Hacker News

worth noting that google/twitter/facebook/reddit/others colluded to combine sessions, identifiers, so that any person getting identified on any one session / ip would be identified on all

so while this comment is apt, i would ask them what they think of the previous chicxulub impact of the 2012 era collusion - which to this day has not been reported on

(just realized emacs bindings work in comments, nice, no ctrl-x tho)

If you run a website, it seems trivial to forward the attestation to someone else by putting the same code up on your website, and getting their device banned from google instead of your own.

When companies like this exist, what is the point of relying of TPM? Looks like the future is bright for VC backed bots

https://doublespeed.ai/

Stop visiting sites and using services that use reCAPTCHA. Problem solved.

> My understanding is that this new reCAPTCHA is basically just remote attestation.

Yes, somehow "parse this QR code" would not have made my top 500,000 list of 'tasks that a human can do more effectively than a computer'.

I don't see any requirement to support hardware attestation in the recaptcha documentation, the Play Services seem to be "enough".

I think it's most likely to be attested by Google remotely; they might be using an app (with enormous access to the phone as the Play Services have) to be able to link a ton of data together, possibly including the local activity on the phone, officially to make better humanity assessments based on it all.

For people using a Google account it probably won't make a huge difference, in terms of data collected.

If that's how it would work, spoofing would probably be theoretically possible, but it would be easy for Google to detect attestations used by multiple people.

Let's not forget that this is an update to a very approximate system, absolute security is not (yet) required.

But there's a good chance that it will be extremely hard to sidestep, despite that.

Shouldn't that be illegal under GDPR?

> Google didn’t demand iPhone users install Google software to pass the test.

Can de-Googled Android phones present themselves as iPhones?

[dead]

My setup is similar and nearly 100% self-hosted, including email, files, AI. If something does not work on Graphene, I will do without it. I also have a Google profile, mostly for testing purposes.

If you don't mind me asking, what Bank? I've resolved that this phone will be my last googled phone, and my next will be GrapheneOS.

What's the best alternative for Google drive? I also went this route but Samba is a bit annoying sometimes

Nice that there's bank to move to. We need regulations against such lock ups.

For me this archive.is thing has been unusable for a long time already, because they rely on Google Captcha for a long time already and I block Google shit by default. Allowing Google is probably equivalent to showing them your id, due to fingerprinting in the name of "safety". That's why archive.is is not helpful and usually just a tab I close again right away.

Interesting, the text says "reCAPTCHA doesn't share your details with this site", but it says nothing about sharing your details with Google. Which means yes?

I just tried using archive.is on my non-degoogled phone using IronFox instead of Chrome and could not pass the recaptcha. Actually it presented me the mobile attestation on second try, but I was able to switch to images again. But I am also unable to pass that one with the tracking protections built into the browser. Hopefully some 'serious' website starts using this so I can bomb their customer support.

The water is already boiling and the frog can't get out anymore.

I thought archive.is were the ones squabbling with Cloudflare (extreme simplification)

You can still use the audio captcha, but I’m not sure how long that’ll be around.

i wondered the same earlier and i am pretty sure they are just mimicking cloudflare's validation page. no way that cloudflare is paying reCAPTCHA when they have theor product, turnstile, available.

What? Don't Cloudflare literally have their own CAPTCHA service? Why are they using reCAPTCHA?

> https://ibb.co/X9Q6Y84

Wow, This is really bad :-(

I think this is just gonna make viewing internet without a phone significantly harder especially with archive.is and the likes.

Not sure, how relevant this is to the discussion but if it helps, I have made a project[0] which allows to archive archive.is pages on archive.org/wayback machine (this uses singlefile)

Perhaps something like this can be used by community at scale too. Also, I hope that archive.is does something to fix this issue of requiring QR code and hopefully it doesn't become a permanent issue.

[0]: https://smileplease.mataroa.blog/blog/htmlpipe-and-how-we-ca...

As someone that uses AI agents, this makes me want to install a browser plugin for "public windows" that just archives everything I see, and then farms out clicks of content that are missing from those sites.

The result of this would be to upload it all to a bot-friendly alternative to archive.org.

It doesn't fundamentally solve anything. You want to be able to identify a specific person or at least a relatively expensive device so that if you ban them they stay banned.

The article mentions that they use Private Access Tokens on iOS, so I'm not sure where you're getting the idea that they're "not adopting" them from

Private access tokens are also a repackaged WEI as far as I'm concerned.

"pretended" ... do they even care any more?

Not Invented Here Syndrome?

How you know this is a monopoly is that if you go on their documentation website half the video is how this rolls into Google Analytics.

This is using another product to reinforce the search and ads monopoly.

You can’t scrape content to build a better google or Gemini, you can’t make an OS to compete with Google or Apple, and you can’t make a Google Analytics competitor.

It’s plain anti competitive.

The governments are the ones who needs the most. They want to know who all the potential and current dissidents are.

I agree. There are pretty clear grounds here to think about opening an investigation here into illegal tying, or a misuse of market power. Not sure if the FTC maintains a presence on here, but if you're listening...

Instead, our governments use this crap, meaning on .gov sites too, and impose it upon us.

Oh man as if we still live in those times

"Don't be evil. That's our job."

If you need access to both apps from China and websites/apps from outside China, non-Apple devices have been difficult before this, primarily due to push notification infrastructure.

This makes it more difficult. But I don’t think it matters given how difficult it was prior to this.

I run into https://www.hcaptcha.com/ and https://friendlycaptcha.com/ from time to time as a user without complaint. Can't speak to the latter but I've used the former a bit and it does the job.

Cloudflare Turnstile, if you're already using Cloudflare (or not!): https://www.cloudflare.com/application-services/products/tur...

hcaptcha is pretty popular these days. It uses a very wide variety of traditional visual puzzles.

> https://archive.is is now serving, via Cloudflare

It looks like a cloudflare page but it's not hosted by them. eg. https://bgp.he.net/dns/archive.is#_ipinfo It's hosted by AS49505 JSC Selectel

I don't have one either. No plans to get one, even with this.

They're only doing that because the EU currently doesn't want to antagonize US any more with their tech fines. Noticed how there hasn't been any as of recently?

AI Studio playground maybe? It seems all integrated.

There really isn't much of an option. Apple's just as bad if not worse.

Motorola + GrapheneOS next year could be an alternative. So far they've been relatively insulated from the changes that have been coming down from Google.

You won't be alone. I've resolved that this will be my last Googled phone.

My dad runs the family domain/emails/etc. The hard part will be convincing him to degoogle the whole family.

I'm inclined towards keeping an ancient android for those apps that require it, and maybe something open for actual use. Or perhaps a crappy old android for android and a small non-android tablet/laptop for daily-driver stuff, which always works better as a computer anyway!

I'm also becoming open to using software that lies to google about what it is :) Google will treat us like sh*t, why shouldn't we reciprocate.

I've been getting asked more and more how to degoogle stuff by non-nerds.

Android yes, but Graphene is the answer.

Those two add up to "prove that you allow computer vendors to teach you what 'human' means".

Possibly. And possibly the fact that breaking experience for iOS users would result in a massive backlash, while the volume of non-iOS/non-Android users is negligible in comparison. Some of them will convert to mainstream OSes, the rest will succumb.

Everyone, including Linus Torvalds, who rejected Stallman as too political or ideological, and advocated for "pragmatism" instead, is part of the reason we're where we are today. And it's going to get a lot worse, before it ever gets better.

One thing I hope we've all discovered by now is that, if Stallman hasn't been proven right at the present moment, on any topic that touches on libre computing, is that it's only a matter of time until he is

Yes he was.

But his vision/prophecy is about 50 years old and while still valid it probably needs an update.

We are now dealing with a fully networked world where AI/bots have become dominant. I am not sure he did / could go as far in his vision.

Same reason as "make another (better) windows" is very difficult - almost everyone wants to be able to run existing apps and drivers, so you're forever playing compatibility catchup with android (or windows).

That's the reason companies are desperate to be first/biggest - once you're it, you're it until you finally fall on your face and dwindle to a nobody.

and that is gonna be funded by who? anyone who is gonna fund that is gonna want their slice of the pie. we need regulation to keep big tech in line

Mobian, PureOS, postmarketOS already exist. Sent from my Librem 5.

Ugh I hate that I can't tell whether you are being sarcastic or not.

The fallback is that you get redirected to a website helpfully demanding you buy a Google- or Apple-vetted smartphone: https://support.google.com/recaptcha/answer/16609652.

You will also see this page if your smartphone is degoogled and you try to open the reCAPTCHA attestation URL in a web browser instead of in Google Play Services.

> Sites that use reCAPTCHA/Turnstile/etc. have already been broken for me for years now due to neverending captcha/refresh loops.

I had this problem recently with the Indeed website. (Cloudflare Captcha)

Thanks to someone on Reddit, it was discovered that anyone using a Chromium based browser (Brave, Vivaldi, etc.) on Linux was being punished.

Awfully frustrating having to set up a Virtual Machine just to be able to access one website via Firefox since even my hardened Firefox was being punished.

Almost would bet one or a few of your ISP's customers have their connections being used as residential VPNs.

I know people like to think of suspicious android box setups but even a lot of "free" apps, extensions and other such services scarily seem to do that duty these days. I'm sure I'm preaching to the choir here, but its sad how many people will use some free of cost vpn and not even think why that might be.

This is why I ended up paying extra for a static IP from my ISP. While they always provided me with a public IP outside a CGNAT, I guess whole IP blocks were being targeted by these web security providers.

I guess my ISP allocates static IPs from a separate pool, and probably my IP block neighbors are better behaved (probably SMBs and other fellow nerds), aside from platforms learning that my IP is safe.

Captcha difficulties are way down now.

Turnstile feels bad as a user. Every site that I’ve seen it long will lock up Safari hard while it’s doing whatever it’s doing. But at least I haven’t run into more than 2 refresh loops.

> I just take my business elsewhere...

Mars? /i

I have not been able to visit AliExpress for months now. Just an endless reCAPTCHA loop.

I wonder if they are seeing a decrease in traffic and somehow find that acceptable.

Oh man I feel you. I turn my VPN off on certain sites due to the captcha loop.

Wouldn't a 1£ Linux VM as Wireguard access point suffice?

whenever I can't access a website for various stupid blocks

I fire up cloudflare warp and walk right through it

use wireguard with wgcf in environments without cloudflare client

yeah it's stupid we have to do this in 2026 but I guess cloudflare is the new AOL garden

The Government reviewed the Google situation on behalf of you,

and on behalf of the Government,

and said “data, so piss off”:

https://abcnews.com/Technology/google-hit-antitrust-lawsuit-...

https://macdailynews.com/2026/02/04/u-s-files-appeal-in-goog...

warfare*

I mean, they could sue for non competitive behavior, but good luck beating Google's lawyers

It looks like archive.is uses recaptcha so I don’t think that’s the fix you’re looking for.

It's all fun until you can't get paid because some fintech app doesn't work. That's why we need regulations. I don't see politicians ever going against an advertising company when they're customers.

What do you use instead? iOS?

I think you and I move in very different social circles...

I would have no idea how, nor desire to purchase a Google account on the black market, and I do in fact still trust that my web browser can do TLS correctly.

The rebellion will not spread online, in the space controlled by these bastards; but offline, outside of their control. I'm telling everyone I know, and you should too.

Here's the obligatory: Google, FUCK YOU!

Not soon, now. The new reCAPTCHA on desktop shows you a QR code for you to scan with your Google-approved phone to prove you have one.

A parallel, fully public and accessible internet being widespread and available for anyone with a slight tinkering kick... Could actually be really awesome.

Let the commerce-driven, corporatized hellhole that the modern web has become eat itself.

What a coincidence that Windows 11 makes it a requirement!

TPMs can also be based on free software and our own keys. It works well with Heads and Librem Key.

People can install Google Services in them. Once you sign into google account then you self-certify the device. https://www.google.com/android/uncertified/?pli=1

Treatment is not a cure.

I agree, wholeheartedly - lets get a list of the google engineers who worked on this. What do you propose we do with it?

We've banned this account. This is an utterly appalling comment.

The article was at #1 on the frontpage when you posted this.

I’d just like to interject for a moment. What you’re referring to as “Android,” is in fact Android/Linux, or as I’ve recently taken to calling it, Android plus Linux kernel.

Linux is not an operating system unto itself, but rather a kernel—a core component that manages hardware resources. Android uses the Linux kernel, but replaces the traditional GNU userland with its own runtime, libraries, and system framework.

Many users run Linux-based systems every day without realizing it. Through a peculiar turn of events, the Linux kernel combined with Android’s userspace is often simply called “Android,” and many of its users are not aware that it is built on Linux at its core.

There really is Linux in Android, and these people are using it, but it is just a part of the system they use. Linux is the kernel: the program in the system that allocates the machine’s resources to the other programs you run. The kernel is an essential part of the system, but useless by itself; it can only function in the context of a complete operating system.

Android is normally used in combination with the Linux kernel: the whole system is basically Android/Linux, a Linux-based operating system with a distinct userspace, not a GNU/Linux system like traditional desktop distributions.

The kernel is a Linux kernel. The userspace is very different from a typical Linux distribution.

Android literally is a Linux distro, though. Like, sure it has a weird userspace and is user hostile, but that doesn't make it not a Linux distro.

It's the punishment for all the times people laughed at calling regular Linux "GNU/Linux".

Unless it was in a previous iteration of the submission's title, I don't see Linux mentioned anywhere.