• Google is making it mandatory to have Play Services for its next-generation reCAPTCHA system on Android.

  • Your phone will need to be running Play Services version 25.41.30 or greater when the system asks you to scan a QR code for verification.

  • This hurdle means that de-Googled phones will fail the verification test by default.

  • 9tr6gyp3@lemmy.world
    link
    fedilink
    English
    arrow-up
    282
    arrow-down
    1
    ·
    8 days ago

    If you’re a web dev, and you implement this, just know you won’t receive my web traffic. Ill go live with the other robots and we will start our own internet with blackjack and hookers.

  • Zak@lemmy.world
    link
    fedilink
    English
    arrow-up
    186
    ·
    8 days ago

    That means if Google’s verification system gets widely adopted, browsing the web could become a headache.

    Using a phone to scan a QR code in order to access a website on my desktop is a headache even if it has no dependencies in particular.

    • limonfiesta@lemmy.world
      link
      fedilink
      English
      arrow-up
      48
      ·
      8 days ago

      Unless it was the website I needed inorder to receive an organ donation, I would just close it.

      I could claim that’s an act of righteous protest, but really I just know that absent my needing a new liver, there’s no website I would ever care enough about to get me to scan a QR code just to keep browsing.

    • Kairos@lemmy.today
      link
      fedilink
      English
      arrow-up
      9
      ·
      8 days ago

      I have, multiple times, had to take a screenshot, send it to another device, and then display that QR code on that device so I can scan it. Nothing about using phones isn’t a headache.

        • systemglitch@lemmy.world
          link
          fedilink
          English
          arrow-up
          6
          ·
          8 days ago

          I spend most of my day without a phone near me. I hate phones, this won’t encourage me to do anything but pull further away.

          I suppose that is a win. Real life isn’t happening on a screen.

  • thejml@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    113
    ·
    8 days ago

    Ignoring the de-Googled phones for a sec: I assume if you’re using a desktop, then the QR shows up and you have to drag out your phone to scan it in the camera app that then prompts to open the google play store. Dumb, but possible for people who have a phone with Android. What about those that don’t? Would you need a google account?

    Now if it’s all on phone (using Chrome or Firefox or whatever) and pops up a QR code, you can’t scan it… but the browser would have to open the play store directly and thats a huge security no-no. The browser shouldn’t even know I have the Play Store.

    I have a feeling the hundreds of us that are de-Googled ad just going to stop using these sites all together.

    • Phoenixz@lemmy.ca
      link
      fedilink
      English
      arrow-up
      52
      arrow-down
      1
      ·
      8 days ago

      Yeah, so the hundreds of us won’t be able to use the internet anymore if this passes

      Awesome

    • Dave@lemmy.nz
      link
      fedilink
      English
      arrow-up
      10
      ·
      8 days ago

      The browser shouldn’t even know I have the Play Store.

      Every app on your Android phone knows every other app you have installed. GrapheneOS are trying to solve this but it’s challenging.

    • Cethin@lemmy.zip
      link
      fedilink
      English
      arrow-up
      6
      ·
      8 days ago

      I’m not even de-Googled (yet) and I wouldn’t bother with this shit. It’s an instant close in that tab, and if it’s something I need then I’ll find another service.

    • timestatic@feddit.org
      link
      fedilink
      English
      arrow-up
      4
      ·
      8 days ago

      What about people who use iPhones? Even if I used a normal google android I wouldn’t want to be bothered to scan a qr code with my phone to verify myself every time

  • Wispy2891@lemmy.world
    link
    fedilink
    English
    arrow-up
    95
    arrow-down
    1
    ·
    8 days ago

    This is awesome news for scammers:

    1. Fake page will say “you need to scan this qr code to verify you’re human”
    2. Users normally dismisses this shit, but it has become normal nowadays, take out the phone to scan it
    3. Qr code opens a page on totallynotascam.com that say “you need to install this totally safe APK on your device for verification 😉”
    4. APK passes the new useless developer “verification” as the scammer either used a hacked dev account or just paid $25 with a stolen id + stolen credit card
    5. User see the message “APK verified by Google play protect” and would totally believe the bullshit, giving all the possible permissions to the app
    • redsand@infosec.pub
      link
      fedilink
      English
      arrow-up
      2
      ·
      7 days ago

      Don’t even need an app. There’s a root LPE almost monthly now most of android takes a month or more to patch. Just need a common exploitable app to handle your link and get your initial shell.

  • Phoenixz@lemmy.ca
    link
    fedilink
    English
    arrow-up
    67
    ·
    8 days ago

    Once this is implemented, Google will have finally succeeded in closing the entire fucking internet. That is, assuming this will become anywhere successful and smaller websites will be using it as well.

  • x00z@lemmy.world
    link
    fedilink
    English
    arrow-up
    59
    ·
    7 days ago

    A lot of Android bot devices simulate (or even ARE) a full phone with a legit Play Store and other Google services.

    This requirement is enforced vendor lock in. Nothing more.

  • zerofk@lemmy.zip
    link
    fedilink
    English
    arrow-up
    57
    ·
    8 days ago

    Wait wait wait. To prove you’re human you have to read something designed for computers to read?

    • JcbAzPx@lemmy.world
      link
      fedilink
      English
      arrow-up
      5
      arrow-down
      1
      ·
      8 days ago

      To be honest, most of what they use now is pretty easy for machines to do. Mostly because they’ve been using the captcha to train ocr and self driving.

        • YeahToast@aussie.zone
          link
          fedilink
          English
          arrow-up
          3
          ·
          7 days ago

          And started off with letter identification to help with reading scanned books. For example, place 3 known 'R’s tell users to select all R’s. If majority of people select 4 R’s then that unknown 4th R becomes a known letter

          • nickiwest@lemmy.world
            link
            fedilink
            English
            arrow-up
            1
            ·
            4 days ago

            I knew that function. And improving OCR felt like a worthwhile endeavor to crowdsource. There are a lot of old books that we need to digitize before we lose them forever.

            The pivot to recognizing things for self-driving cars makes a lot of sense, but I really don’t like the idea that I’m increasing shareholder value for Tesla.

  • ennof@feddit.org
    link
    fedilink
    English
    arrow-up
    46
    arrow-down
    1
    ·
    8 days ago

    “Google’s next-gen reCAPTCHA system could spell trouble for any website that implements it as no de-Googled phone user will care to use it”

    • frongt@lemmy.zip
      link
      fedilink
      English
      arrow-up
      35
      arrow-down
      1
      ·
      8 days ago

      That demographic is so small as to be irrelevant to the majority of companies.

    • Dæmon S.@calckey.world
      link
      fedilink
      arrow-up
      16
      arrow-down
      2
      ·
      8 days ago

      @ennof@feddit.org @LuminousLuddite@lemmy.world @technology@lemmy.world

      As if it were a matter of caring or wanting/not wanting to use websites… It would be really nice to live in such a world where one could have the luxury of “choosing”. Unfortunately, it’s not this world for many people and many peoples.

      To exemplify this, there are websites I, as a Brazilian, can’t simply choose whether to use or not, because there are government and bureau websites for services through which I’m expected to comply with citizen things I didn’t ask for (as I didn’t ask to be born in this world to begin with). Online services such as “DETRAN” (state-wise transportation bureaus where one must renew one’s driver’s license), which I remember having to click a reCAPTCHA in order to proceed with transportation-related citizen duties. I can’t have the luxury of saying “you know what, I’m not renewing my driver’s license which has become my ID for a plethora of services not even related to driving, which means I’m going ID-less and becoming a legally-indigent person in the eyes of the next cop that requests my ID”.

      Hell, I can’t even choose to have a degoogled phone because our customs (Receita Federal) will likely deny the entry for any “unlicensed device” (i.e. devices not licensed by ANATEL, Brazilian telecommunication agency). And installing a custom ROM in any available device is not without the risk of bricking the device (and losing a monthly minimum wage worth of money spent with said device) especially for someone like me who never installed custom ROMs.

      Again, would be really awesome to live in the world you described where one could afford “caring to use” things…

      • Wispy2891@lemmy.world
        link
        fedilink
        English
        arrow-up
        7
        ·
        8 days ago

        Well the good thing is that now Google enshittified recaptcha and now if the website owner wants to implement it, needs to pay $1 for 1000 verification requests which is crazy expensive for something that as of now it’s easy to pass as a bot than as a human (bots ask the voice verification and ask a LLM to interpret that, pass recaptcha in less than a second. Humans need to click on 25 traffic lights and give up in the process)

  • RachelRodent@lemmy.dbzer0.com
    link
    fedilink
    English
    arrow-up
    45
    ·
    edit-2
    8 days ago

    Would this pass in EU? Seems anti competition. Do we need another movement like stop chat control to mobilize people?

    • WhoIzDisIz@lemmy.today
      link
      fedilink
      English
      arrow-up
      41
      ·
      8 days ago

      It’s not just anti-competition, but anti-privacy - Google will know exactly who is going to what sites, regardless of your browser.

    • matlag@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      7
      ·
      8 days ago

      Probably not, but my expectations is the EU will slam them with a record fine of 0.03% of their monthly revenue after 5 years of investigations and obligation to provide an alternative solution, that they will work around so it still does not fix anything.

      By the time the damages would be done.

      Has anyone seen the benefits of EU’s mandatory opening of chat systems to third parties yet??

    • namingthingsiseasy@programming.dev
      link
      fedilink
      English
      arrow-up
      3
      ·
      8 days ago

      Yeah, this should definitely not be allowed. Google should not be allowed to dictate which operating systems people are allowed to use. And no doubt that this is harmful to many European companies and prevents competition in the space of mobile operating systems.

      That said, it remains to be seen if anything will get done about it.

  • Blue@lemmy.world
    link
    fedilink
    English
    arrow-up
    42
    ·
    8 days ago

    Then I’ll just not use the services that use it, very stupid, as this shouldn’t be necessary

    • DFX4509B@lemmy.wtf
      link
      fedilink
      English
      arrow-up
      3
      ·
      8 days ago

      That’s gonna be really hard with the increasing amount of sites that push this.

  • PierceTheBubble@lemmy.ml
    link
    fedilink
    English
    arrow-up
    41
    ·
    edit-2
    8 days ago

    It turns out reCAPCHA has been a privacy nightmare from the beginning: from silently monitoring user activity in the background, to sending payment information to Google; in order for an AI to assess the data, and return a risk-score to the website. But that apparently wasn’t bold enough, and now an effective 2FA is required, which provides additional telemetry to Google (but not to the website or app: which is obviously the privacy concern). So get ready to 2FA with Google upon registration, login, updating your cart, and payment; or to skip the hassle, you should just let an approved “shopping assistant” make purchases for you (“that drive a projected 25% increase in average order value”). I don’t even own a modern Android or iOS device, so how am I supposed to solve these?

    • Tollana1234567@lemmy.today
      link
      fedilink
      English
      arrow-up
      1
      ·
      7 days ago

      google allows V3 version to be used REDDIT , thats why there has ben a huge amount of bans last year. alledgely to catch bots or whatever.

    • cecilkorik@piefed.ca
      link
      fedilink
      English
      arrow-up
      24
      arrow-down
      1
      ·
      8 days ago

      I think I’ll just go to a local store and pay in cash instead. I’m starting to think the Amish have the right idea, anyone know where I can rent a horse and buggy?

      • PierceTheBubble@lemmy.ml
        link
        fedilink
        English
        arrow-up
        6
        arrow-down
        1
        ·
        8 days ago

        Yeah, on the rare occasion where I do order something online, and happen to trip up the convoluted system, I rather give the webshop a call, than giving into this dystopian nonsense. And I’ve long done away with any mainstream platforms, which I suspect will happily adopt the system (especially those who forced me to adopt 2FA: which was seemingly just in preparation of this…). I’ll happily function as an example, to illustrate just how morally unjust it is, to effectively force someone to purchase and use a device they explicitly chose not to use; I really want to hear someone justify that.

        I think there’s few people left, which do not believe we’ve gone too far with technology, so the Amish to some extend are definitely onto something.