necessary and this is less worse than the alternatives. And the fact that website owners choose whether to enable this or not means that those who want to keep an internet open to all devices and web requests can do so, if they're willing to handle the additional costs in handling abuse.
It's making a valid point.
I wondered people are reading "I wonder what you've done that might warrant harassment?" as some kind of personal threat or incitement to harassment, but I read it as precisely the opposite.
It's an entirely valid point that many of us have worked at jobs on products that did something that somebody disagreed with, and we shouldn't be asking anybody to harass us personally for it, because that is wrong.
GP is asking to "aggressively name and shame" engineers. It's entirely valid to say that you wouldn't much like that if it happened to you.
Also as the article states (referencing an HN comment):
> How should we realistically teach Susan from HR the difference between a real Google Captcha QR code and a malicious phishing QR code - you (realistically) can’t.
Susan from HR is the least of it. This is a huge vector to increase fraud, not decrease it.
How would an ethical, competent engineer argue against this?
The CAPTCHA company who put this out might have an agenda, but also since they're in the industry they might also have knowledge to impart.
We're reaching an inflection point with the oligarchies where the old ideas of "writing a blistering editorial" or "calling your congress-critter" need to be seriously questioned as useful and other non-violent methods of recapturing digital freedom need to be entertained.
That captcha company is not trying to push spyware onto my device and punish me for daring to remove it. Google is.
> Look at how complicated CAPTCHAs are getting to try to be unsolvable with AI - it's a losing game.
So don't play. Even cloudflare had a better idea - don't block, just demand payment.
Some people think women shouldn’t be allowed to vote, not all opinions are created equal.
Are some ideas worth more than others should some people's votes count more than others? You can't have both.
If you don't like this functionality, participate in democracy and work with your representatives to make it unlawful. But be prepared to humbly lose if the majority disagrees with you.
You're not, however, entitled to a "heckler's veto."
What do you think this is a call for, if not harassment?
It sounds to me like you're trying to defend harassment. If that's not true, and you also believe people should not be harassed, it would be helpful if you stated so clearly and unambiguously.
Usually people feel ashamed when they do something that is shameful. That is the definition of being uncomfortable.
> It sounds to me like you're trying to defend harassment. If that's not true, and you also believe people should not be harassed, it would be helpful if you stated so clearly.
I am against the harassment. For me, these arguments feels like that you are trying to allow people do to whatever the want for the money as long as they can hide behind the company.
If the law allows it, why not?
If a company is doing things you don't like, you have a few choices:
1. Don't buy things from them
2. Picket or otherwise express your displeasure at the company's place of business
3. Publish your own complaint about them
4. Pressure your legal representative to make the behavior unlawful
Then they'll come with "but I have a family and mortgage". No shit, so does literally everyone.
I mean, I hate this QR code shit as much as anyone, but c'mon, we can and should be better - both in how we treat others, and how much we rely on this shit.
I imagine if they would be named and shamed, they would get huge contracts in companies like oracle.
Such as? I don't see how regulation would apply here without concrete technical solutions that enforce it. So what alternative mitigations do you have in mind?
These wouldn't eliminate the problem, but they'd change it from "many people do this" to "this is always a malicious attack, react accordingly".
Regulate it today, and tomorrow, corporate legal departments will be very carefully training their employees to understand that it's illegal and they should never do it.
Currently, some countries have laws saying that you're not allowed to pay bribes, including foreign bribes. Consider how widespread that practice was when it was outlawed. Imagine if, instead of regulating it, those countries had said "oh, that's not enforceable and too many people are already doing it and it would affect existing business practices...". Instead, today, corporate legal departments will ensure that employees are trained to know they can never do that and they should report any attempts to solicit bribes.
CAPTCHAs are increasingly ineffective. Services are either going to go offline or implement some kind of system like this. PII like credit cards or SSNs aren't enough because those are regularly stolen.
So where do things go? Fewer services and infinite fraud?
A combination of "regulate AI" and "The optimal amount of fraud is not zero". https://www.bitsaboutmoney.com/archive/optimal-amount-of-fra...
As a footnote i found googles recaptcha bitterly ironic, it was painted it in bright colors "this data assists in book scanning" or "this help our self driving cars recognize stop signs" but really designed to train models to do exactly what it's trying to prevent them from doing. and making life hell for the humans along the way. The modern single click version is doing behavioral analyses.
People are just going to have to find a new way to monetize. Maybe more things will become paywalled, or sponsored long-term like old TV shows. Again, there’s no good way to solve this, and the “solutions” on offer just contribute to the surveillance state without solving the problem.
>For operations that need Play Integrity attestation specifically, a compliant Android device costs approximately $30 at current market prices
This assumes the logic on google's side is something like `if(attestationResult == "success") allow()`, but it's not hard to imagine the device type being factored into some sort of fraud score. For instance, expensive devices might have a lower fraud score than cheaper devices, to deter buying a bunch of cheap devices. They might also analyze the device mix for a given site, so if thousands of Chinese phones suddenly start signing up for Anne's Muffin Shop, those will get a higher fraud score.
>Firefox for Android does not appear in Google’s stated browser support list for Fraud Defense.
The browser only needs to show a QR code, so if you're on firefox mobile they'll either open a deeplink to google play services on the phone itself, or show a qr code.
>One human solving a single challenge pays a negligible cost. A bot farm running concurrent sessions faces exponential compute costs with each additional attempt - and AI agents, which consume GPU cycles to operate, face identical penalties regardless of how sophisticated their reasoning is.
PoW for bot protection basically never caught on because javascript performance is poor, and human time is worth more than a computer's time. An attacker doesn't care if some server has to wait 10s to solve a PoW challenge, but a human would. An 8-core server costs 10 cents per hour on hetzner. Even if you assume everyone has a 8-core desktop-class CPU at their disposal (ie. no mobile devices), a 6 minute challenge would cost an attacker a penny. On the other hand how much do you think the average person values 6 minutes of their time?