Google broke reCAPTCHA for de-googled Android users

https://reclaimthenet.org/google-broke-recaptcha-for-de-googled-android-users

by anonymousiam • 3 months ago

1561 589 3 months ago

reclaimthenet.org

Related: Google Cloud fraud defense, the next evolution of reCAPTCHA - https://news.ycombinator.com/item?id=48039362

also: Google Cloud Fraud Defence is just WEI repackaged - https://news.ycombinator.com/item?id=48063199

hackernews682• 3 months ago

The gate to the pig pen is closing…

ranger_danger11• 3 months ago

Sites that use reCAPTCHA/Turnstile/etc. have already been broken for me for years now due to neverending captcha/refresh loops.

My ISP regularly changes everyone's IP, and I apparently share an ISP with people who suck, so I get flagged just trying to do all sorts of normal things. Some examples:

- I've never bought anything from Etsy but I'm somehow banned from even viewing their site at all.

- Discord immediately bans me any time I try to create an account.

- Can't buy flights from Delta, always gives a non-descript error.

- Can't buy concert tickets, it thinks I'm a fraudulent buyer.

- Most CF sites produce a "Sorry, you have been blocked" page, or just loop.

- Trying to buy products on a shopping cart will have my order silently flagged/canceled for "VPN usage" (I don't use one).

- Some sites/programs block me for being on the DroneBL or similar lists I did nothing to get onto, and have verified many times that it's not really coming from me.

I just take my business elsewhere... eventually I'll probably just stop using technology at all.

prism56• 3 months ago

Oh man I feel you. I turn my VPN off on certain sites due to the captcha loop.

Milpotel• 3 months ago

Wouldn't a 1£ Linux VM as Wireguard access point suffice?

ranger_danger11• 3 months ago

Nope, I have tried. Just as suspicious to them if not moreso because it's a datacenter IP and not residential. I even have a list of sites I've tried to visit that were explicitly blocked from datacenter IPs, and that file has over a hundred hosts in it now.

ck2• 3 months ago

whenever I can't access a website for various stupid blocks

I fire up cloudflare warp and walk right through it

use wireguard with wgcf in environments without cloudflare client

yeah it's stupid we have to do this in 2026 but I guess cloudflare is the new AOL garden

wafflemaker• 3 months ago

You sir seem to have solved a problem many people here have.

Would you care to elaborate a little on how you did it?

It doesn't happen that often to me, but sometimes adblock setup I'm using results in such issues.

titularcomment• 3 months ago

the fact that this works, as well as cloudflare having a literal web scraping tool available as another product honestly makes my blood boil.

Jigsy• 3 months ago

Sites that use reCAPTCHA/Turnstile/etc. have already been broken for me for years now due to neverending captcha/refresh loops.

I had this problem recently with the Indeed website. (Cloudflare Captcha)

Thanks to someone on Reddit, it was discovered that anyone using a Chromium based browser (Brave, Vivaldi, etc.) on Linux was being punished.

Awfully frustrating having to set up a Virtual Machine just to be able to access one website via Firefox since even my hardened Firefox was being punished.

anonymousiam• 3 months ago

Why not just change your user agent string?

hysan• 3 months ago

Turnstile feels bad as a user. Every site that I’ve seen it long will lock up Safari hard while it’s doing whatever it’s doing. But at least I haven’t run into more than 2 refresh loops.

miladyincontrol• 3 months ago

Almost would bet one or a few of your ISP's customers have their connections being used as residential VPNs.

I know people like to think of suspicious android box setups but even a lot of "free" apps, extensions and other such services scarily seem to do that duty these days. I'm sure I'm preaching to the choir here, but its sad how many people will use some free of cost vpn and not even think why that might be.

ranger_danger11• 3 months ago

Yes, I have even seen mobile android games that include notices about a BrightData SDK or HolaVPN etc. where their idle bandwidth is resold.

chadgpt25• 3 months ago

Honest question: Is there anything scary about this apart from lowering your ISP's reputation score?

retired2• 3 months ago

I have not been able to visit AliExpress for months now. Just an endless reCAPTCHA loop.

I wonder if they are seeing a decrease in traffic and somehow find that acceptable.

rescbr• 3 months ago

This is why I ended up paying extra for a static IP from my ISP. While they always provided me with a public IP outside a CGNAT, I guess whole IP blocks were being targeted by these web security providers.

I guess my ISP allocates static IPs from a separate pool, and probably my IP block neighbors are better behaved (probably SMBs and other fellow nerds), aside from platforms learning that my IP is safe.

Captcha difficulties are way down now.

chrisjj3• 2 months ago

I just take my business elsewhere...

Mars? /i

wraptile• 2 months ago

It's not only IP but entire browser stack is being fingerprinted: Javascript, http, tls - everything. I've been living in the SEA region on Linux firefox for the last 10 years and the web has been miserable due to cloudflare and recaptcha

ranger_danger11• 2 months ago

Yep I often have to launch a clean/ephemeral chromium profile just to access a specific website, but even then it's sometimes not enough.

coppsilgold5• 3 months ago

My understanding is that this new reCAPTCHA is basically just remote attestation.

Remote attestation doesn't use blind signatures (as that would be 'farmable') so tying the device to the 'attestee' is technically possible with collusion of Google servers: EK (static burned-in private key) -> AIK (ephemeral identity key in secure enclave signed by a Google server) -> attestation (signed by AIK). As you can see if the Google server logs EK -> AIK conversions an attestation can be trivially traced to your device's EK. This is also why we don't really see and probably never will see online services which offer fake remote attestations, as it will be pretty obvious that the next step of running such a service is getting Google as a customer and having all your devices blacklisted. Private farms probably won't last long either as I'm sure Google logs everything and will correlate.

Unless something special is done with this new reCAPTCHA not only are you locking internet services behind TPM chips but you are also surrendering anonymity to Google. Unless you acquire untraceable burners for every service, the new reCAPTCHA will be technically capable to tying all your accounts across all these services together. Much like age verification. It may appear that the service would need to cooperate to link the reCAPTCHA session to your registration but the registration time alone will likely be sufficient (the anonymity set will be all but destroyed).

dheera• 3 months ago

Google didn’t demand iPhone users install Google software to pass the test.

Can de-Googled Android phones present themselves as iPhones?

coppsilgold5• 3 months ago

Apple has their own remote attestation infrastructure and you will not be able to impersonate an Apple device without extracting private key material from the secure enclave of a legitimate Apple device or compromising Apple certificate authority private keys.

thaumasiotes2• 3 months ago

Can they present themselves as... web browsers?

tardedmeme18• 3 months ago

If you run a website, it seems trivial to forward the attestation to someone else by putting the same code up on your website, and getting their device banned from google instead of your own.

ChadNauseam• 3 months ago

The domain in the attestation would be yours, so that wouldn't work

coppsilgold5• 3 months ago

Realistically, what Google will do in such a scenario is collect data about the illicit service, enumerate the devices the farm uses and what other activities the devices participate in. What you suggested has far less control over the devices that generate the attestations and it will show.

Also, if the implementation is competently done the phone will show the website for which you scanned the QR code. A user would be able to see whether or not that matches the site where they observed the QR code and proceed accordingly. In time Google will probably integrate it into the Chrome browser where a proxied QR code cannot even be shown.

getpokedagain3• 3 months ago

Stop visiting sites and using services that use reCAPTCHA. Problem solved.

tardedmeme18• 3 months ago

With the new reCAPTCHA this is going to happen because most human visitors will actually be unable to pass the CAPTCHA. It will be interesting to see whether this makes websites ditch reCAPTCHA or whether they literally just don't care about having customers, an attitude that seems to be getting more and more common every day.

g-b-r7• 3 months ago

Yeah, live in a cave, and problem solved.

However much I hate it, right now among the sites using reCAPTCHA there are many that I strongly want to use.

Let's find a better solution please

reaperducer• 3 months ago

Stop visiting sites and using services that use reCAPTCHA. Problem solved.

No. Bigger problem created, since there are innumerable government, health care, and educational web sites that use reCAPTCHA.

I'm not going to give up reading the test results from my doctor because of some simplistic ideologue decides that it's "problem solved."

lxgr8• 3 months ago

I'd love to, but I'd not be able to visit many sites anymore thanks to Cloudflare...

vasco• 2 months ago

So what are you doing here?

Ask HN: Did HN just start using Google recaptcha for logins? [0]
dang
No recent changes, but we do sometimes turn captchas on for logins when HN is under some kind of (possible) attack or other. That's been happening for a few hours. Hopefully it goes away soon.

[0] https://news.ycombinator.com/item?id=34312937

1vuio0pswjnm7• 2 months ago

HN uses reCAPTCHA under certain conditions

palata49• 2 months ago

Stop visiting sites and using services that use reCAPTCHA. Problem solved.

Not solved at all: 99.999% of users don't give a damn and use a Google-signed Android.

My opinion is that because they don't give a damn does NOT mean regulations should not protect them. What Google is doing here is anticompetitive and they should be fined (antitrust and all that).

duskdozer8• 2 months ago

That's great until it's some essential government, medical, educational, etc. service that you have either no alternative to or no alternative that isn't also using the same thing. I'm already being slowly and incrementally softlocked out of some (fortunately non-essential so far) sites either by cloudflare or other more subtle "anti-bot" networks as time goes on, including some like I've listed above. I can only expect this will continue until it's something I can't avoid.

IshKebab• 2 months ago

Or stop spreading this extraordinarily naive view of how the world works.

jollymonATX2• 2 months ago

Removing recaptcha from my sites now actually. Its not much, but its something.

thaumasiotes2• 3 months ago

My understanding is that this new reCAPTCHA is basically just remote attestation.

Yes, somehow "parse this QR code" would not have made my top 500,000 list of 'tasks that a human can do more effectively than a computer'.

lxgr8• 3 months ago

I'm sure some people still remember how to mentally decode QR codes and verify ECDSA signatures from Covid days. Public transit ticket inspectors in my city also seem to be quite proficient at it :)

g-b-r7• 3 months ago

I don't see any requirement to support hardware attestation in the recaptcha documentation, the Play Services seem to be "enough".

I think it's most likely to be attested by Google remotely; they might be using an app (with enormous access to the phone as the Play Services have) to be able to link a ton of data together, possibly including the local activity on the phone, officially to make better humanity assessments based on it all.

For people using a Google account it probably won't make a huge difference, in terms of data collected.

If that's how it would work, spoofing would probably be theoretically possible, but it would be easy for Google to detect attestations used by multiple people.

Let's not forget that this is an update to a very approximate system, absolute security is not (yet) required.

But there's a good chance that it will be extremely hard to sidestep, despite that.

lxgr8• 3 months ago

they might be using an app (with enormous access to the phone as the Play Services have) to be able to link a ton of data together, possibly including the local activity on the phone

But anything your phone can possibly do in software can be spoofed, so how would that help?

palata49• 2 months ago

I don't see any requirement to support hardware attestation in the recaptcha documentation, the Play Services seem to be "enough".

Doesn't Play Integrity use hardware attestation, but specifically checking the Google keys?

If you use the Play Services on GrapheneOS, you still don't pass Play Integrity because your system is signed by GrapheneOS and not by Google.

rdedev• 3 months ago

When companies like this exist, what is the point of relying of TPM? Looks like the future is bright for VC backed bots

https://doublespeed.ai/

tcoff91• 3 months ago

Wow that is so dystopian.

dakolli3• 3 months ago

Why is every startup using that same Serif font now, Garamond or whatever. Is it an LLM design phenomenon? Its kinda ruining that font style for me.

Also $1,500 a month for 10 "influencers" is wild. This doesn't seem that sophisticated unless they're doing something special to increase trust scores of accounts. They say they have "in house warming algorithm" which honestly doesn't inspire confidence for me.

Whats funny is its almost a certainty (if they are doing things correctly) that they have literal farms of phones (probably in SEA). The only real way to keep trust high is to have a real mobile connection and unique devices. Proxies are okay, but you really need to use the apps on real hardware.

NikolaNovak• 3 months ago

I'm assuming that's a troll / sarcasm / fake... But that could just be my last vestige of faith in humanity.

Edit: aaaand... That's another little sliver of my faith gone : https://www.theatlantic.com/podcasts/2026/04/how-fake-people...

failuser2• 3 months ago

How is this not grounds to be sued into oblivion by Google and Meta? They clearly violate ToS for profit. This is something I expect to find on a dark web forum where 0days are traded, not in public.

tardedmeme18• 2 months ago

These companies would have to buy one phone per fake influencer.

varispeed• 3 months ago

Shouldn't that be illegal under GDPR?

gib4444• 2 months ago

There are massive exemptions for the prevention and detection of crime

And https://gdpr.eu/recital-49-network-and-information-security-... :

Recital 49 - Network and Information Security as Overriding Legitimate Interest
The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security, i.e. the ability of a network or an information system to resist, at a given level of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered by, or accessible via, those networks and systems,...

It's funny how people after all this time think 99 Articles, 173 Recitals and a huge tech lobby equals a water-tight, pro-citizen, impenetrable privacy law with almost no exemptions.

deIeted• 2 months ago

worth noting that google/twitter/facebook/reddit/others colluded to combine sessions, identifiers, so that any person getting identified on any one session / ip would be identified on all

so while this comment is apt, i would ask them what they think of the previous chicxulub impact of the 2012 era collusion - which to this day has not been reported on

(just realized emacs bindings work in comments, nice, no ctrl-x tho)

normie3000• 2 months ago

I was going to ask for more info on this collusion but you say it wasn't reported. And googling "chicxulub" just gives a volcano.

Is this speculation, or has it been confirmed somewhere?

gorgonian• 2 months ago

Colluded how?

matt_kantor• 2 months ago

(just realized emacs bindings work in comments, nice, no ctrl-x tho)

Are you using macOS? If so, those keybindings work everywhere.

As far as I can tell, Hacker News doesn't impose any custom keybindings (the client-side scripting on this site[0] is very simple).

[0] https://news.ycombinator.com/hn.js

palata49• 2 months ago

Much like age verification

Age verification as a technical concept can be done in a privacy-preserving manner! Whether or not we want age verification is another debate, but let's stop making wrong technical claims about that: it doesn't help.

bpfrh• 2 months ago

Really, how?

At some point someone will need to issue a key, which at some point will need to be verified against known good signatures.

These signatures will also need to be kept in case of lawsuirs/enforcement, so if somebody gets access they will know you visited that site

indymike• 2 months ago

Divorcing technical detail from how it is used does little good for humanity.

pdntspa• 2 months ago

Doesn't matter if it is privacy preserving, it is still an evil thing to do

jollymonATX2• 2 months ago

Exactly the mindset that got us to this current reality..

coppsilgold5• 2 months ago

As far as I know no currently proposed age verification method does this in practice.

The only way to implement truly privacy preserving age verification is through zero knowledge proofs (or blind signatures) but what that would allow is undetectable token forging.

account424• 2 months ago

No it can't. If it's done in a truly privacy preserving way then someone can also sell a fake age verification service making the whole thing meaningless.

nullc3• 2 months ago

(as that would be 'farmable')

It could be contextual, as in each user gets one anonymous id per domain name per day. Multiple uses by the same user at the same domain in the same day are linked.

But much of the purpose of these systems is to violate the public's privacy and exert as much surveillance and control as possible. If not for that schemes that mitigate the privacy loss would be a top priority.

EmbarrassedHelp3• 2 months ago

having all your devices blacklisted. Private farms probably won't last long either as I'm sure Google logs everything and will correlate.

So basically Google can now ban your device from being able to access a huge portion of the internet, in addition to nuking any online presence connected to them.

You could wake up one day and find your device blacklisted from the internet, with no chance of ever reaching customer support. What a lovely future

ChrisArchitect• 3 months ago

Google Cloud fraud defense, the next evolution of reCAPTCHA

https://news.ycombinator.com/item?id=48039362

Google Cloud Fraud Defence is just WEI repackaged

https://news.ycombinator.com/item?id=48063199

kittikitti• 3 months ago

Please stop calling Android Linux. It's a marketing lie that continues to disappoint, including here. You're holding Linux back substantially by claiming Android is part of it. Just because it has Unix doesn't mean it's Linux as MacOS is also Unix.

prophesi• 3 months ago

Unless it was in a previous iteration of the submission's title, I don't see Linux mentioned anywhere.

PaulHoule• 3 months ago

The kernel is a Linux kernel. The userspace is very different from a typical Linux distribution.

g-b-r7• 3 months ago

A fork of it, updated periodically

And let's not pretend that we mean the kernel when we say Linux distribution

IsTom• 3 months ago

It's the punishment for all the times people laughed at calling regular Linux "GNU/Linux".

yjftsjthsd-h• 3 months ago

Android literally is a Linux distro, though. Like, sure it has a weird userspace and is user hostile, but that doesn't make it not a Linux distro.

Ylpertnodi• 3 months ago

... and is user hostile,

How so?

cybercatgurrl2• 3 months ago

linux is a choice, this is not a choice. fairly confident people are rejecting this notion on ideological grounds

bellowsgulch• 3 months ago

I’d just like to interject for a moment. What you’re referring to as “Android,” is in fact Android/Linux, or as I’ve recently taken to calling it, Android plus Linux kernel.

Linux is not an operating system unto itself, but rather a kernel—a core component that manages hardware resources. Android uses the Linux kernel, but replaces the traditional GNU userland with its own runtime, libraries, and system framework.

Many users run Linux-based systems every day without realizing it. Through a peculiar turn of events, the Linux kernel combined with Android’s userspace is often simply called “Android,” and many of its users are not aware that it is built on Linux at its core.

There really is Linux in Android, and these people are using it, but it is just a part of the system they use. Linux is the kernel: the program in the system that allocates the machine’s resources to the other programs you run. The kernel is an essential part of the system, but useless by itself; it can only function in the context of a complete operating system.

Android is normally used in combination with the Linux kernel: the whole system is basically Android/Linux, a Linux-based operating system with a distinct userspace, not a GNU/Linux system like traditional desktop distributions.

tamimio• 3 months ago

And soon desktop OSes will follow, if you don’t have TPM you won’t be able to browse half of the internet.

Andrex2• 3 months ago

A parallel, fully public and accessible internet being widespread and available for anyone with a slight tinkering kick... Could actually be really awesome.

Let the commerce-driven, corporatized hellhole that the modern web has become eat itself.

spencerflem2• 3 months ago

I love the vision, but I do wonder how the parallel internet will deal with DDoS levels of bot traffic.

I hear ‘web of trust’ pretty often and I like the idea but that’s not anonymous or accessible either

fsflover3• 3 months ago

TPMs can also be based on free software and our own keys. It works well with Heads and Librem Key.

cyklosarin2• 3 months ago

TPM with things like Heads are borderline zero security and theater compared to actually decent implementations on Android/iOS platforms, I doubt the big companies would rely on that. TPM in general on non Mac/Chromebook PCs is mediocre even from big OEMs.

anonymars• 2 months ago

What a coincidence that Windows 11 makes it a requirement!

roywiggins• 2 months ago

Not soon, now. The new reCAPTCHA on desktop shows you a QR code for you to scan with your Google-approved phone to prove you have one.

spankibalt• 3 months ago

Time for some lawfare!

DANmode4• 3 months ago

The Government reviewed the Google situation on behalf of you,

and on behalf of the Government,

and said “data, so piss off”:

https://abcnews.com/Technology/google-hit-antitrust-lawsuit-...

https://macdailynews.com/2026/02/04/u-s-files-appeal-in-goog...

userbinator10• 2 months ago

If the masses can somehow point the absolute loose-cannon that is the current President at Google, things might actually change.

Computer0• 3 months ago

warfare*

KPGv23• 3 months ago

https://en.wikipedia.org/wiki/Lawfare

Lawfare is the use of legal systems and institutions to affect foreign or domestic affairs, as a more peaceful and rational alternative, or as a less benign adjunct, to warfare.

cornholio• 3 months ago

It's a move to block competitor AI agents while securing access for your own, classic ladder kick. The market for autonomous agents providing services and doing online work will be gigantic so, unless you want your own bots locked out from ie properties guarded by Amazon, CloudFlare, Microsoft etc., you will need a bargaining chip.

hedora2• 3 months ago

As someone that uses AI agents, this makes me want to install a browser plugin for "public windows" that just archives everything I see, and then farms out clicks of content that are missing from those sites.

The result of this would be to upload it all to a bot-friendly alternative to archive.org.

CaptainFever• 2 months ago

That exists! Check out Hoardy Web. https://oxij.org/software/hoardy-web/

Its whole point is undetectable archiving because it just saves what your browser already sees.

citizenpaul• 3 months ago

For Decades the huge tech companies basically faced no adversity whatsoever. Now for the first time in their existence the massive returned investments in AI they are experiencing ... we will call it pain.

I would say it will be interesting to see what they do but I think rent-seeking, oppression, human rights violations would be more apt.

They were of course trustworthy proviers while they were untouchable but now I know how things are gonna go.

ezekiel68• 3 months ago

I don't know why reclaimthenet hasn't embraced the obvious answer: Simply create a new smart device operating system with a fully disentangled cosmos of programs, libraries, APIs, app SDKs, hardware partners, drivers, trust networks, carrier agreements, app stores, documentation, conferences...

colordrops• 3 months ago

Ugh I hate that I can't tell whether you are being sarcastic or not.

fsflover3• 3 months ago

Mobian, PureOS, postmarketOS already exist. Sent from my Librem 5.

cybercatgurrl2• 3 months ago

and that is gonna be funded by who? anyone who is gonna fund that is gonna want their slice of the pie. we need regulation to keep big tech in line

repelsteeltje• 3 months ago

How about consumers paying a little extra for their device? The way it's going, add sponsored big tech is dieing because click fraud detection is becoming too expensive. Either we give up privacy and track every user, or we let bots have at it, stop targeting ads to users and bill advertisers on bandwidth.

flatIronSteak2• 3 months ago

I uh.. I think that was the (sarcastic) point.

gessha• 2 months ago

Parent is sarcastic

BrenBarn• 2 months ago

Ideally it would be funded by the personal wealth of the people who've profited from the current situation.

drpixie2• 2 months ago

Same reason as "make another (better) windows" is very difficult - almost everyone wants to be able to run existing apps and drivers, so you're forever playing compatibility catchup with android (or windows).

That's the reason companies are desperate to be first/biggest - once you're it, you're it until you finally fall on your face and dwindle to a nobody.

palata49• 2 months ago

AOSP is open source. There are plenty of AOSP-based systems (starting with GrapheneOS). No need for a new one.

The thing here is that Google is building technology to prevent alternatives from connecting at all. We fundamentally cannot solve it by building more alternatives, we have to prevent Google (and TooBigTech in general) from doing it.

palata49• 2 months ago

Simply create a new smart device operating system

Why does it have to be new? Plenty of open source OSes exist... starting with Android! GrapheneOS is based on AOSP, you would call it Android. If I show you a phone running GrapheneOS, you probably won't even realise that it's running an alternative OS: it will be Android to you.

The problem is not that we don't have alternative. The problem is that Google is moving towards forcing everyone to run their OS (or the OSes they accept, since it includes iOS) to connect to random stuff on the Internet. They are literally building technology that will prevent alternative OSes from running properly.

No need to create new OSes if anyway they won't work, right?

thecatapps• 3 months ago

I'm failing to see why they didn't just adopt Private Access Tokens (not that they're great either), where they could have at least:

- pretended that it wasn't all about invading peoples' privacy.

- done a good ol' fashioned "but Apple does it"

- pretended to be standards-oriented

- advertised it as something completely transparent to the end-user

Seems like that would've caused a lot less backlash while still achieving the goal of having some form of device attestation -- but I'm guessing that's not the real goal.

FateOfNations• 3 months ago

Not Invented Here Syndrome?

treis• 3 months ago

It doesn't fundamentally solve anything. You want to be able to identify a specific person or at least a relatively expensive device so that if you ban them they stay banned.

altairprime2• 2 months ago

This is the exact method used to secure iMessage against spam: secure attestation and ‘console’ bans of devices (reversible by iirc phoning support, indicating who you purchased the used device from, and providing an ID). But Google is trying to pull a Windows 11 “TPM or die” conversion on the public Internet via Recaptcha. Welcome to the attestation wars, unwitting websites :)

rockskon• 2 months ago

As others in this thread have commented - there are scammer hubs where a single person controls hundreds if not thousands of phones at a time.

The people who this method is most hoping to stop are the least likely to be impacted by it in the long run.

incompatible• 2 months ago

"pretended" ... do they even care any more?

nightpool• 2 months ago

The article mentions that they use Private Access Tokens on iOS, so I'm not sure where you're getting the idea that they're "not adopting" them from

supriyo-biswas• 2 months ago

Private access tokens are also a repackaged WEI as far as I'm concerned.

Worf2• 3 months ago

I don't use Android right now and haven't used Google'd Android for almost a decade. And I won't. If this is the hill I die on, so be it.

I'm not going to use any sort of hardware attestation, especially one controlled by Google. You shouldn't either, even if you have an unrooted Google-certified Android phone.

brikym• 3 months ago

It's all fun until you can't get paid because some fintech app doesn't work. That's why we need regulations. I don't see politicians ever going against an advertising company when they're customers.

freedomben• 3 months ago

Indeed, I generally favor being conservative with regulations because they can genuinely impede progress and can be really hard to change or remove when they're bad, but this is an issue that we need regulation for. It's just too much in the interest of big tech to lock us down and strip us of our freedom of compute. Short of regulation.

Unfortunately I see the regulatory environment more likely to go the other way of requiring attestation. I sure hope I'm wrong.

retired2• 3 months ago

Already happening. The official German identification app, AusweisApp, is designed exclusively for Android and Apple mobile devices

lukashahnart• 3 months ago

What do you use instead? iOS?

Worf2• 2 months ago

Sorry for the late reply. Right now I don't use Android (in any form) or iOS. I have a dumb phone for calls and SMS. I'm fortunate enough that I can keep it on mute for days. I don't really need a tiny computer right now. My desktops and laptops are more than enough.

palata49• 2 months ago

"Not using" doesn't make any noise. If you just "don't use", you will just use less and less stuff.

Google doesn't give a shit, but smaller companies are the ones using reCAPTCHA and that kind of shit. Consumers need to complain to those smaller companies. And citizen need to complain to their government, if those case. In the EU there is the DMA: https://digital-markets-act.ec.europa.eu/contact-dma-team_en.

What's sad is that the few citizen who care are often complaining against regulations. And it is the lack of regulations that got us here. We need antitrust, period.

einpoklum• 3 months ago

Google seems to be putting yet another brick in the garden wall.

cantalopes• 3 months ago

This is crossing the line where the governments should step in and ban/fine google heavilly for this monopol behavior

OutOfHere2• 3 months ago

Instead, our governments use this crap, meaning on .gov sites too, and impose it upon us.

milderworkacc• 3 months ago

I agree. There are pretty clear grounds here to think about opening an investigation here into illegal tying, or a misuse of market power. Not sure if the FTC maintains a presence on here, but if you're listening...

failuser2• 3 months ago

The governments are the ones who needs the most. They want to know who all the potential and current dissidents are.

bigyabai4• 3 months ago

Bingo. Remember all the people on HN who canvassed for consumers to vote with their dollar? Absent-minded consumption is what consumers voted for.

Now everyone pretends like it's monopoly abuse because the Leopards Eating Faces company finally rang the dinner bell.

data-ottawa• 3 months ago

How you know this is a monopoly is that if you go on their documentation website half the video is how this rolls into Google Analytics.

This is using another product to reinforce the search and ads monopoly.

You can’t scrape content to build a better google or Gemini, you can’t make an OS to compete with Google or Apple, and you can’t make a Google Analytics competitor.

It’s plain anti competitive.

gib4444• 2 months ago

Oh man as if we still live in those times

chrisjj3• 2 months ago

"Don't be evil. That's our job."

kyrofa• 3 months ago

I don't even have a smart phone, I assume there is some sort of fallback behavior?

mzajc• 3 months ago

The fallback is that you get redirected to a website helpfully demanding you buy a Google- or Apple-vetted smartphone: https://support.google.com/recaptcha/answer/16609652.

You will also see this page if your smartphone is degoogled and you try to open the reCAPTCHA attestation URL in a web browser instead of in Google Play Services.

yohannesk• 3 months ago

Isn't reCAPTCHA a spam? This video I watched recently does a nice history and also was enjoyable to watch https://youtu.be/seX_rDEsP6E?si

OutOfHere2• 3 months ago

If there was any remaining doubt whether Google is evil, this settles that yes it is.

pixel_popping10• 3 months ago

archive.is just asked me for a QRcode scan, I'm so ashame of that crap (it's behind Cloudflare), forcing website visitors to KYC? Are you guys insane!?

the web is ruined if you push for this, this is millions of websites that will suddenly force KYC? What...the...f

https://ibb.co/X9Q6Y84

By KYC, obviously it's because there is very few non-criminal ways to have a SIM without KYC and get a Google account for Playstore without a number, so every website visits will be attached to a real ID.

I don't use a stock Android, right now I literally can't access many websites, this is genuinely crazy.

codedokode6• 3 months ago

Interesting, the text says "reCAPTCHA doesn't share your details with this site", but it says nothing about sharing your details with Google. Which means yes?

duskdozer8• 2 months ago

Naturally, "Your data is private[ly] and secure[ly stored in plain text on our servers so that it's only accessed by us and shared with the advertising partners we choose]."

Imustaskforhelp• 3 months ago

https://ibb.co/X9Q6Y84

Wow, This is really bad :-(

I think this is just gonna make viewing internet without a phone significantly harder especially with archive.is and the likes.

Not sure, how relevant this is to the discussion but if it helps, I have made a project[0] which allows to archive archive.is pages on archive.org/wayback machine (this uses singlefile)

Perhaps something like this can be used by community at scale too. Also, I hope that archive.is does something to fix this issue of requiring QR code and hopefully it doesn't become a permanent issue.

[0] https://smileplease.mataroa.blog/blog/htmlpipe-and-how-we-ca...

tom1337• 3 months ago

i wondered the same earlier and i am pretty sure they are just mimicking cloudflare's validation page. no way that cloudflare is paying reCAPTCHA when they have theor product, turnstile, available.

stavros4• 2 months ago

What? Don't Cloudflare literally have their own CAPTCHA service? Why are they using reCAPTCHA?

gruez3• 2 months ago

They mimic the cloudflare captcha page but they're not hosted by cloudflare.

pixel_popping10• 2 months ago

Never understand this anymore, it's genuinely one of the easiest services to pay to bypass automatically (literally 3-liner of JS), webmasters are becoming incompetent.

syntheticnature• 2 months ago

I thought archive.is were the ones squabbling with Cloudflare (extreme simplification)

altairprime2• 2 months ago

Their squabble was to claim that Cloudflare wouldn’t let them collect identifying information about the original requestor. No doubt they’re thrilled by this change’s identity exposure.

j0272• 2 months ago

You can still use the audio captcha, but I’m not sure how long that’ll be around.

BloodyIron5• 2 months ago

Google will incur serious lawsuits if they remove that accessibility aspect.

velocity3230• 2 months ago

Sound advice.

tocariimaa• 2 months ago

The water is already boiling and the frog can't get out anymore.

riedel• 2 months ago

I just tried using archive.is on my non-degoogled phone using IronFox instead of Chrome and could not pass the recaptcha. Actually it presented me the mobile attestation on second try, but I was able to switch to images again. But I am also unable to pass that one with the tracking protections built into the browser. Hopefully some 'serious' website starts using this so I can bomb their customer support.

zelphirkalt• 2 months ago

For me this archive.is thing has been unusable for a long time already, because they rely on Google Captcha for a long time already and I block Google shit by default. Allowing Google is probably equivalent to showing them your id, due to fingerprinting in the name of "safety". That's why archive.is is not helpful and usually just a tab I close again right away.

duskdozer8• 2 months ago

Seriously? I didn't realize this was already happening. FWIW I still got the old captcha testing that site, and I often get flagged and blocked, though it's possible you're doing better.

EmbarrassedHelp3• 2 months ago

If you reload the page it'll give you a non QR code captcha to do. Hopefully it stays that way or attestation captchas are removed entirely.

tomrod• 2 months ago

Even crazier is that there is nothing preventing agents from not using this. The hardware, signing, etc. can all operate as part of an autonomous agent stack. There is no benefit here to anyone.

cyberax3• 3 months ago

I think it's possible to run the Play Services in an emulator, faking the device type. Google doesn't seem to use the platform attestation for now.

SV_BubbleTime3• 3 months ago

Treatment is not a cure.

cyberax3• 2 months ago

Agreed. I'm just pointing out the possibility (for now).

qiine• 2 months ago

Really that seem almost too easy ?

cyberax3• 2 months ago

For now. They'll likely start requiring device attestation in future, and the emulator can't pass it.

buzzwords• 3 months ago

Given the way Google is going I'm not sure if my next phone will be Android. I am fully aware that I am probably in the minority here. For me the trust is entirely gone.

fluidcruft3• 3 months ago

There really isn't much of an option. Apple's just as bad if not worse.

chadgpt25• 3 months ago

Both are terrible for privacy so it comes down to which one has a nicer screen now. :(

I'd rather have Google check an Apple phone attestation than have Google check a Google phone attestation, and vice versa, though, because you can assume each company is trying to keep as much information private to themselves instead of giving it to the other. Google is probably just getting "yes it's an Apple phone" and some kind of temporary token, instead of my IMEI, IMSI, phone number, all signed in accounts, biometrics and so on.

queenkjuul• 3 months ago

At least with an Android i have the option of Graphene, and have access to a terminal, and for now can sideload apps.

With apple there's no choices, so I'll continue to take my chances with Android

LeoPanthera• 2 months ago

Apple's just as bad if not worse.

Could you justify that? Because to me it seems like Apple isn't doing anything even like this.

cyklosarin2• 3 months ago

Motorola + GrapheneOS next year could be an alternative. So far they've been relatively insulated from the changes that have been coming down from Google.

doctor_radium• 2 months ago

I'll be waiting.

In the meantime, I'm currently using a low end Motorola moto g 5G 2023 which lets me turn off Play Services. Chrome and the Google Calendar don't run (really do need to find a replacement calendar), and I couldn't be happier. Motorola's interest in GrapheneOS makes me wonder if they did this on purpose.

pillefitz• 2 months ago

https://motorolanews.com/motorola-three-new-b2b-solutions-at...

microtonal5• 2 months ago

Or if you need it now, Pixel + GrapheneOS. Pixel A-series are really affordable. E.g. the 9A is 350 Euro here, have great device security (Google Titan M2 hardware security processor, CPU that supports MTE, etc.), pretty good cameras/camera processing, etc.

palata49• 2 months ago

Motorola won't change a thing about hardware attestation. GrapheneOS is locked out from reCAPTCHA because GrapheneOS is signed by GrapheneOS and not by Google.

The way it's going, by the time the Motorola + GrapheneOS phone is out, it will be a lot more painful to use GrapheneOS than today. Not because of GrapheneOS of course, but because everybody accepts that bullshit Google is doing.

If you're waiting for Motorola + GrapheneOS, you could start complaining to banks and other apps that don't support GrapheneOS :-). If enough people did that, maybe those companies would consider it.

ryukoposting3• 2 months ago

You won't be alone. I've resolved that this will be my last Googled phone.

My dad runs the family domain/emails/etc. The hard part will be convincing him to degoogle the whole family.

drpixie2• 2 months ago

I'm inclined towards keeping an ancient android for those apps that require it, and maybe something open for actual use. Or perhaps a crappy old android for android and a small non-android tablet/laptop for daily-driver stuff, which always works better as a computer anyway!

I'm also becoming open to using software that lies to google about what it is :) Google will treat us like sh*t, why shouldn't we reciprocate.

drnick16• 2 months ago

Android yes, but Graphene is the answer.

nosioptar• 2 months ago

I've been getting asked more and more how to degoogle stuff by non-nerds.

lxgr8• 3 months ago

Almost completely unrelated, but I recently helped out a very confused family member with deleting not one, but two Google Cloud accounts they had no idea existed, and that they only learned about from an email referencing reCAPTCHA getting integrated into some other Google product offering.

I have absolutely no idea what happened there. My best theory so far is that they clicked on some really, really wrong buttons when solving a captcha themselves while logged in to their Google account in the same browser. Bizarre.

brunocvcunha• 3 months ago

AI Studio playground maybe? It seems all integrated.

lxgr8• 3 months ago

They almost certainly didn't use that.

The projects were named after a Google Doc they'd recently worked on (or a .docx attachment they'd received?) though, so my other guess is that they somehow created a Google Docs macro or similar by accident?

amluto• 3 months ago

I would love to see someone challenge this as an anti-trust violation. Google is using its market power (as the provider of reCAPTCHA) to actively prevent devices that don’t use Google Play Services from competing effectively.

cromka2• 2 months ago

They're only doing that because the EU currently doesn't want to antagonize US any more with their tech fines. Noticed how there hasn't been any as of recently?

probably_wrong• 2 months ago

Alternative explanation: they're following the Meta playbook of releasing surveillance features during a "dynamic political environment" that's keeping their opponents distracted.

https://www.nytimes.com/2026/02/13/technology/meta-facial-re...

gib4444• 2 months ago

https://www.cnbc.com/2026/04/10/google-meta-big-tech-6-billi... :

April 2025: Apple fined €500 million for failing to comply with "anti-steering" obligations. Meta fined €200 million under the Digital Market Act for requiring users to consent to sharing their data with the company or pay for an ad-free service.
December 2025: X fined €120 million under the Digital Services Act for breaching transparency obligations.

(Sure, not this year, but that's pretty recent by most standards. And not sure if they're still being contested and unpaid)

And recently, Google is working with the EU to avoid a fine: https://www.bloomberg.com/news/articles/2026-05-06/google-ma...

palata49• 2 months ago

because the EU currently doesn't want to antagonize US any more with their tech fines

Yeah, I say it as "because the US bully the EU to prevent them from doing it".

palata49• 2 months ago

It's worse than forcing the Play Services: strict Play Integrity requires your system to be signed by Google. So if you use the Play Services on GrapheneOS, you're still locked out.

surajrmal4• 2 months ago

I'm not sure the definition of anti-trust matches what you're saying. Are there any retail android devices for sale without Google Play Services? Also, notably iPhones will be able to still work despite not having Google Play Services.

goda90• 2 months ago

They're using their position to force people to buy a certified Android phone or iPhone in order to use millions of websites Google doesn't even own. People without a phone, people with dumb phones and alternative operating systems (deGoogled Android being just one example) can be totally cut off.

a21282• 2 months ago

Retail phones for sale without Google Play Services:

All Huawei phones, which uses Huawei AppGallery after sanctions

FairPhone 6 /e/OS

Practically all modern feature phones: Nokia phones, HMD phones, etc. As I understand it, predominantly used by elderly and kids. But it's also gaining traction among millennials and Gen Z for digital detox and defeating mobile addiction.

Linux phones (Jolla Phone, PinePhone, FuriPhone, etc) - these you probably won't find in your local retail store but this is another competing platform being built from effectively an entirely different lineage minus the kernel

dwedge9• 3 months ago

I've kept a spare cheap android for too long and recently went with Graphene instead. I have one Google profile and only use it for Uber, work's Google Chat and maps. One bank refused to work (even with Google services) so I moved bank. I've moved most of my mobile use to self hosted (freshrss full text, password manager, calendar, tasks) with no direct internet connection.

It's a bit irritating but I'm glad I started down this journey because it looks more and more like I'm going to be avoiding the internet

gonzalohm2• 3 months ago

What's the best alternative for Google drive? I also went this route but Samba is a bit annoying sometimes

dwedge9• 3 months ago

I only share with one person so we use Seafile

danparsonson5• 3 months ago

Syncthing is very nice.

bsmith• 3 months ago

If you dont need filesharing, you can just setup wireguard, setup a network drive on your phone's files app.l, and then when connected it'll feel like native file browsing.

drnick16• 2 months ago

What makes Samba annoying? I think it's perfect for its intended use (LAN).

If you need to share files externally, Nextcloud works very much like Google Drive and allows the creation of sharable links.

BloodyIron5• 2 months ago

Nextcloud, Samba serving SMB isn't really equivalent.

ianopolous• 2 months ago

There is Peergos: https://peergos.org (disclaimer: I am the creator)

class3shock2• 2 months ago

Proton Drive works well and is from a company that supports privacy but does require a paid subscription.

ryukoposting3• 2 months ago

If you don't mind me asking, what Bank? I've resolved that this phone will be my last googled phone, and my next will be GrapheneOS.

dexterdog• 2 months ago

Not OP, but I've been on GrapheneOS for a few years and I have no problem with Chase, CiT or Wealthfront. I mostly use them to check balances and unlock debit cards, but they all login and function fine.

dwedge9• 2 months ago

Halifax UK. It just refuses to work so I left it (Graphene is more secure, so forcing less security for the sake of tracking is off the cards). All the other banks so far say they won't work without Google services but if I click OK they work

drnick16• 2 months ago

My setup is similar and nearly 100% self-hosted, including email, files, AI. If something does not work on Graphene, I will do without it. I also have a Google profile, mostly for testing purposes.

xerox13ster• 2 months ago

How have you managed to accomplish self-hosted email? I tried similar in 2022 and found it damn near impossible without business static IP or a cloud provider.

palata49• 2 months ago

I said it already in another comment, but if you care enough to use GrapheneOS, I believe you should not only "do without it". You should also complain to those services.

If enough people complain, those services will start caring. If all they see is "one user complains every 3 years", they will just ignore it. That's how it works.

zx8080• 2 months ago

Nice that there's bank to move to. We need regulations against such lock ups.

dwedge9• 2 months ago

Forced 2FA for banking in the EU is making this worse when it doesn't work

palata49• 2 months ago

One bank refused to work (even with Google services) so I moved bank

Banks are implementing terrible "security" checks. Users of alternative OSes should be a lot more vocal: change bank, but also complain a lot to the offending one, and make sure to leave them a bad review on the Play Store.

Actually people not using an alternative OS but caring about that should also leave bad reviews to those banks on the Play Store.

At the end of the day, the problem comes from humans in those banks who don't understand and don't give a shit. The only way to make them care about it is to complain enough that it becomes their problem.

circuit10• 2 months ago

When I had a jailbroken iPhone my bank app (HSBC) would detect it and show a warning but let you continue anyway at your own risk, which I thought was a reasonable compromise

fullstop• 2 months ago

It's a bit irritating but I'm glad I started down this journey because it looks more and more like I'm going to be avoiding the internet

I feel this more and more each day.

ghm2180• 2 months ago

This should be the way. Have a tiny burner phone for maps and any apps that you absolutely can't use without google(it should be a tiny set of < 10 apps hopefully) until you can fully de-google

My current de-google project is categorizing all my pictures on my local NAS to create the memories feature (where it shows historic pics on multiple theme axes). You can get really far with just a few hours of work a month to de-google and some off the shelf image embeddings.

The hero project in this category — what one cannot do trivially as an indie dev — is creating a great fresh PoI dataset. This is tough to do on a planetary scale because its a societal cooperation problem.

class3shock2• 2 months ago

The problem with this is gmaps. There is no alternative to it and by the nature of it knowing your location it removes anonymity. I would buy, or even pay a monthly fee, for something that is 75% as good as gmaps but respects your privacy but there is nothing out there I have found.

foltik• 2 months ago

Have you tried the Uber webapp?

paweladamczuk• 2 months ago

What do you use for calendar and tasks hosting?

I'm on a similar journey and I use Radicale.

codedokode6• 3 months ago

To be fair, there are already apps that require a mobile phone to sign up, for example, VK, Telegram. And I think Google requires to scan a QR code to register account, so it is easier just to buy a Google account on a black market if you need it for some purpose.

Nobody trusts web browsers nowadays.

danparsonson5• 2 months ago

I think you and I move in very different social circles...

I would have no idea how, nor desire to purchase a Google account on the black market, and I do in fact still trust that my web browser can do TLS correctly.

tardedmeme18• 2 months ago

I think you can just search 'buy google account' - it isn't illegal.

dredmorbius• 2 months ago

My reading of codedokode:

"easier just to buy a Google account ...." for those who would choose to do that in quantity. That is, the scammers and fraudsters for whom this is a financial decision. Which suggests that Google's latest moves shift the needle only slightly against actual abuse at a huge cost to the rest of us.

"Nobody trusts web browsers ..." applies to the publishing side. Content (that is, advertiser) sites and commerce most especially. The prove-yourself hoops that those opting out of that approach (de-Googled Android, privacy-hardened browser, alternative OS) must deal with are mind-bogglingly insane, speaking from personal experience. The Web no longer brings joy.

Incidentally, Google plays strongly in the second space, such that its incentives are aligned with pushing people into the "Google Play Services" ecosystem, and to both its own browser and ad-tech personal surveillance tools.

In conclusion, Google must be destroyed.

codedokode6• 2 months ago

I meant "corporations do not trust users who register from a web browser and not from a mobile app". Without a mobile app (which allows to collect more hardware identifiers and spam you with notifications) you are not welcome.

grishka2• 2 months ago

VK has been digging its own grave for quite some time now. Hardly anyone uses it any more. It's speedrunning enshittification with that registration thing but also with the very unpopular post redesign, the removal of custom news feeds, and most recently with shutting off most of the API access for third-party apps, including popular client apps like Kate Mobile.

dstnn• 3 months ago

Its going to be just like the wild days of the late 90s and 2000s

Strap in, the ownage will be hard.

pzmarzly• 3 months ago

Does anyone know what changed in iOS 16.5 that made Google stop requiring the app? To me it seems to correlate with Private Access Tokens, aka remote attestation by Apple. https://developer.apple.com/videos/play/wwdc2022/10077/

rippeltippel• 2 months ago

Possibly. And possibly the fact that breaking experience for iOS users would result in a massive backlash, while the volume of non-iOS/non-Android users is negligible in comparison. Some of them will convert to mainstream OSes, the rest will succumb.

djfergus• 3 months ago

What happens with Chinese Huawei phones that don’t have Google services?

omnifischer• 2 months ago

People can install Google Services in them. Once you sign into google account then you self-certify the device. https://www.google.com/android/uncertified/?pli=1

tinycommit• 3 months ago

Eww. Ok, so, I’ve used reCAPTCHA on sites I maintain at work, just on forms to prevent excessive bot spam submissions. No way do I want to subject users to this BS, though. Does anyone have recommendations for other decent captchas that could be used instead?

ksymph• 3 months ago

I run into https://www.hcaptcha.com/ and https://friendlycaptcha.com/ from time to time as a user without complaint. Can't speak to the latter but I've used the former a bit and it does the job.

BloodyIron5• 2 months ago

Any chance for something 100% self-hostable? hcaptcha and friendlycaptcha last I checked require interfacing with their services.

Velocifyer3• 2 months ago

hCaptcha is horrible. I think that a PoW captcha would be effective to make spammers just mine Monero instead.

tardedmeme18• 2 months ago

hcaptcha is pretty popular these days. It uses a very wide variety of traditional visual puzzles.

himata41134• 2 months ago

in my good ol' days I just sent a screenshot to 2captcha for grid of the entire captcha iframe which means that the solvers would have to figure out what to do instead of having to write code for each different type of captcha. to solve their new rotating puzzles I would just capture them at 50% opacity twice and change the prompt to pick the highest brightness object since 50% opacity would dim the moving elements.

Velocifyer3• 2 months ago

hCaptcha is horrible. I think that a PoW captcha would be effective to make spammers just mine Monero instead.

aprilnya• 2 months ago

Cloudflare Turnstile, if you're already using Cloudflare (or not!): https://www.cloudflare.com/application-services/products/tur...

kristianp• 2 months ago

Anubis is an alternative to captchas, it's OSS.

wasmperson• 2 months ago

Bots are usually very stupid and will bail on any captcha system they don't recognize, so anything you make that's custom and requires javascript will cull 99% of them. This may change at some point with LLMs but for now my websites at least are still holding strong.

hedora2• 3 months ago

Is there a way to just ban all these sites? Like a firefox plugin or whatever that detects this crap, and just bounces over to some place more reputable, like archive.is.

Permit• 2 months ago

It looks like archive.is uses recaptcha so I don’t think that’s the fix you’re looking for.

tardedmeme18• 2 months ago

then we make a new one

varenc• 2 months ago

I have a good friend who doesn't own a cell phone. He's a math professor. Every year he keeps living life without a smartphone, I continue to be more impressed. Things like this makes me feel like he might have to eventually give in. https://archive.is is now serving, via Cloudflare, this QR code backed CAPTCHAs. There seems no way to get past them without a smartphone. Sad times. I wonder at what point even basic government services will essentially require a smartphone.

gruez3• 2 months ago

https://archive.is is now serving, via Cloudflare

It looks like a cloudflare page but it's not hosted by them. eg. https://bgp.he.net/dns/archive.is#_ipinfo It's hosted by AS49505 JSC Selectel

j0272• 2 months ago

To add onto this, cloudflare switched away from recaptcha a while ago. https://blog.cloudflare.com/moving-from-recaptcha-to-hcaptch...

I think they now use their own Cloudflare turnstile if I remember correctly, but back then they switched to hcaptcha.

phyzome3• 2 months ago

I don't have one either. No plans to get one, even with this.

SJMG• 2 months ago

No cell phone period or no smart phone? I'm not sure how people manage the former. Do you have a home with a land line? What do you do when you travel?

eks391• 2 months ago

I envy you. Before I degoogled my life, I tried going all in to no smart phone. It didn't last very long. I still would like to get there, but considering how difficult and slow it was just to degoogle, I anticipate that it may be a long time before I can operate without a smart phone.

neilv2• 2 months ago

After all the surveillance capitalism abuses over the last 2-3 decades of Web, it's a little late to be pushing back, but... should we start shunning individuals from companies who implement this?

Whether it's from companies that create the tech, or companies that use it.

In the orgy of money, we've had a kind of industry-wide sociopathic convention of individual engineers considering it perfectly OK to further surveillance capitalism.

Can we reverse that?

If someone says we can't, because "everyone does it", are they saying that we're a field of baddies?

gregoryl• 2 months ago

I agree, wholeheartedly - lets get a list of the google engineers who worked on this. What do you propose we do with it?

userbinator10• 2 months ago

Spread the word. They need to be held accountable the same way elected officials are --- except in this case they're not even elected.

neilv2• 2 months ago

I had more the thought like being skeptical of anyone who would take a job at company Foo or stay there, when they tell you. To me that seems preferable to trying to -- what risks devolving into -- a witch hunt of fall guys (persons), and doxxing people.

I think we are already starting to have that with a couple more infamous other companies in the news the last year: if someone goes to work there, I suspect a lot of people are going to think what is wrong with you, since you must know that company does very harmful things,

Maybe it's time to start wondering that about anyone who'd work for a lot of additional companies?

(I actually had a recruiter recently who was pitching a startup, and the headline featured the "ex-" pedigrees of the founders, including an especially infamous company. I figured any company touting that pedigree as a selling point is probably a bad fit for me. I thanked the recruiter, but said that infamous company as selling point probably isn't a fit. The recruiter seemed to not only understand, but to agree with my vague sentiment about that pedigree company.)

flossposse• 2 months ago

We cannot rely on millions of individual workers to take expensive stands on principle. And they shouldn't have to. It's an essential duty for lawmakers and regulators to design the rules of the marketplace in such a way that wealth flows to those who do genuine good for the populace, and to designate certain tools and practices as off-limits because they are incompatible with our society's core values. Google's actions here are a clear antitrust violation and should be blocked/punished. If our representatives don't do so, then they should be punished.

himata41134• 2 months ago

I did something unpopular and just didn't have a captcha, I just read up on creepjs etc and rolled out my own which is just browser state analysis, basic ip check (abuse lists only) and PoW. Haven't had an issue with a single bot registration (yet).

grishka2• 2 months ago

A simple captcha with distorted characters + some hidden form fields would stop every single "opportunistic" bot.

There's hardly anything you can do to stop someone determined enough to spend money to spam your specific website. These kinds of captchas do raise the bar somewhat, but every single one of them is ultimately bypassed by paying people to solve them for you.

himata41134• 2 months ago

I rotate structures every request I made it explicitely hard to automate and I just raise the PoW during attacks. It's always about reducing volume rather than preventing it and a million registrations later it's still holding strong.

bots get pruned after an hour since 100% of the bots fall into the same trap, giving it a delay makes A/B testing really difficult and breaks most AI strategies.

alok-g• 2 months ago

Cool! I would like to hear more about this, and understand how to do the same.

himata41134• 2 months ago

https://abrahamjuliot.github.io/creepjs/ took this and made it PoW

smallerize• 2 months ago

This isn't just about weirdos (like me) who run GrapheneOS. Huawei phones don't have Google Play services installed, or Xiaomi phones with MIUI China. That's what, a billion and a half phones that can't get to your website now?

Amazon tablets don't have Google services either, which hints that the upcoming Amazon phones also might not work with this.

gene91• 2 months ago

If you need access to both apps from China and websites/apps from outside China, non-Apple devices have been difficult before this, primarily due to push notification infrastructure.

This makes it more difficult. But I don’t think it matters given how difficult it was prior to this.

ickyforce• 2 months ago

What's wrong with Apple push notifications in China?

oefrha• 2 months ago

Using apps based on Google Play Services may be impossible on those phones out of the box (not sure), but websites have no such dependency and most people don’t give a crap about push notifications from PWAs anyway so whether FCM works with the device matters little. Also doesn’t the web push API support different push services at registration time so those devices’ browsers can register their own vendor push server? (It’s been a while since I implemented web push myself, memory is fuzzy.)

This is blocking access to websites wholesale, so it’s on a whole different level.

drnick16• 2 months ago

So Stallman was right, after all?

xethos• 2 months ago

One thing I hope we've all discovered by now is that, if Stallman hasn't been proven right at the present moment, on any topic that touches on libre computing, is that it's only a matter of time until he is

quantummagic2• 2 months ago

Everyone, including Linus Torvalds, who rejected Stallman as too political or ideological, and advocated for "pragmatism" instead, is part of the reason we're where we are today. And it's going to get a lot worse, before it ever gets better.

drewfax2• 2 months ago

I wish Linus had adopted GPL v3. He had the power to stop this madness from big tech, but he sided with them. It just reveals that he never fully understood the reason for the existence of GPL in the first place.

palata49• 2 months ago

I disagree. The reason we are where we are today is the lack of antitrust.

sunshine-o3• 2 months ago

Yes he was.

But his vision/prophecy is about 50 years old and while still valid it probably needs an update.

We are now dealing with a fully networked world where AI/bots have become dominant. I am not sure he did / could go as far in his vision.

BloodyIron5• 2 months ago

I'm sorry Google, I'm afraid I can't do that.

userbinator10• 2 months ago

We told you. You dismissed it, and thought we were just crazy conspiracy theorists. Too brainwashed by the mainstream propaganda about "threats" to see the truth. Now they're even more emboldened by how much they can herd the sheeple, and showing their actual goals even more clearly.

Spread the news, tell everyone you know, before it's too late. I wish we won't have to resort to even more drastic methods in this fight.

"Those who give up freedom for security deserve neither."

userbinator10• 2 months ago

The rebellion will not spread online, in the space controlled by these bastards; but offline, outside of their control. I'm telling everyone I know, and you should too.

Here's the obligatory: Google, FUCK YOU!

koala-news• 2 months ago

The internet increasingly feels like “prove you’re using the approved computer” instead of “prove you’re human”.

balamatom• 2 months ago

Those two add up to "prove that you allow computer vendors to teach you what 'human' means".

orblivion• 2 months ago

I imagine GrapheneOS is thinking carefully about their statement on this. I look forward to reading it.

riffraff• 2 months ago

I mean, they could sue for non competitive behavior, but good luck beating Google's lawyers

palata49• 2 months ago

GrapheneOS users (and actually just citizen who care) in the EU should complain to the DMA team [1]. As with everything: the more people complain, the higher priority it gets.

[1] https://digital-markets-act.ec.europa.eu/contact-dma-team_en

gib4444• 2 months ago

On becoming anti Google, I blocked Google's ASNs (shortcut to block all their IP addresses) on my router the other day as an experiment. It's a little eye-opening.

Obviously you immediately realise just how often you !g in DDG, use Google Flights, YouTube etc. Ok easy enough to fix

Then of course I can't use Play Store (Aurora didn't work either) so my phone would have eventually become quite obsolete

You can't compile many Go projects because the dependencies are pulled from Google

And if you had ALL of Google's ASNs that would include GCP and that's a whole other level of being cut off

shevy-java• 2 months ago

This tyrannical and selfish, evil corporation, needs to be broken down. These are not accidents. Just remember how Google killed off ublock origin via a lie:

https://ublockorigin.com/

See the explanation associated with Manifest V3.

manmal2• 2 months ago

It’s quite easy to remote control an Android phone with an agent (eg there‘s agent-device). I don’t think this will keep automation from happening.

moebrowne• 2 months ago

OK, so what are the alternatives, what can developers use instead?

palata49• 2 months ago

Developers implement what they are told to implement. People who make those decisions in companies just don't give a damn, they will happily use whatever is easier/cheaper. Usually something from TooBigTech, sponsored by surveillance capitalism.

doublerabbit• 2 months ago

Create your own. Captchas have long existed on the internet. Start your own Captcha As A Service. If you've not seen the dark net some of their QR checks are inquisitive.

   >? URL: .env.project :: IP: 213.209.159.175
   >? 30326336336 :: viewer key
   >? URL: lab/.env :: IP: 213.209.159.175
   >? 39363064647 :: viewer key
   >? URL: Dr0v :: IP: 185.12.59.118
   >? 76543264647 :: viewer key
   >? URL: data/.env :: IP: 213.209.159.175
   >? 63623731628 :: viewer key
   >? URL: docker/app/.env :: IP: 213.209.159.175
   >? 62653061304 :: viewer key
   >? URL: fedex/.env :: IP: 213.209.159.175
   >? 61663064656 :: viewer key

   [09/May/2026:11:31:32] notice: exiting: exceeded max connections per thread

Above is verbose from my honeypot. Some security camera network has been hacked and is being used for net thrifting in Romania.

The internet is a failure. Congratulations us.

pixel_popping10• 2 months ago

It feels ultra sad that "developers" think they need to use reCaptcha? What is this lazyness, it's not even good on top of that at what it does, recaptcha cost less than $1/1000 to solve automatically, it's also slow, crappy, bad UI.

Even competent people got completely brainwashed, crazy.

holoduke• 2 months ago

One positive thing about tools like Claude is that I can finally do things where I had originally no time for. For example I asked Claude to debloat windows. Remove everything possible. From firewalls to notepad to uac to whatever. I also asked Claude to root my pixel phone and install another OS. I also asked to install pihole on a old Mac to serve as a dns and block all ads. All this took maybe an hour of my time.

stuaxo• 2 months ago

Anti competitive behaviour ?

palata49• 2 months ago

People running de-Googled phones chose those setups because they read the data practices, understood what Play Services phones home about, and decided they didn’t consent.

This is wrong. Many (most?) users of alternative Android OSes do use a variant of the Play Services (be it sandboxed Play Services like on GrapheneOS, or an open source, reverse engineered implementation like microG that phones home just the same).

Google seems to be leveraging Play Integrity here, which requires that the phone OS is signed by Google. This is clearly anticompetitive, I hope the DMA will do something about that.

mnadkvlb• 2 months ago

Exactly. Imagine them blocking captchas on iphone or windows

thayne3• 2 months ago

IIUC, They are blocking it on windows, unless you have an android or iOS device you can use to complete the "captcha"

bjackman2• 2 months ago

There is a fundamental tension here though - suppose DMA or something requires that online providers recognise reCAPTCHAs from non-Google-attested OS builds. What OSs can they safely trust?

Only ones that are difficult for fraudsters to use to generate bogus traffic. Whether or not those builds come from Google, they are inherently gonna be pretty constrained OSs. It's not gonna let you spoof your location or simulate user input.

I do think it's a problem if only Google can provide these attestations but even if that organisation problem is solved there is still a fundamental technologic problem here now that humans can't be detected by their ability to solve puzzles any more.

surajrmal4• 2 months ago

Arguably anyone else who can provide a similar level of trustworthy authentication that they are not a bot can work with Google to get support. Fundamentally this is a trust based problem and only OS providers are even capable of building such systems. There are very few of those out there. The key is that the systems need to be locked down to prevent automation of input and that automatically disqualifies most android alternatives that the community likes. It's clear that Apple offers this capability though. I can imagine a more locked down version of Windows also providing this in the future.

sneak2• 2 months ago

Wanting to load a webpage anonymously is not something that makes one a “fraudster”.

Zak• 2 months ago

What OSs can they safely trust?

None. The first rule of network security is you can't trust the client.

All attempts at remote attestation of consumer devices are someone wanting to break this rule. It's always a mistake; the OS being on the blessed list raises the difficulty level for fraud a little, but serious fraudsters have already perfected workarounds.

db48x• 2 months ago

I long ago stopped using any webpage that uses a captcha. If the website uses one, I bounce.

sylware• 2 months ago

Wait, you need a TPM chip?

I don't know what services a TPM chip does provide. Wild guess, some private keys, hidden to the computer user, are used to sign stuff and/or encrypt ?

pavel_st• 2 months ago

this is going to keep happening across every trust layer google rolls out

the trajectory has been clear since AMP-convenience for site owners, attestation pressure on users

paulnpace• 2 months ago

I wonder if any of these sites will see any meaningful drop in users, or if they even care.

tosti• 2 months ago

Next phone I'm buying won't be able to run android if I can help it.

Verify that.

(edit: and it definately won't be an iphone, although that would fit the description above, those only run non-free software by design)

uyzstvqs• 2 months ago

Luckily Google reCAPTCHA seems to be dying. Almost everything uses Cloudflare Turnstile, hCaptcha, or some form of a PoW challenge now.

I'd go as far as to say that still having Google reCAPTCHA on your website is a sign of your website being unmaintained. Half of them even have the "reCAPTCHA is changing terms, take action" text on them.

This move will cause the last users to stop using it, and reCAPTCHA will be on the "Killed by Google" list in a year or two.

morissette• 2 months ago

Can’t like companies do what they want, or did we let the fascists take over?

AdityaAnuragi• 2 months ago

Doesn't surprise me — I've hit undocumented Android Chrome behavior too while working with the Vibration API (more advanced usage by a very large margin). The browser/OS layer on Android has a lot of silent, unannounced behavior.

anymouse123456• 2 months ago

I worked at Google. I know there are tons and tons of great and well meaning people working there. This is the kind of thing that would make me crazy.

People there be like, “but I’m not evil! I’ll never do anything bad with all of this incredible power!”

But if you create a nuclear bomb, someone unsavory is going to wrest control of that power from your stupid little painted fingernails and destroy the rest of us with it.

How about, don’t make an effing privacy nuclear bomb if you don’t want to contribute to making the world more evil?

comandillos• 2 months ago

that reinforces me using HarmonyOS - nothing against Graphene btw -. It's impressive how difficult is to actually use any platform apart from the stablished ones normally these days.

aftbit• 2 months ago

Sigh...

Incompatible browser extension or network configuration

jaimex2• 2 months ago

Delete Chrome and use Brave. Problem solved.

redbell• 2 months ago

From the screenshot in the article "Troubleshoot reCAPTCHA Mobile Verification":

To complete the mobile verification, you must use a compatible mobile device.

At first glance, reading this made me wonder: what is exactly a compatible mobile device? But they quickly answered this question just below:

If verifying on iOS/iPadOS...
If verifying on Android device with Google Play Services...

OK then, got it! These are the ONLY compatible mobile devices. No de-googled devices are being welcomed here.

Google broke reCAPTCHA for de-googled Android users

Related Stories