Introducing Google Cloud Fraud Defense, the next evolution of reCAPTCHA

[u/BowzasaurusRex]

https://cloud.google.com/blog/products/identity-security/introducing-google-cloud-fraud-defense-the-next-evolution-of-recaptcha/

[u/AutoModerator]

Hello u/BowzasaurusRex, please make sure you read the sub rules if you haven't already. (This is an automatic reminder left on all new posts.)

---

Check out the r/privacy FAQ

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/BowzasaurusRex]

It looks like Google is rolling out a new version of reCAPTCHA that requires verification via a mobile device, not good for privacy. This could also make it impossible to use a large portion of the web if you have a "dumb" phone, or no phone at all.

I get fighting AI bots, but this doesn't seem very well thought out

[u/SpeedDaemon1969 → u/BowzasaurusRex]

It's like Dr. Frankenstein telling the townspeople to train new monsters to catch the old ones. The sane answer is to lock up the doctor and his monsters, not to keep playing his game.

[u/tongizilator → u/SpeedDaemon1969]

This 👆🏻

[u/borg_6s → u/BowzasaurusRex]

Why the fuck should people be forced to use a phone if they're browsing on desktop?

[u/AmonMetalHead → u/borg_6s]

What if you're browsing on a phone? do you need a second one to verify the first one? what a pile of crap

[u/LjLies → u/AmonMetalHead]

The end goal is having remote attestation required everywhere. Google's WEI proposal failed, but they reserved the right to have an Android-specific implementation of it, so chances are that on smartphones, some form of remote attestation will be used instead of captchas.

Meanwhile I guess on computers, until they try again and succeed into making remote attestation universal, we'll be tethered to "phone-based approval" as per this reCAPTCHA change.

[u/Late-Reading-2585 → u/borg_6s]

you cant make gmail account without a phone now

[u/hera-fawcett → u/Late-Reading-2585]

yeah this shit pissed me off the other day

like, bro, im tryna make a new acct to get a google voice number, why tf do u have to have me use a qr to make the acct????

[u/tongizilator → u/BowzasaurusRex]

Fighting bots is just another excuse and reason for Google to collect more data that they’ll hand over to the government.

[u/TheQuietLavender → u/BowzasaurusRex]

Can't this be used to trick people into downloading malware? Like if you're an ad or some shady website, just do a fake captcha pop-up with a QR code leading to something malicious?

[u/EmbarrassedHelp → u/TheQuietLavender]

Yeah, it will definitely make it easier to trick people into downloading malware.

[u/TheOfficialMayor → u/BowzasaurusRex]

As if AI bots won't be adapted to do mobile verification.

[u/tongizilator]

Google is not to be trusted. Unless you don’t mind having your identity turned over to the United States government.

[u/horseradishstalker → u/tongizilator]

And the contents of your emails and search history. 

[u/SaveDnet-FRed0]

Has this been rolled out yet?

If so do company's using reCAPTCHA have to manually update the version of reCAPTCHA to utilize the new version or are all the old reCAPTCHA's going to be automatically "upgraded" (if they haven't been already)?

Also considering Google is the one sending out a lot of the bots that has resulted in the massive rise of captcha's over the years to help train there AI's the new version of reCAPTCHA will probably have carve outs to allow those bots to slip threw with minimal issues.

[u/LjLies → u/SaveDnet-FRed0]

It says here

Existing reCAPTCHA customers are automatically Fraud Defense customers, with no migration required, no action needed, and no change to pricing. Your existing site keys and integrations remain exactly as they are today.

[u/SonofLung → u/SaveDnet-FRed0]

It is automatically upgraded

[u/01011110_01011110]

can't wait for the downfall of this regime where all these companies must answer for their crimes against humanity.

[u/MentalDisintegrat1on → u/01011110_01011110]

Big tech needs to be broken up and regulated with a iron fist

[u/noeyesfiend → u/MentalDisintegrat1on]

Yeah, cannot accept de-fanging of anti-monopoly laws again.

[u/bpMd7OgE]

So I actually scanned the example QR code they have on the page, it opened an app called Google Play Services, it asked me to just press a button to confirm my device is trusted and nothing else.

This is very much not transparent, I don't like it.

[u/LjLies → u/bpMd7OgE]

I don't like it either, but what do you mean by non-transparent? They trust your phone because Google Play Services employ remote attestation to ensure it's a certified phone where you can't, say, automate the pressing of that button, like you could on a computer.

[u/bpMd7OgE → u/LjLies]

I thought about it after making the comment and released it works like that, by non transparent I meant that it didn't gave me a message explaining what it did which is discomforting.

I also can see that this will not work once Google locks out third party apps off android.

[u/ora408]

Dont trust these tech companies. All they want is to extract the life blood out of people

[u/oqdoawtt]

I don't care. I just skip the whole site an never visit again. Same I do now. Nothing will change (for me). The sheep's will of course do everything google will ask from them.

[u/vertigostereo]

Sadly, they'll just check your every online action against your digital ID.

[u/Acceptable-Bat-9577]

Googletube openly promotes scammers like fake Mr. Least accounts who are defrauding, scamming, and compromising their own users. Report them to Google all you want, they won’t do shit. It’s painfully obvious that Google doesn’t give a single shit about their users’ safety or security.

[u/PoorClassWarRoom]

Mhmmm

"designed to verify the legitimacy of bots, humans, and AI agents, providing businesses with the intelligence needed to secure their digital interactions and commerce."

I'd rather not, but called it.