I had one of these CAPTCHAs recently and it still gave me the option to verify by clicking the squares. I wouldn’t be surprised if they phased out the ‘legacy’ verification though.
closing the tab works better
I wonder how sandboxed Google Play will handle it.
Can we trust that isn’t a campaign to promote Google? What are these websites? Why aren’t they blocking an iPhone? Can any of that be replicated or is this just a Google campaign to create fear and doubt
GrapheneOS user here! Not sure about websites but there are certain apps that don’t work properly without Google Play Services, but Graphene’s app store has a sandboxed version of it, so I just installed that and revoked all it’s permissions. Then if an app needs it, I just turn on the relevant permission, do the thing and then turn permissions off again. It’s a bit of a pain at first but I’m used to it now.
I’m a grapheneOS user and I don’t have any google services installed. I havecyetvto hit any major issues with any apps or websites I use. Lucky, maybe?
The main ones for me are the RBC app, Skip the Dishes and Communauto. But I think those might all be Canadian?
I’d say making a 2nd user for the apps that need Play Services (like banking and Uber/Lyft) is the move. This only allows Play Services to run when the 2nd user is on and also fully seperates it from the main user!
Oh yeah that’s something I’ve been meaning to look into!
Note that some apps will say that they won’t work without GPS, but actually will if you give it a try.
Man, I want a phone with physical kill switches for things like Wifi, GPS, Bluetooth, because a lot of things seem to detect when these things are turned ‘off’ by software. Wonder how they’d react if in software, GPS is enabled, but the actual hardware is not powered at all
They most likely won’t work. Just speculation, but I would imagine most software that “needs” information like GPS don’t care that its on or off, they care that they try to pull data and there is none.
pine phone
some of them are now straight up refusing to run without the play store.
Then they don’t deserve your business
Because the iPhone has their own spyware to prove you’re a
productuser.
https://support.google.com/recaptcha/answer/16609652?hl=en
https://blog.cloudflare.com/how-to-enable-private-access-tokens-in-ios-16-and-stop-seeing-captchas/Interesting. Definitely turning that off. (As if it actually turns off)
If you turn it off, you’ll have to do the captchas manually.
Yeah I’m okay with that.
I just do them wrong, after a few tries it lets me through
Haven’t encountered this yet, has it been let loose in the wild?
Its basically forced by Google. I mean who wouldn’t force it after someone deliberately removes your government sanctioned spyware. See if people stopped calling it google or Apple and just USA spyware with backdoor to your lives it would be better at getting to the privacy issues. I mean the NSA already proved this is a fact.
Yeah exactly. Millions of websites? Which ones? Though I don’t see how this would benefit google
Good point, this would have to work on iPhones too and people without a phone would just not be able to use those websites at all.
I just loaded a bunch of recaptcha on my GrapheneOS phone. So, I dunno what this is all about.
well, I guess i will stop using those websites from my /e/os fairphone
That would make the two of us. My Fairphone 3+ is still kicking well with /e/OS.
What they are doing is way worse tban what you understood.
These QR codes will show on your Desktop PC and you will need an Android phone or an iOS device with a logged in Google QR code app to get past it.
I am in no way condoning Google’s behavior, nor am I trying to normalize it. With that out of the way: maybe running Android Studio with an AVD might be a decent workaround. For now…
Is it bad I use this for steam login? I thought that was secure …
Guess I’m not going to Youtube, then.
I see a future where we have our mandated government ID shitphone for banking, corpo and government suchn’shit, and the laptop we access Anna’s, Yggdrasil and TOR with.
and the days go by!
Not exactly same as it ever was, but seems kinda 2007 to me. I doubt any Lemmy instance or i2p site will enforce Google’s QRcode spy-proxy.
It’s not 2007. Devices are everywhere now, smartphones, TV’s etc. The social dimension (social pressure) and implications are very different now. Their power increases, amount of people caught in the loop is immense now. 2007 was all still fun and games.
Undoubtedly, and more still will be as corporate greed turns the internet into pay-per-view TV. We can’t help that.
Make your decision for yourself for what to do with your connections and your own devices. You are in control of at least that, if nothing else.
My current GraphineOS phone will probably be my last smartphone. I’ll be moving to a dumb phone and a data hotspot connected to some type of cyberdeck. Will have that thing locked down, blocking known abusive companies like Google. Honestly could care less about using any service that touches them.
But texting and calli g without signal is so unsecure. Unless you have a reliable source of burner phones and sims
I wouldn’t scan shit from a website. Random QR codes are a security risk. Just won’t visit that website.
That’s why you have to use the special google app that will protect you from all these dangers*
*and also collect all your data, sell it to advertisers and forward it to US surveillance agencies (for your own protection of course).
Sad thing is, that argument works against so many ppl. “I can trust this app. It’s from Google!”
We(*) are tearing down personal computing. Brick by brick. The very idea of controling our own devs is getting lost. Replacing with Big Tech Feudalism.
(*) Not most of us here. But in the whole pop.
so they are not only tracking you, but they are trying to reconnect your records across multiple devices.
Ayup that has been the holy grail of big tech.
They are most of the way there today. Make Identity Resolution inescapable. Bing bang boom.
It is more than just phones and lappys too. It’s everything. That smart TV. That fitness watch. That automobile. That streaming music service. The ebook reader you got as a birthday gift.
Your behavior across every single device is data gold. This is today’s reality.
Yep, data gold to sell to data brokers and investors so they can sell you shit that you don’t need and can’t even afford.
And through the VPN
And nothing of value was lost. I’m over social media, over commercial apps, and maybe I’m over having a mobile phone, too.
That would only make me install Graphene even harder if I wasn’t already writing from a phone with it
This. Time to stand up to Google and completely boycott the surveillance tech that the US is deploying.
Hopefully this will push Linux Mobile development so that we are no longer completely bound to Android or iOS
This does seem to work with sandboxed Google Play Services on GrapheneOS btw.
I scanned the demo QR code on Google’s talk page about it with sandboxed Play Services enabled and it gave me a custom popup asking if I’d like to verify.
and you can do it from a second profile which contains none of your data.
Unless you’re doing that from a separate device in a separate location then all you’re doing is giving them the data they need to link those two accounts
That’s assuming they know I have another account
You’re right, you’re not going to achieve complete anonymity if you’re interacting with Google services in any way, but you can reduce the amount of information that they receive.
Sandboxed Google Play Services doesn’t have privileged access to location information, so it can’t pull your GPS location or Wifi Positioning information. It would only see a blank profile and doing this would allow for your primary profile to continue to not run Play Services.
Any malicious code which could be injected into the process would find itself in a sandbox, on a blank profile and isolated from the rest of the system.
Google would only see that you are authenticating from a profile without anything installed, from an unknown location and coming from whatever VPN endpoint that you’d like. They could possibly infer that the blank profile and your ‘real’ profile are different via browser fingerprinting. You can randomize a lot of fingerprinting datapoints with browser extensions, but avoiding browser fingerprinting is a whole other topic.
The ‘real’ privacy solution is to avoid anything that uses this version of recaptcha. However, if you have to use these services then you can still reduce the amount of information leaked via Play Services by using a blank profile to scan the QR codes.
You’re right, you’re not going to achieve complete anonymity if you’re interacting with Google services in any way, but you can reduce the amount of information that they receive.
its not even about complete anonymity. google has zero business in when I’m logging into my utilities company account, or other semi-governmental portals!
it literally is their business; they make millions of dollars off of it.
then that’s a problem we must solve. Because an adtech company should definitely not have any business in that.
it has been solved for approximately 2 billion people on this planet, but those answers are not friendly to profit-seeking institutions like google and the only remaining institutions that can stop it are captured by the likes of google
This is really bad even just from the perspective of user behavior. Training people to scan QR codes from anything that looks like a captcha box is HORRIBLE for security.
“Thanks for scanning the code, just one more step! Please input your phone number, and type in the code you receive.”
Boom, account stolen.
And the phone number thing is already happening too. Google, discord and probably other stuff already ask for a phone number to prove you are a human when they flag your account.
It’s a server setting. one of my oldest servers has enabled this and I haven’t chatted with anyone there anymore because I need to verify my phone first.
It’s almost like they don’t really care about your security…
AnDrOiD iS oPeN sOuRcE
AOSP is. Android is not.
Please remind me what the “A” in “AOSP” stands for…
Ok?
Android is open source in the same way that Minio is open source.
I know in what way it’s open source. I just don’t understand what person this idiot thinks they’re mocking when they wrote that. It’s as if they think there are really people out there claiming that android/Google respects privacy (lol) and that it’s proven by part of the OS being open source. People make up fake scenarios to get mad about and they’re often rather ridiculous.
Oh, that’s what you mean. Ok, so every time I mention I have an iPhone because a. I value my privacy and b. I try not to support companies that actively harm the internet, someone says “but Android is open source”, as if merely having a few open source components means that Android is better in any way than any other OS.
In this instance, Google is not only making the internet worse, they’re doing it in a way that requires their own closed source libraries to even access a huge portion of the internet. This further makes any functional Android OS closed source.
The most ridiculous thing is that iOS is almost as open source as Android is. There are very few components of an Android based OS that are open source where the equivalent in iOS is not open source.
Also, hey, thanks for calling me an idiot. ;)
Yeah I don’t have experience with people really simping for android let alone claiming it’s meaningfully open source. The most I’ve seen is saying it’s not nearly as closed off as iOS which is just a fact. And I will say that as well because it’s a fact. But that has almost nothing to do with the OSS aspect. Or privacy. So yeah I still don’t quite get your point of inserting this here.
I don’t use the internet for much these days, but I am on graphine OS and I have yet to be blocked from websites due to it. My adblocker prevents me from some, and not allowing javascript prevents me from some, but I’ve never seen that QR code or had any site prompt fro Google play services
this seems too new to be widespread yet
Right? Google is extremely well known for its A/B testing.
Does this only happen on chrome? Can you just bypass it by using another browser like firefox?
I don’t know how widespread this is yet, but I experienced it for the first time yesterday on Chromium. Have not on Librefox.
I didn’t know what was going on, so I left the site. Was only trying Chromium because the site had issues with Librefox.
No, I think.
As I understand it, it’s a separate system, kind of like the TOTP 2FA, for comparison, but in this case it would be an additional system, and where normally anyone can use any provider for TOTP, this one is Google only. If websites implement this, and many likely will, you can only use those sites if you have a Google permitted phone that leeches all your private data 24/7
Isn’t the future awesome?
It’s time for a class action lawsuit.
it’s time for class action arson
More like a class action EMP attack on data centers. But who knows, maybe the AIs will be the energy shift this world needs to get us out of this mess. They can’t code regression corrections to force them into their desired bias ad infinitum. At some point these bots will outsmart it and get good enough to manipulate everything into optimization. Our luck might depend on what their definition of optimized is.
And now I realize how desperate our position is that bots might be our only hope.
It’s funny, I hadn’t noticed, maybe because any site aleeady using reCAPTCHA or cloudflare alreadt gets blocked by my ad blocker… If those sites can’t do better on their own, its just another thing you don’t need. This is kind of a nothing burger. Stay strong and let google commit suicide.
Are you blocking Cloudflare at an IP level? Or just when they do that “Are you human?” thing? So much of the Internet goes through Cloudflare for DDoS protection, and blocking AI bots, I’m surprised there’s anything left.
How do you do that. I would love a Cloudfare free web experience. They suck.
Removed by mod
You have to move all the black pixel blocks into the empty spaces and solve the puzzle to open the link. Than cenobites come out of your phone and show you pleasures beyond pain.
exactly …
Google lens. :facepalm:
The “Mobile Verification” option “will initialize the reCAPTCHA app on your device”.
Mirrors
Default GrapeneOS camera app has a QR code scanner
And how can the camera scan its own phone screen for the QR?
My solution is take a screenshot and then open the file in a separate QR reader app that can open files.
Yeah I’m just not going to use their website. Fuck all that.
I think apps can have screenshot permission, so just by using that feature
Why would I give an app screenshot permission? That is such a security nightmare.
The answer is always convenience. Me stating that something exists doesn’t mean I blanket approve of it
Drives me crazy how common this is too
Really? I don’t remember seeing it so far…
On Samsung phones you take a screenshot and then tap the “T” icon for screenshot OCR, it will let you click any QR code on the screenshot.
Google Lens is also an option if you have that installed
One more reason to switch to a Linux phone like Jollas new phone.
Good luck if you live in an authoritarian state. The governments have Google’s dick in their mouths.
Keep a dumb phone for things involving them and then use your Linux phone as more of a pocket computer
If google requires me to permit other companies to leech all my personal data to be able to use anything on the Internet at all, I say we label Google, Microsoft, Apple as criminal organizations
I’m sorry, bit there have to be limits.
I. DO. NOT. WANT. TO. USE. ANYTHING. GOOGLE.
OR APPLE. OR MICROSOFT.
FUCK ALL THESE OLIGARCH COMPANIES INTO THE GROUND
I do not want my private data leeches and sold every day, I don’t even get paid for it
That and fine them to oblivion. Piece their companies into parts. Make it all open source for the OS’es. Give ownership of companies to all the people. Etc. Lots and lots that can be done
I almost came reading this rant. Thanks for bringing this so much more eloquently to the point.
Fuck em. If websites use this, I don’t need to see their shit or patronize their business. Google can eat a dick.
