517
"Scan to Verify You're Human": Google's reCAPTCHA is trialing a new "experimental challenge type" which requires desktop users to use an Android or iOS device to be able to pass it (europe.pub)
submitted 5 months ago by to c/privacy@lemmy.ml
156 comments fedilink hide all child comments
 

cross-posted from: https://lemmy.ml/post/47972724

i encountered this for the first time today while attempting to read something on archive.today.

i confirmed that decoding the qrcode using a computer and following the URL it contains is insufficient; the error it gave directed me here which is what the linked screenshot is of.

the old type of captcha remains available too, for now:

screenshot of text: Important: Mobile verification for Google Cloud Fraud Defense is an experimental challenge type in Preview. Visual and audio challenges are available as alternatives for users who can't complete mobile verification. To use them, click the Visual or Audio buttons.

screenshot of google support webpage with text: To complete the mobile verification, you must use a compatible mobile device. If verifying on iOS/iPadOS device with version 15.0-16.4, download the reCAPTCHA app in the App Store. After installation, return to the challenge to try again. If verifying on Android device with Google Play Services version older than 25.41.30, upgrade to the latest Google Play Services version. After upgrading, return to the challenge to try again. Scan to Verify You're Human. Use your phone's camera app to scan this QR code. This securely links your device. Mobile Verification. Verification will initialize the reCAPTCHA app on your device.
you are viewing a single comment's thread
view the rest of the comments
[–] 232 points 5 months ago (24 children)

  1. People without a mobile device are fucked out of being able to pass a captcha

  2. As if this isn't a way for them to associate multiple sessions on multiple specific devices with one another, this is just another avenue for data collection, period. Hidden under the guise of "more secure."

  • permalink
  • fedilink
  • source
  • hideshow 24 child comments
    •
  • [–] 53 points 5 months ago (4 children)

    Captcha has been one of the greatest google acquisitions ever.

    They acquired it under the guise of improving OCR and have since morphed it into an AI data farm (how else is google lens gonna know what objects are what?) and now total insight into a users every single action from desktop to mobile, tying it all together into a surveillance nightmare.

    I can guess the permissions that the recaptcha app needs now. Probably something akin to root access with all datapoints and considerations you could think of.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 20 points 5 months ago*

    I used to always add one incorrect tile and skip one correct tile.(It would still pass)

    I thiught I was such a rebel lol

    Then I figured, they'd be stupid if they didn't show the same image to multiple people...

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 5 months ago (2 children)

    How would that teach Lens to recognise anything other than motorcycles and traffic lights really well?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 5 months ago (1 child)

    I've had many, many not traffic light and motorcycle/bicycle recaptchas. They're probably leaning a bit into self driving learning the past few years.

    Lens has a lot more data points nowadays after everyone's google photos was used for training for what, 10+ years at this point?

    Google harvested all human typed words 15 years ago with the google library project. They've been hoarding and processing data for models forever.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 5 months ago

    I was being at least partly facetious because I rarely get anything but motorcycles and traffic lights and even then it'll most likely ask me about buses or bridges. Not disagreeing that they're hoarding data :)

  • permalink
  • fedilink
  • source
  • parent
  • [+] 38 points 5 months ago* (last edited 2 months ago) (3 children)
    [deleted]
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 17 points 5 months ago (6 children)
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 3 points 5 months ago (5 children)

    The point with captchas is not really that bots can't pass them, more that its too expensive to pass them consistently with a hurtfully large enough volume of bots.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 2 points 5 months ago* (last edited 5 months ago) (4 children)

    I'd heard of this strategy, like making it perform some kind of costly encryption that's irrelevant to a human user but restrictively expensive for a bot army.

    But does decoding a QR code apply? I never really thought about it. I guess it's an image, it's at least a little big by comparison... but it's also in a restricted, easy to capture spot and maybe could be minimized to a fairly small pixel set? Idk how many key pixels you need to parse a QR code... I guess I could Google

    *typo bit --> bot and bit --> big... I'm full of bit

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 2 points 5 months ago (1 child)

    I don't know much about this new captcha system, but I feel like the challenge wouldn't really be in the scanning of the qr code itself but more so on making the device you're scanning with seem legitimate. They could check usage patterns, what apps are installed, how many accounts are added and are they actively used, location and sensor data, are the hardware specifications really unusual, are they constantly trying to complete random captchas... Stuff like that to tell apart a real user's device from a bot or sandbox. The QR Code is probably just a random ID for which captcha instance the user is trying to pass.

    Also I just realised this but this is probably inconvenient as hell. Like I do NOT want to constantly be picking up my phone to scan QR codes when I'm trying to go around the Internet. What if my phone is on the other side of the house? I don't want to get up and walk all the way over there! If this gets fully rolled out there may actually be a small dip on the amount of desktop users of websites because they just leave when they are hit wth this captcha instead of bothering to scan a code.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 16 points 5 months ago (2 children)

    i have one. but it isn't android, or ios, or 'smart' in any way. it doesn't even text. it's just a telephone that fits in my pocket and connects to the cellular networks. it's all i want. it's all i use. it's all i've needed ever since i got my first one about 25 years ago.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 9 points 5 months ago (2 children)

    It really should be illegal to build systems that require a user's access to any unrelated technology. You shouldn't be forced to have a phone to pay a parking fee or to get on the bus. You shouldn't need an app to charge your car. You shouldn't need to use proprietary software from one spesific company to pass a captcha on a random site.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •