4 ms·

> People running de-Googled phones chose those setups because they read the data practices, understood what Play Services phones home about, and decided they di

by palata 6mo ago

> People running de-Googled phones chose those setups because they read the data practices, understood what Play Services phones home about, and decided they didn’t consent. This is wrong. Many (most?) users of alternative Android OSes do use a variant of the Play Services (be it sandboxed Play Services like on GrapheneOS, or an open source, reverse engineered implementation like microG that phones home just the same). Google seems to be leveraging Play Integrity here, which requires that the phone OS is signed by Google. This is clearly anticompetitive, I hope the DMA will do something about that.

mnadkvlb 6mo ago
Exactly. Imagine them blocking captchas on iphone or windows
- thayne 6mo ago
  IIUC, They are blocking it on windows, unless you have an android or iOS device you can use to complete the "captcha"
bjackman 6mo ago
There is a fundamental tension here though - suppose DMA or something requires that online providers recognise reCAPTCHAs from non-Google-attested OS builds. What OSs can they safely trust? Only ones that are difficult for fraudsters to use to generate bogus traffic. Whether or not those builds come from Google, they are inherently gonna be pretty constrained OSs. It's not gonna let you spoof your location or simulate user input. I do think it's a problem if only Google can provide these attestations but even if that organisation problem is solved there is still a fundamental technologic problem here now that humans can't be detected by their ability to solve puzzles any more.
- surajrmal 6mo ago
  Arguably anyone else who can provide a similar level of trustworthy authentication that they are not a bot can work with Google to get support. Fundamentally this is a trust based problem and only OS providers are even capable of building such systems. There are very few of those out there. The key is that the systems need to be locked down to prevent automation of input and that automatically disqualifies most android alternatives that the community likes. It's clear that Apple offers this capability though. I can imagine a more locked down version of Windows also providing this in the future.
  - bjackman 6mo ago
    Yes that is what i mean, anyone can do it technically, but they are gonna have to build a slightly crappy OS in order to do it. But still, better multiple slightly crappy OSs instead of just one (plus Apple).
- sneak 6mo ago
  Wanting to load a webpage anonymously is not something that makes one a “fraudster”.
- Zak 6mo ago
  > What OSs can they safely trust? None. The first rule of network security is you can't trust the client. All attempts at remote attestation of consumer devices are someone wanting to break this rule. It's always a mistake; the OS being on the blessed list raises the difficulty level for fraud a little, but serious fraudsters have already perfected workarounds.

by palata 6mo ago

mnadkvlb 6mo ago

Exactly. Imagine them blocking captchas on iphone or windows

thayne 6mo ago
IIUC, They are blocking it on windows, unless you have an android or iOS device you can use to complete the "captcha"

bjackman 6mo ago

There is a fundamental tension here though - suppose DMA or something requires that online providers recognise reCAPTCHAs from non-Google-attested OS builds. What OSs can they safely trust? Only ones that are difficult for fraudsters to use to generate bogus traffic. Whether or not those builds come from Google, they are inherently gonna be pretty constrained OSs. It's not gonna let you spoof your location or simulate user input. I do think it's a problem if only Google can provide these attestations but even if that organisation problem is solved there is still a fundamental technologic problem here now that humans can't be detected by their ability to solve puzzles any more.

surajrmal 6mo ago
Arguably anyone else who can provide a similar level of trustworthy authentication that they are not a bot can work with Google to get support. Fundamentally this is a trust based problem and only OS providers are even capable of building such systems. There are very few of those out there. The key is that the systems need to be locked down to prevent automation of input and that automatically disqualifies most android alternatives that the community likes. It's clear that Apple offers this capability though. I can imagine a more locked down version of Windows also providing this in the future.
- bjackman 6mo ago
  Yes that is what i mean, anyone can do it technically, but they are gonna have to build a slightly crappy OS in order to do it. But still, better multiple slightly crappy OSs instead of just one (plus Apple).
sneak 6mo ago
Wanting to load a webpage anonymously is not something that makes one a “fraudster”.
Zak 6mo ago
> What OSs can they safely trust? None. The first rule of network security is you can't trust the client. All attempts at remote attestation of consumer devices are someone wanting to break this rule. It's always a mistake; the OS being on the blessed list raises the difficulty level for fraud a little, but serious fraudsters have already perfected workarounds.