Get the top HN stories in your inbox every day.
jeroenhd
moritzwarhier
> saw this coming from miles away. Computers are better at solving CAPTCHAs than people are
good point... it's interesting how Captcha was initially popularized as a reverse Turing test, but it's just variants of Proof of Work today.
And it seemed clever at the time for Google to leverage this for improvement of their OCR models (it was!), and makes you wonder what utility is derived from the proven "work" today.
jonas21
CAPTCHAs were designed as a type of Turing Test, not a reverse Turing Test. It’s not surprising that the effectiveness of these weaker variants has collapsed, given that AI can now pass the real Turing Test.
Retric
LLM’s can still only pass limited Touring Tests. The longer the interaction the worse they do. Which of course means you can easily create an experiment they successfully pass, but just as easily you can create an experiment where they fail.
CAPTCHAs are nearly useless because of how little you need to pay humans to solve them.
InsideOutSanta
I'm not sure if LLMs are solving most of these captchas. There are services that employ humans to solve them for pennies per captcha.
moritzwarhier
Oh, right, "reverse" was wrong here. I thought of "computer classifies user as computer or human" versus the inverse, while the word is about who classifies, not who's being classified.
(?)
I guess so
dylan604
With the crosswalk, bike, motorcycle, stairs type of things, wasn't that just improving their training data?
moritzwarhier
Yes, for Waymo, AFAIK (I don't know for sure).
The OCR thing was earlier and used for Google Books, I think. Which is also is fitting for training data, or the motto "organize all knowledge".
At that time, this goal seemed really cool!
armchairhacker
> people can be bribed or convinced to join botnets so IP whitelisting doesn't work either
Do you think this won’t also be bypassed, by bribing people to scan QR codes and spoofing location etc.?
chadgpt2
The person who scanned to QR code is knowable. They have their IMEI encoded in the response.
armchairhacker
Allegedly can be spoofed.
But regardless, I imagine scammers will circumvent this to buy products, login to bank accounts, etc. of the exact users they’re targeting. The user will be presented with “Scan this QR code for $100” as the scammer is logging into their account with spoofed metadata.
dylan604
> people can be bribed or convinced to join botnets so IP whitelisting doesn't work either
what does that bribe look like, as in, how much can one get? what all does that entail? is that a little box i connect to my network and forget about? does that mean if i unplug it unless another payment is received that will work out? i'm asking for a friend that's looking to avoid selling plasma to make ends meet.
michaelt
https://www.fbi.gov/investigate/cyber/alerts/2026/evading-re...
> The following methods can be used to acquire residential IP addresses for a residential proxy network:
> Software development kit (SDK) partnerships: Proxy services convince mobile application developers to include their SDK in applications in exchange for payment for each person who downloads the application. Individuals download the application and accept the terms and conditions, allowing the SDKs to run in the background and route proxy traffic through users' devices.
> Virtual private network (VPNs) with hidden terms of service: Free VPN services may enroll users' devices in a residential proxy network, without obtaining their consent. The details are often hidden in the terms of service, which most users do not read prior to download, or the language is difficult for the user to understand.
> [malware and compromised IoT devices]
> Passive income schemes: Proxy services convince people to download applications on their device that promise to pay them for their internet bandwidth. People often do not realize that criminals use their internet connection to commit cyber attacks
One reddit post says bandwidth sharing passive income schemes paid them $1 to $9 per month.
miki123211
I used to know some Americans who were on the poorer end of the spectrum, and apps that paid you for performing fitness activity and such weren't uncommon in that demographic. Not as much of a thing in Europe for some reason.
I believe the cheap Chinese pirate TV boxes that are somewhat popular in the US these days are also in botnets, which is likely how the vendors make them so cheap.
ddtaylor
What are these Chinese pirate devices? This sounds fascinating.
tadfisher
Oh it's better than that now, if you can afford the up-front costs. You can set up a phone farm with cheap Google-certified devices, and the control software manages the Google accounts and botnet connection (through multiple residential proxies, of course). All of these attestation games are DOA.
dns_snek
I'm afraid it's far less enticing. The usual offer is "To continue playing, pay $0.99 or hit AGREE to share your internet connection with Legit Services Inc."
And that's assuming they're nice enough to ask at all.
dakolli
I personally think its easier to detect llm controlled browser sessions, the people deploying them are far more naive and inexperienced than traditional scrapers/crawlers.
insert You wouldn't bring a 40 Petabyte Zip Bomb to School, would you? meme
jeroenhd
Part of the problem is also that Google wants to permit crawlers to do some things but jot others.
Their announcement is full of buzzwords about "agentic" things. Detecting LLMs is one thing, but imagine the power of being able to pick which LLM browsers are permitted and which aren't!
I think Google is being too early to the party with this. Cloudflare still has CAPTCHAs to throw at the wall. There are ways other than attestation to verify that someone is a real human, but they're getting more and more annoying to real users and harder and harder to implement on a small website.
Despite the massive implications, this is a simple system that just works for the 99% of people who use Chrome or Safari or at least have access to an Android phone or iPhone somewhere. It's quick, doesn't require installing apps or creating accounts, and it just works from both the website perspective and the user perspective.
Of course when you start thinking about people with disabilities things become problematic, but when have tech companies ever really cared about that sort of thing? Inclusiveness was fun and all for a while, but the clowns the American people elected banned that sort of thing for any company considering government contracts, and big tech licked that boot like it was made of honey.
The world becomes a lot easier if you just decide to ignore all edge cases and assume customers who disagree with you didn't matter anyway. And infuriating as it may be, for companies like Google, that business model works.
Fire-Dragon-DoL
I mean depending on the cost, Google is guaranteed to lose the battle, like gaming anticheat: there are tools that do parsing of the image on screen and send input as a usb device, there is absolutely nothing to detect.
Doing that for a webpage seems way easier than s videogame
SwellJoe
From "Don't be evil" to building the largest, most invasive, surveillance operation the world has ever seen.
That was true before this, but this indicates nothing will ever be enough. Google will always want to track more of everyone's activity online, and will use every tool at their disposal to do it.
curiousgal
It's not Google, it's someone. A person came up with this idea and is pushing it through. We should stop treating corporations as some abstract entity instead of a group of sick people making these kinds of decisions.
munchler
I think this is the third HN link I've clicked on in a row that leads to an LLM-generated article. I'm not opposed to AI, but I'm tired of seeing it quietly substituted for human thought and expression.
alex_duf
I'm seeing this stance a lot "this is obviously AI generated"
Why? What's LLM generated? How can you tell?
To me what's obvious is that our trust system is already breaking down. Commenters accusing each other of being AIs is also another example of this.
gruez
>Why? What's LLM generated? How can you tell?
Not the guy you're responding to, but:
1. The high number of (em) dashes is suspect, though it's unclear whether they manually replaced the em dashes or is actually human generated.
2. "One additional failure worth noting: one incident response professional in the HN thread, raised a concern that operates independently of the bot problem" feels out of place for a content marketing piece. HN isn't popular enough to be invoked as a source, and referencing it as "the HN thread" seems even weirder, as if the author prompted "write a piece about how google cloud defense sucks, here are some sources: ..."
3. This passage is also suspect because it follows the chained negation pattern, though it's n=1
>No hardware identifier is transmitted. No attestation is required. No certification layer determines who may participate.
edit:
I also noticed there are 2 other comments that are flagged/dead expressing their reasons.
ribtoks
> actually human generated
Human written, not generated.
> HN isn't popular enough to be invoked as a source
Excuse me, what do you mean there? The author happens to read HN too.
bakugo
Looks like the moderators are actively deleting comments that call out AI generated articles now. Grim. This comment will probably be deleted too.
munchler
The choppy language is the biggest trigger for me. Examples:
* "With Fraud Defense, there was no process to respond to. The product launched. The requirements page went live."
* "That is not a technical limitation waiting to be engineered around. It is the mechanism."
* "The defeat is mechanical. Bot operators point a camera at a screen, a trivial automation with off-the-shelf hardware."
I could be wrong, of course. Maybe humans are starting to write like LLM's, or maybe it's just confirmation bias on my part.
Terretta
Look at the number of : per paragraph. What human puts two : in a single sentence?
"One additional failure worth noting: one incident response professional in the HN thread, raised a concern that operates independently of the bot problem: …"
The ersatz Ted Talk meets LinkedInfluencer rhythm of sentences, the throat clearing fillers as connective tissue…
Or Wikipedia: https://en.wikipedia.org/wiki/Wikipedia:Signs_of_AI_writing
mananaysiempre
I do. I usually notice and try to rephrase, though.
(Also, you can pry my em dashes[1] from my cold, dead hands.)
[1] https://www.gally.net/miscellaneous/hn-em-dash-user-leaderbo... says mean 1.64, maximum 13 em dashes per pre-ChatGPT comment.
bakugo
The entire article is just one long stream of short, punchy, declarative sentences. The latest Claude models are notorious for writing like this.
There's also a few cookie-cutter patterns that should immediately jump out at you if you're at all familiar with AI writing, such as:
> No hardware identifier is transmitted. No attestation is required. No certification layer determines who may participate. User privacy is structurally preserved, not promised.
> Google Cloud Fraud Defense is not a reCAPTCHA update. The QR code is the visible mechanism, but device attestation is the real product.
tkel
It's really obvious. The repeated information. The very. short. sentences. The incessant detail. The tangents that go nowhere. And LLMS always try to structure the entire essay into topical sub-sections.
nitwit005
They can't tell. It has become a statistical thing. There will exist some percentage of them that assumes an item is AI generated. With enough people seeing something, you'll see the accusation.
michaelcampbell
"this is AI" is the new "This is shopped", but without the "I can tell by the pixels" rejoinder.
I mean sometimes they're right, but honestly in this day and age does that even matter?
Havoc
Whether it's AMP or manifest 3 or android source shenanigan or attempts to replace cookies with their FLOC nonsense or this...Google is rapidly turning into a malicious force when it comes to the open internet
xiaoyu2006
Turns out RMS has always been right. How surprising.
tgsovlerkhgsel
Turns out that identifying a problem doesn't help without a workable solution/alternative.
undefined
skinfaxi
The first step in solving a problem is identifying it.
jjulius
The whole "don't point out a problem unless you have a solution" trope is bullshit.
dylan604
I hate this trite and the managers that say "don't bring me problems, bring me solutions" nonsense. I'm not the person to be able to fix it so the solution is make the problem known so others responsible can fix it. If I could fix it, I wouldn't be telling you about the problem. If anything, I would tell you how I fixed an issue in some stand up or other of the many meetings scheduled keeping me from working.
m463
nonsense on all levels.
RMS has offered broadly solutions/alternatives since the beginning, along with reporting early on trends that other people ignore.
janalsncm
What is RMS’ solution to this problem?
kibwen
Uncompromisingly insist on only using things you have ultimate ownership and control over, even when that means dramatic and life-altering inconvenience, and where those things don't exist, build them yourself.
Unfortunately, "build it yourself" is relatively easy when it comes to software, and almost impossible when it comes to the hardware running that software. It doesn't matter if you have full ownership of a complete open-source stack if no hardware manufacturer will permit you to run unsigned arbitrary code. The lack of open hardware--chips that you could build in your garage using materials nobody could reasonably prevent you from acquiring--is the lynchpin upon which open source software will wither and die.
wafflemaker
In Eve online you used to be able to have people (outside your contacts list) pay some cash in escrow to send you a message.
Refreeze5224
I know what his solution is not. It's not a mechanism that conveniently enables the fine-grained surveillance of people that just so happens to be google's business model.
Aloha
Indeed, occasionally hammers do find nails to hit.
stronglikedan
Strange analogy considering that RMS got to where he is precisely by finding nails to hit much, much more than occasionally, and much, much more than most hammers.
traderj0e
If RMS said not to trust Google's self-proclaimed altruism and relationship with open source, yeah. I always assumed that was a backstab waiting to happen. But that only meant I used an iPhone and didn't care that it was more closed than Android, not that I got an Arch Linux phone or something. (And a Mac more importantly, but there's not really a Google counterpart to that.)
undefined
willio58
> AMP
My god AMP was such an annoying thing ~4-5 years ago when I was working in a marketing-forward web dev shop.
"Google really likes when you pipe your words into their shitty UI because it saves some time for the user"
We were all like, cool so on one hand we're being given complex designs for sites to differentiate them, and on the other hand we're bowing to a megacorp who actually wants to skip the whole web design part entirely and pipe our content through their pre-defined UI.
So glad it died. Should have known it would die in a matter of a couple of years with that being the track record for Google in general.
xnx
> skip the whole web design part entirely and pipe our content through their pre-defined UI
It's a shame this part didn't stick. I use reading mode every chance I get be cause the more design a page has, the worse it is. For some reason orgs agreed that it is ok to let medium or substack own their content, but hated Google's high speed CDN.
phpnode
Last time this happened we got a bunch of Google employees downplaying the impact of WEI and calling it a nothingburger, that people were being hysterical. I just checked, and everyone I saw defending it has since left the company. I'm sure another wave of Google managers, keen to appeal to the higher-ups, will be here to defend this new initiative any minute now.
undefined
EGreg
Don't you see it closing all around you?
It's not just Google. It's governments, corporations, all around the world, simultaneously. The noose is being tightened gradually, then all at once. And it's coming for all of us:
https://community.qbix.com/t/increasing-state-of-surveillanc...
The threats above interlock by design or convergence: Identity layer (1-5) creates the prerequisite for the others. Once identity is established at SIM/account/device level, the carve-outs that make surveillance politically viable become possible (powerful users get exemptions; ordinary users get watched).
Device layer (10-12, 16-19) creates the surveillance endpoint. Once content is scanned on the device before encryption, the cryptographic protections at the communications layer become irrelevant.
Communications layer (6-9) is the most-defended. Mass scanning has been defeated repeatedly. This is the layer where the resistance has the best track record.
Reporting layer (13-15) is nascent. Direct OS-to-government reporting hooks haven't been built yet at scale. The UK's December 2025 proposal is the leading edge.
Platform control (20-24) determines whether alternatives can exist. Browser diversity, app distribution diversity, and engine diversity are the structural protections. All three are narrowing.
A society with all five layers complete has the technical infrastructure for total surveillance with elite carve-outs. We are roughly 40% of the way there. Whether that infrastructure becomes a dystopia depends on political choices, not technical ones.
HN as a whole is surprisingly oblivious to the noose tightening, because many here are super against decentralized distributed things, if they involve any sort of token. You can complain all you want, but downvoting and burying the decentralized alternatives just for groupthink makes you somewhat complicit in the erosion of our privacy and liberties. Even if you might disagree with a project, all the work that goes into it might be a good reason to upvote it instead, considering that without this work, we're basically doomed.
CalRobert
Hell, even using cash feels like a minor form of dissent. And of course even if you leave your phone at home, your car will be scanned with ANPR wherever it goes. And if that fails, there's still your face to be tracked.
hellojesus
The cars themselves phone home all the time. You have to physically remove the transceiver to prevent it or run a jammer nonstop at the risk of a felony.
narrator
I said 16 years ago that when IPV6 was coming into use was the only reason for a 128 bit address space was so they could tie every packet on the internet back to you as a person. https://news.ycombinator.com/item?id=1464940
chadgpt2
No, the main reason is because NAT is terrible and restoring the end to end principle is important if we want the internet to stay not separated into server networks and eyeball networks. If we want to decentralize the internet it's necessary that eyeball machines can talk with each other, not only with servers. This ability reduces the possibility of surveillance.
When IPv6 was designed it was normal for each IPv4 address to be traceable to someone's desk. Fortunately, as that changed with IPv4 so did it with IPv6, so we got IPv6 privacy extensions.
pneumonic
It doesn't help that your first sentence makes you sound like a conspiracy theorist riding his hobby horse. I read on despite that, but others may not.
kogasa240p
[flagged]
EGreg
I refer you to all my own comments about decentralized solutions, which you can see in my history. And the posts that have been flagged after amassing too many upvotes. I think that's sufficient.
ocdtrekkie
> rapidly becoming
Always has been.
Google was creating cartels like the "Open Handset Alliance" literally decades ago.
Via their control of Chrome and Search which are both monopolies, Google holds absolute authority on how websites are rendered and if websites can be found.
Melatonic
Huge fan of Kagi so far - especially SmallWeb if you do want to find websites that probably would not hit the top of Google search results
ocdtrekkie
I am a Kagi early adopter. ;) But the reality is what can be on the web is dictated by Google Search, because nothing survives if you can't find it on Google.
parineum
> Chrome and Search which are both monopolies
I'm on Firefox and use DuckDuckGo.
ToValueFunfetti
You'd be better off mentioning Safari (17% of users vs. Chrome's 68% and Firefox's 2.2%) and Bing (10% vs Google's 85% and DDG's 1.7%). But nice to know there are two of us!
vel0city
It cracks me up when people say Chrome is a monopoly, because a massive amount of computing devices do not even ship with Chrome. Windows computers, Macbooks, and iPhones require users go search out and install Chrome on their own out of their own volition, shipping with entirely functional and decent browsers out of the box that they have lots of patterns to push. Even many Android phones ship with browsers other than Chrome as a default still from what I understand.
How is Chrome, of all things, a monopoly? Have words just entirely lost all meaning and now monopoly just means "things which are popular that I dislike"?
MSFT_Edging
Chrome is a monopoly by extending the internet in ways that force users into chrome. Due to market share and Google's prevalence, they have the sway to introduce things that cannot meaningfully be avoided without extreme siloing.
Dylan16807
Why do you keep talking about who installs the app? That has nothing to do with whether something is a monopoly, which is primarily about market share.
wil421
I’m constantly badgered by google apps on my iPhone to use Chrome. In fact I’m not able to just click a link and open my default browser, I have to see the big chrome logo and a smaller link to choose my default browser.
dns_snek
What's the point of this pedantry? Replace "monopoly" with "dominant market player" and their point still stands. A company doesn't need to be a literal monopoly to engage in anti-competitive behavior. The EU would call this "abuse of dominance". [1]
>> Google holds absolute authority on how websites are rendered and if websites can be found.
This is still 100% correct. Google owns the dominant browser and the dominant search engine, this means that they get to dictate how websites function and pick winners and losers through their search algorithm. If you're a publisher (i.e. anyone who hosts a website) you're forced to fall in line or go out of business.
[1] https://competition-policy.ec.europa.eu/system/files/2021-05...
traderj0e
and even the iPhone Chrome doesn't use the Chromium engine, it's Safari under the hood
ranger_danger
> Windows computers
Ship with a chromium fork called Edge
newphone733
They lost their search monopoly when LLMs came.
imglorp
Lost? No, they shoveled search into the furnace day after day as they prioritized sewage like paid results, link farms, and blog spam while burying the actual result far below, if returned at all. LLM showed up and gave you the direct answer you wanted in <1s; you don't even have to read the shitty troll result page.
xenophonf
I'm amused at how thoroughly Google adopted Microsoft's playbook. Chrome supplanted Internet Explorer by embracing the open web. But then Google immediately started on extensions, and now they're trying to extinguish the open web with nonsense like Cloud Fraud Defense. All very smoothly done. I mean, people are actually _asking_ for this junk. I'm impressed.
olyjohn
No they didn't. Firefox unseated Internet Explorer. Chrome then got big by putting its installer right on the Google homepage and harassing users to install it. And they had it bundled with other software, and would install as a user so that locked down computers could still run it. They absolutely did not win by embracing open standards.
traderj0e
Chrome has gone off doing their own standards to some extent, but you're forgetting what it was like when Internet Explorer dominated. You basically couldn't use the web without IE because they broke so many standards and implemented them in closed source. Then there was ActiveX on top, straight up Windows binaries in web. And besides there being a dominant engine, only one browser could use that engine. Trading that for Chrome dominance was at least a step up.
I use Firefox right now. Occasionally I need to open a site in Chrome instead, but it's rare.
vel0city
Chrome and v8 was just stupidly faster than any other browser and JS stack at the time when I first adoped it. It was a lot buggier in many other ways and many sites just didn't work quite right at the time, but the tradeoff on performance in the early days was very much worth it.
ocdtrekkie
People forget that Sundar Pichai's entire claim to success at Google was injecting the Google Toolbar into the Adobe Reader installer which would hijack your search and browsing data on IE, and the launch of Chrome, which was then also injected into the Adobe Reader installer, occurred because Google was concerned IE might block or limit their toolbar.
People absolutely did like Google at the time, but the majority of its growth is actually shoveling hijackers into other software installs just like BonzaiBuddy.
lotsofpulp
I recall Chrome being a superior browser in the early days, prompting many to switch and evangelizing it.
homebrewer
Lots of supposedly technically advanced users switched to Chrome en masse and promoted it on every occasion they could, because it was so much faster, simpler, safer, etc etc. Don't excuse useful idiots from their share of the blame. People warned about dangers of Chrome's growing domination for about as long as I can remember, back to at least 2012, only to be dismissed as paranoid.
narrator
If I may tie this into other things going on, The California wealth tax as written would force Larry and Sergei, if they didn't move out of California, to basically sell almost their entire stake in Google, and it would probably wind up owned by State Street and Vanguard who outsource their proxy votes to ESG consultants, who will probably vote for more surveillance.
gruez
As much as I hate whatever google's doing, this article has some issues:
>For operations that need Play Integrity attestation specifically, a compliant Android device costs approximately $30 at current market prices
This assumes the logic on google's side is something like `if(attestationResult == "success") allow()`, but it's not hard to imagine the device type being factored into some sort of fraud score. For instance, expensive devices might have a lower fraud score than cheaper devices, to deter buying a bunch of cheap devices. They might also analyze the device mix for a given site, so if thousands of Chinese phones suddenly start signing up for Anne's Muffin Shop, those will get a higher fraud score.
>Firefox for Android does not appear in Google’s stated browser support list for Fraud Defense.
The browser only needs to show a QR code, so if you're on firefox mobile they'll either open a deeplink to google play services on the phone itself, or show a qr code.
>One human solving a single challenge pays a negligible cost. A bot farm running concurrent sessions faces exponential compute costs with each additional attempt - and AI agents, which consume GPU cycles to operate, face identical penalties regardless of how sophisticated their reasoning is.
PoW for bot protection basically never caught on because javascript performance is poor, and human time is worth more than a computer's time. An attacker doesn't care if some server has to wait 10s to solve a PoW challenge, but a human would. An 8-core server costs 10 cents per hour on hetzner. Even if you assume everyone has a 8-core desktop-class CPU at their disposal (ie. no mobile devices), a 6 minute challenge would cost an attacker a penny. On the other hand how much do you think the average person values 6 minutes of their time?
motbus3
I strongly suggest people move away from chrome. They lost all sense of respect.
I know it is a small move, but as it happened when chrome started, this opens opportunities for other players
hbn
I really tried to switch off Chrome when they broke ad blockers, I gave it a good few months trying out alternatives but I really don't like any of the other browsers. I do primarily use Safari on my Mac, but on Windows where I don't have that option, I don't like any of the big players, and I don't really trust the smaller players. Even the "big" smaller players are not that trustworthy when it comes to security, like Arc browser's "Boosts" feature that enabled remote code execution.
So now I'm back on Chrome.
motbus3
It is understandable but you can also use a simpler browser for common things and use chrome for banking or things like that
hansvm
Qutebrowser is my favorite daily driver, save for a few sites I can't boycott and which need Firefox or something.
lambdaone
This is truly disturbing, and trying to sneak it in like this without public discussion is disingenous. Hopefully it will be shot down like last time - at the very least, there are surely antitrust issues here.
phpnode
Last time they tried this they laundered it though an employee's personal github to distance it from google itself, then framed the proposal in the most disingenuous manner possible, as if it was something that users wanted rather than another mechanism for google to exercise control
nerdsniper
I agree on the antitrust issues, but I’m not convinced that’s seen as a serious barrier these days.
dgrin91
Maybe a dumb question, but how is this suppose to work for iphone users? They wont have google play, and it seems like android/google play is required here? There is no way they would cut out such a huge chunk of the market.
nerdsniper
iPhone users will have to install the "reCAPTCHA" app. https://apps.apple.com/us/app/recaptcha/id6746882749
This is detailed at https://support.google.com/recaptcha/answer/16609652
donmcronald
What's up with the reviews? It's pure spam and the 1-star review is completely hidden.
magnio
Apple has device attestation deployed like one year before Google even proposed it: https://httptoolkit.com/blog/apple-private-access-tokens-att...
doctorpangloss
hacker news when discovering that apple deployed WEI, for ages, with beloved IT company Cloudflare, affecting hundreds of millions of users: "aww, you're sweet"
hacker news when reading that google is doing the same thing for the rest of the userbase: "hello, human resources?"
Dylan16807
I thought that cloudflare system worked on any hardware and the tokens are anonymous. Did that change at some point? If it didn't change, then yeah it should get a very different reaction!
(Edit: it looks like the new system is still private and still interlinked with the old system that lets you use any hardware? I think?)
Also I don't know how you could have missed the widespread criticism of apple and especially cloudflare on this site.
michaelcampbell
Were you attempting to give us an example of the Goombah Fallacy? Because this is a picture perfect one.
raincole
Really. I think HN hates Cloudflare with (quite unjustified if you ask me) searing passion.
JoshTriplett
The claim is that an iPad/iPhone will also work. Not that that makes it acceptable; if anything, it's worse, because if it were Google Play only it'd be more obvious how unacceptable it is, whereas catering to the duopoly makes it less obvious how much it excludes people and builds a reliance on proprietary systems.
nicce
One company can soon dictate who can enter the websites. And only two commercial operating systems are viable in the world after this change. Not nice.
gruez
iPhones have attestation too: https://developer.apple.com/documentation/devicecheck/establ...
It'll just be more clunky because you have to install their app.
jeroenhd
I believe the latest versions of iOS just work from the browser, you only need to install the app for older versions of the OS.
I don't know what technology they're using, but when I scanned the QR code it launched (downloaded?) an iOS app of sorts with one tap, similar to the way Google tried Instant Apps a few years back. Didn't even need to double tap the power button like usual.
thecatapps
App Clips -- very underutilized but also very cool. https://developer.apple.com/documentation/appclip
pat2man
They also have Private Access Tokens: https://developer.apple.com/news/?id=huqjyh7k
tadzikpk
This article is full of false assumptions.
For example: > Bot operators point a camera at a screen, a trivial automation with off-the-shelf hardware. For operations that need Play Integrity attestation specifically, a compliant Android device costs approximately $30 at current market prices
A bot farm cannot bypass for long with a $30 phone. Do you seriously think that if Google sees the same hardware identifier 1000s of times a day they are not going to consider that usage to be fraud?
I appreciate that Google's made a real proposal to avoid the web becoming bottomless AI slop. This article hasn't come with a better alternative - I'd love to see one!
iamnothere
> Do you seriously think that if Google sees the same hardware identifier 1000s of times a day they are not going to consider that usage to be fraud?
Phones are very cheap, especially refurbished phones. Just have the phones mimic real life sleep/wake cycles and take occasional breaks. Use 25% more devices to account for the loss in uptime.
Besides, some people (often unemployed or disabled, and possibly with sleep disorders or mania) actually don’t do anything other than scroll on their phone all day and night. So you can’t rely on this as a good signal without creating even more blowback. And you really don’t want too much blowback from troubled people who have infinite free time.
varenc
This still doesn't seem very economical for the bot farm. For a device to look legit it has to only use its hardware identifier about as often as a real human would. This massively changes the economics. If you have 1 bot farm customer that wants 20,000 solves in a day, the bot farm would need something like 20000/200=100 phones to provide this. (assuming a real user can do about 200 solves before being flagged).
And the cost for the bot farm being detected is very high because if a phone's root key loses trust it destroys the value of the ~$30 phone they purchased. And of course, I'm sure Google can use the phone's value as another signal for trustworthiness, treating cheaper phones many generations behind as less trusted.
I don't think bot farms will go away completely, but the price will spike massively, which is all you need to discourage many types of abuse. Some Googling show that reCAPTCHA solves are about $0.003 each right now, so quite cheap. With this new reCAPTCHA, I suspect the price will jump massively.
jsnell
It is particularly funny because this is content marketing for a computational proof of work "captcha". Those are pure snakeoil, with economics that are probably at least four orders of magnitude more favorable to the abusers than this attestation would be.
Velocifyer
I'm pretty sure that the Ai copied the $30 number from my hacker news comments. However in the USA it is true. https://www.walmart.com/ip/Straight-Talk-Motorola-Moto-g-202... (carrier locks don't matter for this usecase.) I am not sure that that storing unique device identifiers is legal in the EU.
ribtoks
I remembered $30 from some comment I read, but didn't look for it later. If it was yours, thank you! (def. thank you for the Wallmart link! - would you like a credit in the blogpost like a quote?
Velocifyer
>would you like a credit in the blogpost like a quote?
Yes.
meowspace
inb4 someone productionizes this (the dependency of cloud phones exists & captcha solvers proved demand) && makes it a cloud service && we are back to square one.
realusername
> A bot farm cannot bypass for long with a $30 phone.
That's exactly what they are doing already, and it's not 30$/device but something like <5$/device. Remember they can buy the worst of the worst of the used market.
Betting on device attestation is really betting that smartphones will become less ubiquitous and more expensive to own. Sounds like it's not going to happen to me.
janalsncm
I think I understand why Google wants to do this, and I think I understand why people are opposed to this particular solution.
It’s also worth noting that the author of this article is selling a proof of work solution to the problem.
I am fairly skeptical that proof of work is the right way to go here. A lot of users of the web are using older hardware. Adding a computational toll booth doesn't solve the problem in a world where people have differing amounts of compute to spend.
On the other hand, a botnet might have access to thousands of computers and may not actually care about waiting an extra 10 seconds. Or worse, they will come up with a custom solution on an ASIC that solves your proof of work puzzle thousands of times faster than grandma‘s laptop.
spankalee
Given all the negative comments here - what is anyone's alternate solution for AI-driven fraudulent activity?
CAPTCHAs are increasingly ineffective. Services are either going to go offline or implement some kind of system like this. PII like credit cards or SSNs aren't enough because those are regularly stolen.
So where do things go? Fewer services and infinite fraud?
JoshTriplett
> Given all the negative comments here - what is anyone's alternate solution for AI-driven fraudulent activity?
A combination of "regulate AI" and "The optimal amount of fraud is not zero". https://www.bitsaboutmoney.com/archive/optimal-amount-of-fra...
nazgulsenpai
Yes, fewer services and infinite fraud is substantially better to me than the web being controlled by Google even more than it already is.
frankchn
It will be fewer accessible services for everyone who refuses to use this, that's for sure. In general though, service providers are not going to accept "fewer services and infinite fraud" and thus they will look into implementing this.
nazgulsenpai
I agree in practice money will always win.
iamnothere
This doesn’t even solve the problem thanks to device farms. There’s not really a solution for this short of aiming a camera at someone’s retina 24/7 plus a fully locked down hardware path. And even that would surely be compromised given enough incentives.
People are just going to have to find a new way to monetize. Maybe more things will become paywalled, or sponsored long-term like old TV shows. Again, there’s no good way to solve this, and the “solutions” on offer just contribute to the surveillance state without solving the problem.
phpnode
Why do you continue to extend the benefit of the doubt to your former employer when they have shown themselves to be untrustworthy again and again?
spankalee
For one, I got to see how utterly insane and off-base many of the conspiracy theories around Chrome were compared to reality.
4289076290867
[dead]
BiteCode_dev
Make people pay money instead of watching ads.
zb3
I don't know which activity you're referring to, but why are you trying to discriminate between humans and bots? Because bots don't pay? So demand payment.. Demand like payment per account creation, then set appropriate rate limits per account.
somat
CAPTCHA is sort of a flawed concept in the first place. a machine to test if another agent is a machine. But I figure the future of this is give the test, but discard the answer, the truth is in how it is answered, behavioral analyses, see if their access patterns are human or machine like. A simple version of which is how fast they type, or speed items are clicked. A surveillance process that really creeps me out. I am undecided if it creeps me out more or less than fully automated agents spewing shit over the open web.
As a footnote i found googles recaptcha bitterly ironic, it was painted it in bright colors "this data assists in book scanning" or "this help our self driving cars recognize stop signs" but really designed to train models to do exactly what it's trying to prevent them from doing. and making life hell for the humans along the way. The modern single click version is doing behavioral analyses.
righthand
Captchas were never effective. It’s an arms race to the bottom.
prima-facie
What Google has done is incredibly clunky and only serves its own interests. We already have methods to prove that we're human.
1. lots of laptops have fingerprint readers & TPM2 build-in
2. lots of folks own Yubikeys or FIDO2 keys - if these became the norm then the price would come down significantly.
Both of these methods only require a tap to authenticate to a website. Both provide public-key authentication, and both provide some level of proof of work / require human interaction, without revealing the identity of the end-user.
Why not use or standardise these? because there's no benefit to Google of course.
nerdsniper
Those don't prove that a human is present. A FIDO2 key can be automated by electronic relay. The only way to do this involves device attestation - locking devices down and utilizing hardcoded TPM/Secure Enclave esque chips. The best we can hope for would be an open standard for those chips so that people can use them with their own X.509 certificates that lets them choose their own CA.
nitwit005
Real hardware doesn't mean a human is present either, unfortunately. It just means that you have to spend on real devices to bypass these defences.
prima-facie
This was exactly my point as well. Everything that can be automated will eventually be automated.
nerdsniper
Maybe Worldcoin really was the answer after all XD
Get the top HN stories in your inbox every day.
I saw this coming from miles away. Computers are better at solving CAPTCHAs than people are and people can be bribed or convinced to join botnets so IP whitelisting doesn't work either. Now we have tons of fingerprinting and behaviour analysis but governments are cracking down on that. Plus, YouTube had a massive ad fraud problem with ads being played back in the background in embedded videos, so their detection clearly wasn't good enough.
There aren't many good ways to prove you're not a bot and there are even fewer that don't involve things like ID verification.
Their opt-in approach helps shift the blame to individual web stores for a while, so who knows if this will take off. But either way, in the long term, the open, human internet is either going away or getting locked behind proofs of attestation like this.
Apple built remote attestation into Safari years ago together with Cloudflare and Google is now going one step further, as Apple's approach doesn't work well against bots that can drive browsers rather than scripted automation tools.
Luckily, their current approach can be worked around because it's only targeting things like stores now and you can buy things from other stores. Once stores find out that click farms have hundreds of phones just tapping at remotely served content, uptake will probably be limited.
It'll be a few years before this is everywhere, but unless AI suddenly isn't widely available anymore, it's going to be inevitable.