15 ms·

Google broke reCAPTCHA for de-googled Android users

• paulnpace 5mo ago
  I wonder if any of these sites will see any meaningful drop in users, or if they even care.
• hackernews682 5mo ago
  The gate to the pig pen is closing…
• ranger_danger 5mo ago
  Sites that use reCAPTCHA/Turnstile/etc. have already been broken for me for years now due to neverending captcha/refresh loops. My ISP regularly changes everyone's IP, and I apparently share an ISP with people who suck, so I get flagged just trying to do all sorts of normal things. Some examples: - I've never bought anything from Etsy but I'm somehow banned from even viewing their site at all. - Discord immediately bans me any time I try to create an account. - Can't buy flights from Delta, always gives a non-descript error. - Can't buy concert tickets, it thinks I'm a fraudulent buyer. - Most CF sites produce a "Sorry, you have been blocked" page, or just loop. - Trying to buy products on a shopping cart will have my order silently flagged/canceled for "VPN usage" (I don't use one). - Some sites/programs block me for being on the DroneBL or similar lists I did nothing to get onto, and have verified many times that it's not really coming from me. I just take my business elsewhere... eventually I'll probably just stop using technology at all.
  • chrisjj 5mo ago
    > I just take my business elsewhere... Mars? /i
  • prism56 5mo ago
    Oh man I feel you. I turn my VPN off on certain sites due to the captcha loop.
  • Milpotel 5mo ago
    Wouldn't a 1£ Linux VM as Wireguard access point suffice?
    • ranger_danger 5mo ago
      Nope, I have tried. Just as suspicious to them if not moreso because it's a datacenter IP and not residential. I even have a list of sites I've tried to visit that were explicitly blocked from datacenter IPs, and that file has over a hundred hosts in it now.
  • ck2 5mo ago
    whenever I can't access a website for various stupid blocks I fire up cloudflare warp and walk right through it use wireguard with wgcf in environments without cloudflare client yeah it's stupid we have to do this in 2026 but I guess cloudflare is the new AOL garden
    • wafflemaker 5mo ago
      You sir seem to have solved a problem many people here have. Would you care to elaborate a little on how you did it? It doesn't happen that often to me, but sometimes adblock setup I'm using results in such issues.
      • tardedmeme 5mo ago
        He just told you, he used cloudflare WARP. It's a "VPN" along the lines of NordVPN et al, but by cloudflare, so it gets special treatment by cloudflare's walled garden enforcement system.
        • krackers 5mo ago
          I wonder if iCloud private relay might also work. Apple probably negotiated some special treatment
          • donmcronald 5mo ago
            I’m guessing it’s all the same effect as CGNAT exit IPs. You need to get big enough to be unblockable. That’s why everyone is trying to get in on the VPN game. This new reCAPTCHA setup is probably a good indicator that big tech wants to shift to verified access only. Personally, I’m just going to quit spending money via the internet and go back to piracy + retail stores with a physical location.
    • titularcomment 5mo ago
      the fact that this works, as well as cloudflare having a literal web scraping tool available as another product honestly makes my blood boil.
  • Jigsy 5mo ago
    > Sites that use reCAPTCHA/Turnstile/etc. have already been broken for me for years now due to neverending captcha/refresh loops. I had this problem recently with the Indeed website. (Cloudflare Captcha) Thanks to someone on Reddit, it was discovered that anyone using a Chromium based browser (Brave, Vivaldi, etc.) on Linux was being punished. Awfully frustrating having to set up a Virtual Machine just to be able to access one website via Firefox since even my hardened Firefox was being punished.
    • anonymousiam 5mo ago
      Why not just change your user agent string?
      • tardedmeme 5mo ago
        It probably fingerprints the browser via TLS fingerprinting.
      • mschuster91 5mo ago
        That's useless, in fact it makes you stand out even more. There are SDKs that can differentiate based on an awful lot of signals if your user agent corresponds to your actual browser version.
      • codedokode 5mo ago
        Because the site can compare the user agent with navigator.platform, which your browser fills with great care.
        • userbinator 5mo ago
          That naturally implies we must patch the browser. "Source code? We don't need no stinkin' source code!"
          • codedokode 5mo ago
            That's what Russian underground hackers do to create so called "anti-detect" browsers, which can emulate different browser fingerprints. But they are commercial and closed-source.
  • hysan 5mo ago
    Turnstile feels bad as a user. Every site that I’ve seen it long will lock up Safari hard while it’s doing whatever it’s doing. But at least I haven’t run into more than 2 refresh loops.
  • miladyincontrol 5mo ago
    Almost would bet one or a few of your ISP's customers have their connections being used as residential VPNs. I know people like to think of suspicious android box setups but even a lot of "free" apps, extensions and other such services scarily seem to do that duty these days. I'm sure I'm preaching to the choir here, but its sad how many people will use some free of cost vpn and not even think why that might be.
    • ranger_danger 5mo ago
      Yes, I have even seen mobile android games that include notices about a BrightData SDK or HolaVPN etc. where their idle bandwidth is resold.
      • donmcronald 5mo ago
        Does the app function as a proxy? I always assumed that wasn’t possible.
        • ranger_danger 5mo ago
          Why wouldn't it be possible? As long as background network access is allowed (the default).
    • chadgpt2 5mo ago
      Honest question: Is there anything scary about this apart from lowering your ISP's reputation score?
      • donmcronald 5mo ago
        Yes. What if your connection is used for illegal activity?
  • retired 5mo ago
    I have not been able to visit AliExpress for months now. Just an endless reCAPTCHA loop. I wonder if they are seeing a decrease in traffic and somehow find that acceptable.
  • rescbr 5mo ago
    This is why I ended up paying extra for a static IP from my ISP. While they always provided me with a public IP outside a CGNAT, I guess whole IP blocks were being targeted by these web security providers. I guess my ISP allocates static IPs from a separate pool, and probably my IP block neighbors are better behaved (probably SMBs and other fellow nerds), aside from platforms learning that my IP is safe. Captcha difficulties are way down now.
  • wraptile 5mo ago
    It's not only IP but entire browser stack is being fingerprinted: Javascript, http, tls - everything. I've been living in the SEA region on Linux firefox for the last 10 years and the web has been miserable due to cloudflare and recaptcha
    • ranger_danger 5mo ago
      Yep I often have to launch a clean/ephemeral chromium profile just to access a specific website, but even then it's sometimes not enough.
• coppsilgold 5mo ago
  My understanding is that this new reCAPTCHA is basically just remote attestation. Remote attestation doesn't use blind signatures (as that would be 'farmable') so tying the device to the 'attestee' is technically possible with collusion of Google servers: EK (static burned-in private key) -> AIK (ephemeral identity key in secure enclave signed by a Google server) -> attestation (signed by AIK). As you can see if the Google server logs EK -> AIK conversions an attestation can be trivially traced to your device's EK. This is also why we don't really see and probably never will see online services which offer fake remote attestations, as it will be pretty obvious that the next step of running such a service is getting Google as a customer and having all your devices blacklisted. Private farms probably won't last long either as I'm sure Google logs everything and will correlate. Unless something special is done with this new reCAPTCHA not only are you locking internet services behind TPM chips but you are also surrendering anonymity to Google. Unless you acquire untraceable burners for every service, the new reCAPTCHA will be technically capable to tying all your accounts across all these services together. Much like age verification. It may appear that the service would need to cooperate to link the reCAPTCHA session to your registration but the registration time alone will likely be sufficient (the anonymity set will be all but destroyed).
  • dheera 5mo ago
    > Google didn’t demand iPhone users install Google software to pass the test. Can de-Googled Android phones present themselves as iPhones?
    • thaumasiotes 5mo ago
      Can they present themselves as... web browsers?
      • tardedmeme 5mo ago
        Yes, and then they'll get served a QR code that you have to scan on a phone Google approves of.
        • 5mo ago
• theturtle 5mo ago
  [dead]
• superasn 5mo ago
  [dead]
• ChrisArchitect 5mo ago
  Related: Google Cloud fraud defense, the next evolution of reCAPTCHA https://news.ycombinator.com/item?id=48039362 https://news.ycombinator.com/item?id=48039362 Google Cloud Fraud Defence is just WEI repackaged https://news.ycombinator.com/item?id=48063199 https://news.ycombinator.com/item?id=48063199
• kittikitti 5mo ago
  Please stop calling Android Linux. It's a marketing lie that continues to disappoint, including here. You're holding Linux back substantially by claiming Android is part of it. Just because it has Unix doesn't mean it's Linux as MacOS is also Unix.
  • prophesi 5mo ago
    Unless it was in a previous iteration of the submission's title, I don't see Linux mentioned anywhere.
  • PaulHoule 5mo ago
    The kernel is a Linux kernel. The userspace is very different from a typical Linux distribution.
    • g-b-r 5mo ago
      A fork of it, updated periodically And let's not pretend that we mean the kernel when we say Linux distribution
      • charcircuit 5mo ago
        Debian also uses a fork that is updated periodically.
  • IsTom 5mo ago
    It's the punishment for all the times people laughed at calling regular Linux "GNU/Linux".
  • yjftsjthsd-h 5mo ago
    Android literally is a Linux distro, though. Like, sure it has a weird userspace and is user hostile, but that doesn't make it not a Linux distro.
    • Ylpertnodi 5mo ago
• tamimio 5mo ago
  And soon desktop OSes will follow, if you don’t have TPM you won’t be able to browse half of the internet.
  • deleted 5mo ago
    [deleted]
  • Andrex 5mo ago
    A parallel, fully public and accessible internet being widespread and available for anyone with a slight tinkering kick... Could actually be really awesome. Let the commerce-driven, corporatized hellhole that the modern web has become eat itself.
    • spencerflem 5mo ago
      I love the vision, but I do wonder how the parallel internet will deal with DDoS levels of bot traffic. I hear ‘web of trust’ pretty often and I like the idea but that’s not anonymous or accessible either
      • SV_BubbleTime 5mo ago
        Well, how does Tor or other services do it now?
        • spencerflem 5mo ago
          They get blocked by Recaptcha, I think. I’m not talking about the network itself but the servers on the other end. I guess my point is that while Google is definitely malicious, I don’t think every site using recaptcha is and if we expect them not to use that tool there should probably be an alternative.
          • 986aignan 5mo ago
            > They get blocked by Recaptcha, I think. I think SV was asking what onion services, which can't really use recaptcha, do to prevent the DDoS storm. And I would imagine the answer is obscurity, since the dark web isn't nearly as well-mapped as the public web. That and some Anubis or other PoW would probably go far.
• spankibalt 5mo ago
  Time for some lawfare!
  • DANmode 5mo ago
    The Government reviewed the Google situation on behalf of you, and on behalf of the Government, and said “data, so piss off”: https://abcnews.com/Technology/google-hit-antitrust-lawsuit-38-state-attorneys-general/story https://abcnews.com/Technology/google-hit-antitrust-lawsuit-... https://macdailynews.com/2026/02/04/u-s-files-appeal-in-google-search-antitrust-case https://macdailynews.com/2026/02/04/u-s-files-appeal-in-goog...
    • userbinator 5mo ago
      If the masses can somehow point the absolute loose-cannon that is the current President at Google, things might actually change.
      • DANmode 5mo ago
        In August 2019, Trump tweeted that Google had “manipulated” millions of votes toward Clinton in 2016 and said the company “should be sued.” Turns out that Presidents, once elected, largely do what Continuity of Government, and business interests, ask for.
        • userbinator 5mo ago
          Trump has been the least normal of them, and the increasing distrust and suspicion towards Big Tech is largely bipartisan at this point.
          • DANmode 5mo ago
            > Trump has been the least normal of them In some ways, yes. In other, major ways: a spade is a spade.
          • DANmode 5mo ago
• cornholio 5mo ago
  It's a move to block competitor AI agents while securing access for your own, classic ladder kick. The market for autonomous agents providing services and doing online work will be gigantic so, unless you want your own bots locked out from ie properties guarded by Amazon, CloudFlare, Microsoft etc., you will need a bargaining chip.
  • hedora 5mo ago
    As someone that uses AI agents, this makes me want to install a browser plugin for "public windows" that just archives everything I see, and then farms out clicks of content that are missing from those sites. The result of this would be to upload it all to a bot-friendly alternative to archive.org.
    • CaptainFever 5mo ago
      That exists! Check out Hoardy Web. https://oxij.org/software/hoardy-web/ https://oxij.org/software/hoardy-web/ Its whole point is undetectable archiving because it just saves what your browser already sees.
      • sunshine-o 5mo ago
        Nice, I understand it is similar to ArchiveBox + its web extension. Now to be honest, while it's optimal to archive pages from you browser view I am not sure I want a random web extension to be in everything I see from a security point of view. I would rather have a local proxy doing it. Maybe something like the InternetArchive warcproc [0]. Haven't tried yet. - [0] https://github.com/internetarchive/warcprox https://github.com/internetarchive/warcprox
        • hexagonwin 5mo ago
          for a short time i had warcprox sitting behind my firefox and auto feeding its output to pywb, it seemed to work but i had connections failing randomly after having warcprox running for more than a few hours~days. not sure if it's an issue with pywb or warcprox but there were some urls missing that i did browse on firefox, and many dynamic pages couldn't be replayed at all.
• citizenpaul 5mo ago
  For Decades the huge tech companies basically faced no adversity whatsoever. Now for the first time in their existence the massive returned investments in AI they are experiencing ... we will call it pain. I would say it will be interesting to see what they do but I think rent-seeking, oppression, human rights violations would be more apt. They were of course trustworthy proviers while they were untouchable but now I know how things are gonna go.
• ezekiel68 5mo ago
  I don't know why reclaimthenet hasn't embraced the obvious answer: Simply create a new smart device operating system with a fully disentangled cosmos of programs, libraries, APIs, app SDKs, hardware partners, drivers, trust networks, carrier agreements, app stores, documentation, conferences...
  • colordrops 5mo ago
    Ugh I hate that I can't tell whether you are being sarcastic or not.
  • fsflover 5mo ago
    Mobian, PureOS, postmarketOS already exist. Sent from my Librem 5.
  • cybercatgurrl 5mo ago
    and that is gonna be funded by who? anyone who is gonna fund that is gonna want their slice of the pie. we need regulation to keep big tech in line
    • repelsteeltje 5mo ago
      How about consumers paying a little extra for their device? The way it's going, add sponsored big tech is dieing because click fraud detection is becoming too expensive. Either we give up privacy and track every user, or we let bots have at it, stop targeting ads to users and bill advertisers on bandwidth.
      • undeveloper 5mo ago
        if you think consumers will pay more for the vague notion of privacy i have beachfront property in kansas to sell you. most normies either don't care ("I have nothing to hide ... do you?") or gave up already ("china / the government / big tech / all of the above already have all my data, why would I care if it's a bit more? what are they even going to do with it?" (sometimes, even "i like having relavent ads!")). at my most pessimistic i can see a world where consumers pay MORE for attestation to continue to opt-in to society, or perhaps a ai-bot-free digital world.
• thecatapps 5mo ago
  I'm failing to see why they didn't just adopt Private Access Tokens (not that they're great either), where they could have at least: - pretended that it wasn't all about invading peoples' privacy. - done a good ol' fashioned "but Apple does it" - pretended to be standards-oriented - advertised it as something completely transparent to the end-user Seems like that would've caused a lot less backlash while still achieving the goal of having some form of device attestation -- but I'm guessing that's not the real goal.
  • FateOfNations 5mo ago
    Not Invented Here Syndrome?
  • treis 5mo ago
    It doesn't fundamentally solve anything. You want to be able to identify a specific person or at least a relatively expensive device so that if you ban them they stay banned.
    • altairprime 5mo ago
      This is the exact method used to secure iMessage against spam: secure attestation and ‘console’ bans of devices (reversible by iirc phoning support, indicating who you purchased the used device from, and providing an ID). But Google is trying to pull a Windows 11 “TPM or die” conversion on the public Internet via Recaptcha. Welcome to the attestation wars, unwitting websites :)
    • rockskon 5mo ago
      As others in this thread have commented - there are scammer hubs where a single person controls hundreds if not thousands of phones at a time. The people who this method is most hoping to stop are the least likely to be impacted by it in the long run.
  • incompatible 5mo ago
    "pretended" ... do they even care any more?
  • 5mo ago
• Worf 5mo ago
  I don't use Android right now and haven't used Google'd Android for almost a decade. And I won't. If this is the hill I die on, so be it. I'm not going to use any sort of hardware attestation, especially one controlled by Google. You shouldn't either, even if you have an unrooted Google-certified Android phone.
  • brikym 5mo ago
    It's all fun until you can't get paid because some fintech app doesn't work. That's why we need regulations. I don't see politicians ever going against an advertising company when they're customers.
    • freedomben 5mo ago
      Indeed, I generally favor being conservative with regulations because they can genuinely impede progress and can be really hard to change or remove when they're bad, but this is an issue that we need regulation for. It's just too much in the interest of big tech to lock us down and strip us of our freedom of compute. Short of regulation. Unfortunately I see the regulatory environment more likely to go the other way of requiring attestation. I sure hope I'm wrong.
      • pino83 5mo ago
        One unfortunate aspect of the entire problem: Go back, let's say 10, 15 or 20 years, when forces were a bit more balanced than today. When all these issues were already quite obvious, but probably somewhat easier to solve. The same people that cry loudly today were completely ignoring all these issues. Actively. And when someone came up with them, that guy was just an idi*t, disturbing the good mood. Right? I can still remember all the conversations that I had, or that I read. Today, they'll deny that and still call me an idiot. Anyways... PS: Sure, there always were a handful of exceptions. If you are one of them, you know what I'm talking about. I don't refer to you. But to the other 99.x%.
        • dwedge 5mo ago
• oybng 5mo ago
  [flagged]
  • dang 5mo ago
    The article was at #1 on the frontpage when you posted this.
• einpoklum 5mo ago
  Google seems to be putting yet another brick in the garden wall.
• cantalopes 5mo ago
  This is crossing the line where the governments should step in and ban/fine google heavilly for this monopol behavior
  • OutOfHere 5mo ago
    Instead, our governments use this crap, meaning on .gov sites too, and impose it upon us.
  • milderworkacc 5mo ago
    I agree. There are pretty clear grounds here to think about opening an investigation here into illegal tying, or a misuse of market power. Not sure if the FTC maintains a presence on here, but if you're listening...
    • KPGv2 5mo ago
      [flagged]
  • failuser 5mo ago
    The governments are the ones who needs the most. They want to know who all the potential and current dissidents are.
    • bigyabai 5mo ago
      Bingo. Remember all the people on HN who canvassed for consumers to vote with their dollar? Absent-minded consumption is what consumers voted for. Now everyone pretends like it's monopoly abuse because the Leopards Eating Faces company finally rang the dinner bell.
  • data-ottawa 5mo ago
    How you know this is a monopoly is that if you go on their documentation website half the video is how this rolls into Google Analytics. This is using another product to reinforce the search and ads monopoly. You can’t scrape content to build a better google or Gemini, you can’t make an OS to compete with Google or Apple, and you can’t make a Google Analytics competitor. It’s plain anti competitive.
• kyrofa 5mo ago
  I don't even have a smart phone, I assume there is some sort of fallback behavior?
  • mzajc 5mo ago
    The fallback is that you get redirected to a website helpfully demanding you buy a Google- or Apple-vetted smartphone: https://support.google.com/recaptcha/answer/16609652 https://support.google.com/recaptcha/answer/16609652. You will also see this page if your smartphone is degoogled and you try to open the reCAPTCHA attestation URL in a web browser instead of in Google Play Services.
• yohannesk 5mo ago
  Isn't reCAPTCHA a spam? This video I watched recently does a nice history and also was enjoyable to watch https://youtu.be/seX_rDEsP6E?si https://youtu.be/seX_rDEsP6E?si
• OutOfHere 5mo ago
  If there was any remaining doubt whether Google is evil, this settles that yes it is.
• pixel_popping 5mo ago
  archive.is just asked me for a QRcode scan, I'm so ashame of that crap (it's behind Cloudflare), forcing website visitors to KYC? Are you guys insane!? the web is ruined if you push for this, this is millions of websites that will suddenly force KYC? What...the...f https://ibb.co/X9Q6Y84 https://ibb.co/X9Q6Y84 By KYC, obviously it's because there is very few non-criminal ways to have a SIM without KYC and get a Google account for Playstore without a number, so every website visits will be attached to a real ID. I don't use a stock Android, right now I literally can't access many websites, this is genuinely crazy.
  • codedokode 5mo ago
    Interesting, the text says "reCAPTCHA doesn't share your details with this site", but it says nothing about sharing your details with Google. Which means yes?
    • duskdozer 5mo ago
      Naturally, "Your data is private[ly] and secure[ly stored in plain text on our servers so that it's only accessed by us and shared with the advertising partners we choose]."
  • Imustaskforhelp 5mo ago
    > https://ibb.co/X9Q6Y84 https://ibb.co/X9Q6Y84 Wow, This is really bad :-( I think this is just gonna make viewing internet without a phone significantly harder especially with archive.is and the likes. Not sure, how relevant this is to the discussion but if it helps, I have made a project[0] which allows to archive archive.is pages on archive.org/wayback machine (this uses singlefile) Perhaps something like this can be used by community at scale too. Also, I hope that archive.is does something to fix this issue of requiring QR code and hopefully it doesn't become a permanent issue. [0]: https://smileplease.mataroa.blog/blog/htmlpipe-and-how-we-can-use-it-for-archive/ https://smileplease.mataroa.blog/blog/htmlpipe-and-how-we-ca...
  • tom1337 5mo ago
    i wondered the same earlier and i am pretty sure they are just mimicking cloudflare's validation page. no way that cloudflare is paying reCAPTCHA when they have theor product, turnstile, available.
• cyberax 5mo ago
  I think it's possible to run the Play Services in an emulator, faking the device type. Google doesn't seem to use the platform attestation for now.
  • SV_BubbleTime 5mo ago
    Treatment is not a cure.
    • cyberax 5mo ago
      Agreed. I'm just pointing out the possibility (for now).
  • qiine 5mo ago
    Really that seem almost too easy ?
    • cyberax 5mo ago
      For now. They'll likely start requiring device attestation in future, and the emulator can't pass it.
• buzzwords 5mo ago
  Given the way Google is going I'm not sure if my next phone will be Android. I am fully aware that I am probably in the minority here. For me the trust is entirely gone.
  • fluidcruft 5mo ago
    There really isn't much of an option. Apple's just as bad if not worse.
    • chadgpt2 5mo ago
      Both are terrible for privacy so it comes down to which one has a nicer screen now. :( I'd rather have Google check an Apple phone attestation than have Google check a Google phone attestation, and vice versa, though, because you can assume each company is trying to keep as much information private to themselves instead of giving it to the other. Google is probably just getting "yes it's an Apple phone" and some kind of temporary token, instead of my IMEI, IMSI, phone number, all signed in accounts, biometrics and so on.
    • queenkjuul 5mo ago
      At least with an Android i have the option of Graphene, and have access to a terminal, and for now can sideload apps. With apple there's no choices, so I'll continue to take my chances with Android
      • fluidcruft 5mo ago
        Possibly... but the extension of this to Android and Apple is going to be the entire internet shuts you out. And everything else will be a giant Dead Internet crawling with bots.
        • tardedmeme 5mo ago
          The sites that require you to log in are precisely the same ones that are crawling with bots. The personal internet or "small web" is, and still will be, full of real content. There are also lots of bot websites that are trying to be small web, but since it's an actual social network and not a giant pool everyone pours stuff into, they don't get traction. If you do find a website that seems to be human but links to a thousand AIslop sites, you'll stop following that guy's links.
• lxgr 5mo ago
  Almost completely unrelated, but I recently helped out a very confused family member with deleting not one, but two Google Cloud accounts they had no idea existed, and that they only learned about from an email referencing reCAPTCHA getting integrated into some other Google product offering. I have absolutely no idea what happened there. My best theory so far is that they clicked on some really, really wrong buttons when solving a captcha themselves while logged in to their Google account in the same browser. Bizarre.
  • brunocvcunha 5mo ago
    AI Studio playground maybe? It seems all integrated.
    • lxgr 5mo ago
      They almost certainly didn't use that. The projects were named after a Google Doc they'd recently worked on (or a .docx attachment they'd received?) though, so my other guess is that they somehow created a Google Docs macro or similar by accident?
      • arccy 5mo ago
        probably Google Doc Apps Script, those create so many Google cloud projects
• amluto 5mo ago
  I would love to see someone challenge this as an anti-trust violation. Google is using its market power (as the provider of reCAPTCHA) to actively prevent devices that don’t use Google Play Services from competing effectively.
  • cromka 5mo ago
    They're only doing that because the EU currently doesn't want to antagonize US any more with their tech fines. Noticed how there hasn't been any as of recently?
    • probably_wrong 5mo ago
      Alternative explanation: they're following the Meta playbook of releasing surveillance features during a "dynamic political environment" that's keeping their opponents distracted. https://www.nytimes.com/2026/02/13/technology/meta-facial-recognition-smart-glasses.html https://www.nytimes.com/2026/02/13/technology/meta-facial-re...
    • gib444 5mo ago
      https://www.cnbc.com/2026/04/10/google-meta-big-tech-6-billion-euros-eu-fine.html https://www.cnbc.com/2026/04/10/google-meta-big-tech-6-billi... : > April 2025: Apple fined €500 million for failing to comply with "anti-steering" obligations. Meta fined €200 million under the Digital Market Act for requiring users to consent to sharing their data with the company or pay for an ad-free service. > December 2025: X fined €120 million under the Digital Services Act for breaching transparency obligations. (Sure, not this year, but that's pretty recent by most standards. And not sure if they're still being contested and unpaid) And recently, Google is working with the EU to avoid a fine: https://www.bloomberg.com/news/articles/2026-05-06/google-makes-eu-offer-to-avert-fines-in-news-search-case https://www.bloomberg.com/news/articles/2026-05-06/google-ma...
    • palata 5mo ago
      > because the EU currently doesn't want to antagonize US any more with their tech fines Yeah, I say it as "because the US bully the EU to prevent them from doing it".
• dwedge 5mo ago
  I've kept a spare cheap android for too long and recently went with Graphene instead. I have one Google profile and only use it for Uber, work's Google Chat and maps. One bank refused to work (even with Google services) so I moved bank. I've moved most of my mobile use to self hosted (freshrss full text, password manager, calendar, tasks) with no direct internet connection. It's a bit irritating but I'm glad I started down this journey because it looks more and more like I'm going to be avoiding the internet
  • gonzalohm 5mo ago
    What's the best alternative for Google drive? I also went this route but Samba is a bit annoying sometimes
    • dwedge 5mo ago
      I only share with one person so we use Seafile
    • danparsonson 5mo ago
      Syncthing is very nice.
      • cromka 5mo ago
        I have nothing but issues with it, mostly because the iOS/Android apps are notoriously bad at syncing the files timely and also because of ridiculous filename restrictions on Android.
      • gonzalohm 5mo ago
        Is not the same though. It requires downloading the entire shared folder. That doesn't work when I have 100+GB of files and I want to share it with my phone
        • duskdozer 5mo ago
          https://docs.syncthing.net/users/ignoring.html https://docs.syncthing.net/users/ignoring.html
• codedokode 5mo ago
  To be fair, there are already apps that require a mobile phone to sign up, for example, VK, Telegram. And I think Google requires to scan a QR code to register account, so it is easier just to buy a Google account on a black market if you need it for some purpose. Nobody trusts web browsers nowadays.
  • danparsonson 5mo ago
    I think you and I move in very different social circles... I would have no idea how, nor desire to purchase a Google account on the black market, and I do in fact still trust that my web browser can do TLS correctly.
    • tardedmeme 5mo ago
      I think you can just search 'buy google account' - it isn't illegal.
      • danparsonson 5mo ago
        Sure but how do I know that the person I'm buying from legitimately owns the account? Won't scam me? Or try to con me out of my existing account? I'm just saying not everyone is as relaxed about that sort of thing.
        • pixel_popping 5mo ago
          Markets are regulated by reviews, seller history and so-on, the same as legal markets and it's generally smooth.
        • codedokode 5mo ago
          The price is about $2-3 so you are not risking much, there are reviews and ratings. Of course there are scam sites, but once you buy several accounts you quickly figure out which ones are scam and which are not. Re: stolen accounts, you can examine account details, history and activity after purchase, check for emails from social networks and return stolen account to the owner. The posting usually also mentions registration period (new accounts are unlikely to be stolen). But it seems that registering new accounts is cheaper than stealing - old accounts are much more expensive. I didn't use the account for any illegal activity, there are just sites that use Google Account as a "verification" that you are not a bot, and to issue bans. And I am not interested in jumping through the hoops of searching a locked smartphone with Google Services and filing a visa application to register the account. I strongly dislike proprietary software and locked smartphones.
• dstnn 5mo ago
  Its going to be just like the wild days of the late 90s and 2000s Strap in, the ownage will be hard.
• picsao 5mo ago
  [dead]
• pzmarzly 5mo ago
  Does anyone know what changed in iOS 16.5 that made Google stop requiring the app? To me it seems to correlate with Private Access Tokens, aka remote attestation by Apple. https://developer.apple.com/videos/play/wwdc2022/10077/ https://developer.apple.com/videos/play/wwdc2022/10077/
  • rippeltippel 5mo ago
    Possibly. And possibly the fact that breaking experience for iOS users would result in a massive backlash, while the volume of non-iOS/non-Android users is negligible in comparison. Some of them will convert to mainstream OSes, the rest will succumb.
• djfergus 5mo ago
  What happens with Chinese Huawei phones that don’t have Google services?
  • omnifischer 5mo ago
    People can install Google Services in them. Once you sign into google account then you self-certify the device. https://www.google.com/android/uncertified/?pli=1 https://www.google.com/android/uncertified/?pli=1
    • overflowcat 5mo ago
      [dead]
• tinycommit 5mo ago
  Eww. Ok, so, I’ve used reCAPTCHA on sites I maintain at work, just on forms to prevent excessive bot spam submissions. No way do I want to subject users to this BS, though. Does anyone have recommendations for other decent captchas that could be used instead?
  • ksymph 5mo ago
    I run into https://www.hcaptcha.com/ https://www.hcaptcha.com/ and https://friendlycaptcha.com/ https://friendlycaptcha.com/ from time to time as a user without complaint. Can't speak to the latter but I've used the former a bit and it does the job.
    • BloodyIron 5mo ago
      Any chance for something 100% self-hostable? hcaptcha and friendlycaptcha last I checked require interfacing with their services.
    • Velocifyer 5mo ago
      hCaptcha is horrible. I think that a PoW captcha would be effective to make spammers just mine Monero instead.
  • tardedmeme 5mo ago
    hcaptcha is pretty popular these days. It uses a very wide variety of traditional visual puzzles.
    • himata4113 5mo ago
      in my good ol' days I just sent a screenshot to 2captcha for grid of the entire captcha iframe which means that the solvers would have to figure out what to do instead of having to write code for each different type of captcha. to solve their new rotating puzzles I would just capture them at 50% opacity twice and change the prompt to pick the highest brightness object since 50% opacity would dim the moving elements.
    • 5mo ago
• hedora 5mo ago
  Is there a way to just ban all these sites? Like a firefox plugin or whatever that detects this crap, and just bounces over to some place more reputable, like archive.is.
  • Permit 5mo ago
    It looks like archive.is uses recaptcha so I don’t think that’s the fix you’re looking for.
    • tardedmeme 5mo ago
      then we make a new one
• varenc 5mo ago
  I have a good friend who doesn't own a cell phone. He's a math professor. Every year he keeps living life without a smartphone, I continue to be more impressed. Things like this makes me feel like he might have to eventually give in. https://archive.is https://archive.is is now serving, via Cloudflare, this QR code backed CAPTCHAs. There seems no way to get past them without a smartphone. Sad times. I wonder at what point even basic government services will essentially require a smartphone.
  • gruez 5mo ago
    > https://archive.is https://archive.is is now serving, via Cloudflare It looks like a cloudflare page but it's not hosted by them. eg. https://bgp.he.net/dns/archive.is#_ipinfo https://bgp.he.net/dns/archive.is#_ipinfo It's hosted by AS49505 JSC Selectel
    • j027 5mo ago
      To add onto this, cloudflare switched away from recaptcha a while ago. https://blog.cloudflare.com/moving-from-recaptcha-to-hcaptcha/ https://blog.cloudflare.com/moving-from-recaptcha-to-hcaptch... I think they now use their own Cloudflare turnstile if I remember correctly, but back then they switched to hcaptcha.
  • phyzome 5mo ago
    I don't have one either. No plans to get one, even with this.
    • SJMG 5mo ago
      No cell phone period or no smart phone? I'm not sure how people manage the former. Do you have a home with a land line? What do you do when you travel?
      • phyzome 5mo ago
        Ah, I have a cell phone, not a smartphone. (Didn't notice that the parent comment referred to both.)
• neilv 5mo ago
  After all the surveillance capitalism abuses over the last 2-3 decades of Web, it's a little late to be pushing back, but... should we start shunning individuals from companies who implement this? Whether it's from companies that create the tech, or companies that use it. In the orgy of money, we've had a kind of industry-wide sociopathic convention of individual engineers considering it perfectly OK to further surveillance capitalism. Can we reverse that? If someone says we can't, because "everyone does it", are they saying that we're a field of baddies?
  • gregoryl 5mo ago
    I agree, wholeheartedly - lets get a list of the google engineers who worked on this. What do you propose we do with it?
    • userbinator 5mo ago
      Spread the word. They need to be held accountable the same way elected officials are --- except in this case they're not even elected.
    • neilv 5mo ago
      I had more the thought like being skeptical of anyone who would take a job at company Foo or stay there, when they tell you. To me that seems preferable to trying to -- what risks devolving into -- a witch hunt of fall guys (persons), and doxxing people. I think we are already starting to have that with a couple more infamous other companies in the news the last year: if someone goes to work there, I suspect a lot of people are going to think what is wrong with you, since you must know that company does very harmful things, Maybe it's time to start wondering that about anyone who'd work for a lot of additional companies? (I actually had a recruiter recently who was pitching a startup, and the headline featured the "ex-" pedigrees of the founders, including an especially infamous company. I figured any company touting that pedigree as a selling point is probably a bad fit for me. I thanked the recruiter, but said that infamous company as selling point probably isn't a fit. The recruiter seemed to not only understand, but to agree with my vague sentiment about that pedigree company.)
  • 5mo ago
• himata4113 5mo ago
  I did something unpopular and just didn't have a captcha, I just read up on creepjs etc and rolled out my own which is just browser state analysis, basic ip check (abuse lists only) and PoW. Haven't had an issue with a single bot registration (yet).
  • grishka 5mo ago
    A simple captcha with distorted characters + some hidden form fields would stop every single "opportunistic" bot. There's hardly anything you can do to stop someone determined enough to spend money to spam your specific website. These kinds of captchas do raise the bar somewhat, but every single one of them is ultimately bypassed by paying people to solve them for you.
    • himata4113 5mo ago
      I rotate structures every request I made it explicitely hard to automate and I just raise the PoW during attacks. It's always about reducing volume rather than preventing it and a million registrations later it's still holding strong. bots get pruned after an hour since 100% of the bots fall into the same trap, giving it a delay makes A/B testing really difficult and breaks most AI strategies.
  • alok-g 5mo ago
    Cool! I would like to hear more about this, and understand how to do the same.
    • himata4113 5mo ago
      https://abrahamjuliot.github.io/creepjs/ https://abrahamjuliot.github.io/creepjs/ took this and made it PoW
  • deleted 5mo ago
    [deleted]
• smallerize 5mo ago
  This isn't just about weirdos (like me) who run GrapheneOS. Huawei phones don't have Google Play services installed, or Xiaomi phones with MIUI China. That's what, a billion and a half phones that can't get to your website now? Amazon tablets don't have Google services either, which hints that the upcoming Amazon phones also might not work with this.
  • gene91 5mo ago
    If you need access to both apps from China and websites/apps from outside China, non-Apple devices have been difficult before this, primarily due to push notification infrastructure. This makes it more difficult. But I don’t think it matters given how difficult it was prior to this.
    • ickyforce 5mo ago
      What's wrong with Apple push notifications in China?
      • poilcn 5mo ago
        "non-Apple", i.e. Android The problem is that most popular apps for Android outside Chinese app stores rely on Google services (specifically, Firebase) for push notifications.
    • oefrha 5mo ago
      Using apps based on Google Play Services may be impossible on those phones out of the box (not sure), but websites have no such dependency and most people don’t give a crap about push notifications from PWAs anyway so whether FCM works with the device matters little. Also doesn’t the web push API support different push services at registration time so those devices’ browsers can register their own vendor push server? (It’s been a while since I implemented web push myself, memory is fuzzy.) This is blocking access to websites wholesale, so it’s on a whole different level.
• drnick1 5mo ago
  So Stallman was right, after all?
  • xethos 5mo ago
    One thing I hope we've all discovered by now is that, if Stallman hasn't been proven right at the present moment, on any topic that touches on libre computing, is that it's only a matter of time until he is
  • quantummagic 5mo ago
    Everyone, including Linus Torvalds, who rejected Stallman as too political or ideological, and advocated for "pragmatism" instead, is part of the reason we're where we are today. And it's going to get a lot worse, before it ever gets better.
    • drewfax 5mo ago
      I wish Linus had adopted GPL v3. He had the power to stop this madness from big tech, but he sided with them. It just reveals that he never fully understood the reason for the existence of GPL in the first place.
      • rvz 5mo ago
        > He had the power to stop this madness from big tech, but he sided with them. He (Torvalds) had no power to do anything and sold out. Even if he did, big tech would just go and use BSD. For over a decade both Torvalds, and Stallman sold everyone out. They don't make their money directly from "free software" or "open source" in the first place. Stallman was right in that he knew digital surveillance was going to happen, but he was incorrect in believing that FLOSS was ever sustainable economically and especially with AI replacing the developer and that big tech and startups are weaponising that against them. Even when Stallman is against AI, he doesn't care. He knows he doesn't make money from "free software"; but only by speaking about it. Torvalds is the same but likes AI. Can any other developer do exactly that in 2026?
• BloodyIron 5mo ago
  I'm sorry Google, I'm afraid I can't do that.
• userbinator 5mo ago
  We told you. You dismissed it, and thought we were just crazy conspiracy theorists. Too brainwashed by the mainstream propaganda about "threats" to see the truth. Now they're even more emboldened by how much they can herd the sheeple, and showing their actual goals even more clearly. Spread the news, tell everyone you know, before it's too late. I wish we won't have to resort to even more drastic methods in this fight. "Those who give up freedom for security deserve neither."
  • userbinator 5mo ago
    The rebellion will not spread online, in the space controlled by these bastards; but offline, outside of their control. I'm telling everyone I know, and you should too. Here's the obligatory: Google, FUCK YOU!
• zuogl 5mo ago
  [flagged]
• wurtapp 5mo ago
  [flagged]
• Vampyre 5mo ago
  [flagged]
  • tomhow 5mo ago
    We've banned this account. This is an utterly appalling comment.
    • Vampyre 5mo ago
      [dead]
• koala-news 5mo ago
  The internet increasingly feels like “prove you’re using the approved computer” instead of “prove you’re human”.
  • balamatom 5mo ago
    Those two add up to "prove that you allow computer vendors to teach you what 'human' means".
• zuogl 5mo ago
  [dead]
• orblivion 5mo ago
  I imagine GrapheneOS is thinking carefully about their statement on this. I look forward to reading it.
  • riffraff 5mo ago
    I mean, they could sue for non competitive behavior, but good luck beating Google's lawyers
    • palata 5mo ago
      GrapheneOS users (and actually just citizen who care) in the EU should complain to the DMA team [1]. As with everything: the more people complain, the higher priority it gets. [1]: https://digital-markets-act.ec.europa.eu/contact-dma-team_en https://digital-markets-act.ec.europa.eu/contact-dma-team_en
      • microtonal 5mo ago
        I recommend every EU citizen to do this. Don't send a pre-canned message or an LLM-generated message. Write your own story and how Google (and Apple) are destroying competition and freedom for you as an EU citizen. Even if you are a GMS Android user, they are going to make installing apps outside the Play Store much more annoying and these attestation-backed verifications are going to further deanonymize you.
• gib444 5mo ago
  On becoming anti Google, I blocked Google's ASNs (shortcut to block all their IP addresses) on my router the other day as an experiment. It's a little eye-opening. Obviously you immediately realise just how often you !g in DDG, use Google Flights, YouTube etc. Ok easy enough to fix Then of course I can't use Play Store (Aurora didn't work either) so my phone would have eventually become quite obsolete You can't compile many Go projects because the dependencies are pulled from Google And if you had ALL of Google's ASNs that would include GCP and that's a whole other level of being cut off
• shevy-java 5mo ago
  This tyrannical and selfish, evil corporation, needs to be broken down. These are not accidents. Just remember how Google killed off ublock origin via a lie: https://ublockorigin.com/ https://ublockorigin.com/ See the explanation associated with Manifest V3.
• lpcvoid 5mo ago
  [dead]
• manmal 5mo ago
  It’s quite easy to remote control an Android phone with an agent (eg there‘s agent-device). I don’t think this will keep automation from happening.
• moebrowne 5mo ago
  OK, so what are the alternatives, what can developers use instead?
  • palata 5mo ago
    Developers implement what they are told to implement. People who make those decisions in companies just don't give a damn, they will happily use whatever is easier/cheaper. Usually something from TooBigTech, sponsored by surveillance capitalism.
  • doublerabbit 5mo ago
    Create your own. Captchas have long existed on the internet. Start your own Captcha As A Service. If you've not seen the dark net some of their QR checks are inquisitive. >? URL: .env.project :: IP: 213.209.159.175 >? 30326336336 :: viewer key >? URL: lab/.env :: IP: 213.209.159.175 >? 39363064647 :: viewer key >? URL: Dr0v :: IP: 185.12.59.118 >? 76543264647 :: viewer key >? URL: data/.env :: IP: 213.209.159.175 >? 63623731628 :: viewer key >? URL: docker/app/.env :: IP: 213.209.159.175 >? 62653061304 :: viewer key >? URL: fedex/.env :: IP: 213.209.159.175 >? 61663064656 :: viewer key [09/May/2026:11:31:32] notice: exiting: exceeded max connections per thread Above is verbose from my honeypot. Some security camera network has been hacked and is being used for net thrifting in Romania. The internet is a failure. Congratulations us.
  • pixel_popping 5mo ago
    It feels ultra sad that "developers" think they need to use reCaptcha? What is this lazyness, it's not even good on top of that at what it does, recaptcha cost less than $1/1000 to solve automatically, it's also slow, crappy, bad UI. Even competent people got completely brainwashed, crazy.
• holoduke 5mo ago
  One positive thing about tools like Claude is that I can finally do things where I had originally no time for. For example I asked Claude to debloat windows. Remove everything possible. From firewalls to notepad to uac to whatever. I also asked Claude to root my pixel phone and install another OS. I also asked to install pihole on a old Mac to serve as a dns and block all ads. All this took maybe an hour of my time.
• stuaxo 5mo ago
  Anti competitive behaviour ?
• palata 5mo ago
  > People running de-Googled phones chose those setups because they read the data practices, understood what Play Services phones home about, and decided they didn’t consent. This is wrong. Many (most?) users of alternative Android OSes do use a variant of the Play Services (be it sandboxed Play Services like on GrapheneOS, or an open source, reverse engineered implementation like microG that phones home just the same). Google seems to be leveraging Play Integrity here, which requires that the phone OS is signed by Google. This is clearly anticompetitive, I hope the DMA will do something about that.
  • mnadkvlb 5mo ago
    Exactly. Imagine them blocking captchas on iphone or windows
    • thayne 5mo ago
      IIUC, They are blocking it on windows, unless you have an android or iOS device you can use to complete the "captcha"
  • bjackman 5mo ago
    There is a fundamental tension here though - suppose DMA or something requires that online providers recognise reCAPTCHAs from non-Google-attested OS builds. What OSs can they safely trust? Only ones that are difficult for fraudsters to use to generate bogus traffic. Whether or not those builds come from Google, they are inherently gonna be pretty constrained OSs. It's not gonna let you spoof your location or simulate user input. I do think it's a problem if only Google can provide these attestations but even if that organisation problem is solved there is still a fundamental technologic problem here now that humans can't be detected by their ability to solve puzzles any more.
    • surajrmal 5mo ago
      Arguably anyone else who can provide a similar level of trustworthy authentication that they are not a bot can work with Google to get support. Fundamentally this is a trust based problem and only OS providers are even capable of building such systems. There are very few of those out there. The key is that the systems need to be locked down to prevent automation of input and that automatically disqualifies most android alternatives that the community likes. It's clear that Apple offers this capability though. I can imagine a more locked down version of Windows also providing this in the future.
• db48x 5mo ago
  I long ago stopped using any webpage that uses a captcha. If the website uses one, I bounce.
• sylware 5mo ago
  Wait, you need a TPM chip? I don't know what services a TPM chip does provide. Wild guess, some private keys, hidden to the computer user, are used to sign stuff and/or encrypt ?
• jwally 5mo ago
  [flagged]
• pavel_st 5mo ago
  this is going to keep happening across every trust layer google rolls out the trajectory has been clear since AMP-convenience for site owners, attestation pressure on users
• tosti 5mo ago
  Next phone I'm buying won't be able to run android if I can help it. Verify that. (edit: and it definately won't be an iphone, although that would fit the description above, those only run non-free software by design)
• uyzstvqs 5mo ago
  Luckily Google reCAPTCHA seems to be dying. Almost everything uses Cloudflare Turnstile, hCaptcha, or some form of a PoW challenge now. I'd go as far as to say that still having Google reCAPTCHA on your website is a sign of your website being unmaintained. Half of them even have the "reCAPTCHA is changing terms, take action" text on them. This move will cause the last users to stop using it, and reCAPTCHA will be on the "Killed by Google" list in a year or two.
• morissette 5mo ago
  Can’t like companies do what they want, or did we let the fascists take over?
• AdityaAnuragi 5mo ago
  Doesn't surprise me — I've hit undocumented Android Chrome behavior too while working with the Vibration API (more advanced usage by a very large margin). The browser/OS layer on Android has a lot of silent, unannounced behavior.
• anymouse123456 5mo ago
  I worked at Google. I know there are tons and tons of great and well meaning people working there. This is the kind of thing that would make me crazy. People there be like, “but I’m not evil! I’ll never do anything bad with all of this incredible power!” But if you create a nuclear bomb, someone unsavory is going to wrest control of that power from your stupid little painted fingernails and destroy the rest of us with it. How about, don’t make an effing privacy nuclear bomb if you don’t want to contribute to making the world more evil?
• comandillos 5mo ago
  that reinforces me using HarmonyOS - nothing against Graphene btw -. It's impressive how difficult is to actually use any platform apart from the stablished ones normally these days.
• jacktu 5mo ago
  [dead]
• aftbit 5mo ago
  Sigh... >Incompatible browser extension or network configuration
• jaimex2 5mo ago
  Delete Chrome and use Brave. Problem solved.
• redbell 5mo ago
  From the screenshot in the article "Troubleshoot reCAPTCHA Mobile Verification": > To complete the mobile verification, you must use a compatible mobile device. At first glance, reading this made me wonder: what is exactly a compatible mobile device? But they quickly answered this question just below: > If verifying on iOS/iPadOS... > If verifying on Android device with Google Play Services... OK then, got it! These are the ONLY compatible mobile devices. No de-googled devices are being welcomed here.