517
"Scan to Verify You're Human": Google's reCAPTCHA is trialing a new "experimental challenge type" which requires desktop users to use an Android or iOS device to be able to pass it (europe.pub)
submitted 5 months ago by to c/privacy@lemmy.ml
156 comments fedilink hide all child comments
 

cross-posted from: https://lemmy.ml/post/47972724

i encountered this for the first time today while attempting to read something on archive.today.

i confirmed that decoding the qrcode using a computer and following the URL it contains is insufficient; the error it gave directed me here which is what the linked screenshot is of.

the old type of captcha remains available too, for now:

screenshot of text: Important: Mobile verification for Google Cloud Fraud Defense is an experimental challenge type in Preview. Visual and audio challenges are available as alternatives for users who can't complete mobile verification. To use them, click the Visual or Audio buttons.

screenshot of google support webpage with text: To complete the mobile verification, you must use a compatible mobile device. If verifying on iOS/iPadOS device with version 15.0-16.4, download the reCAPTCHA app in the App Store. After installation, return to the challenge to try again. If verifying on Android device with Google Play Services version older than 25.41.30, upgrade to the latest Google Play Services version. After upgrading, return to the challenge to try again. Scan to Verify You're Human. Use your phone's camera app to scan this QR code. This securely links your device. Mobile Verification. Verification will initialize the reCAPTCHA app on your device.
you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 5 months ago* (last edited 5 months ago) (4 children)

I'd heard of this strategy, like making it perform some kind of costly encryption that's irrelevant to a human user but restrictively expensive for a bot army.

But does decoding a QR code apply? I never really thought about it. I guess it's an image, it's at least a little big by comparison... but it's also in a restricted, easy to capture spot and maybe could be minimized to a fairly small pixel set? Idk how many key pixels you need to parse a QR code... I guess I could Google

*typo bit --> bot and bit --> big... I'm full of bit

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 2 points 5 months ago (1 child)

    I don't know much about this new captcha system, but I feel like the challenge wouldn't really be in the scanning of the qr code itself but more so on making the device you're scanning with seem legitimate. They could check usage patterns, what apps are installed, how many accounts are added and are they actively used, location and sensor data, are the hardware specifications really unusual, are they constantly trying to complete random captchas... Stuff like that to tell apart a real user's device from a bot or sandbox. The QR Code is probably just a random ID for which captcha instance the user is trying to pass.

    Also I just realised this but this is probably inconvenient as hell. Like I do NOT want to constantly be picking up my phone to scan QR codes when I'm trying to go around the Internet. What if my phone is on the other side of the house? I don't want to get up and walk all the way over there! If this gets fully rolled out there may actually be a small dip on the amount of desktop users of websites because they just leave when they are hit wth this captcha instead of bothering to scan a code.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •