Elektrine lite

← Feed

@WPalant@infosec.exchange

Post #2960322

2026-05-21 19:40 UTC

RE: https://mstdn.social/@jschauma/116610268796045193 So many levels of wrong here. Google’s newest reCAPTCHA “experiment“ tells people to scan a QR code in order to verify that they are human. Yeah, like scanning a QR code displayed by some random website is a good idea in the first place. But of course your ability to scan the code isn’t what verifies your human nature. That QR code merely tells you that you need the reCAPTCHA app (on iOS) or newest Google Play services (on Android). In other words, you have to verify that you own a mobile device and are providing data to Google. Which they promise not to share with the website, like that’s what I’m worried about. This obviously excludes people who don’t have a smartphone, have a de-Googled smartphone or simply don’t want to feed their data to Google. And it again ties a large chunk of the web to Google services. If reCAPTCHA wasn’t evil before (a questionable statement), it definitely is now.

Replies (16)

  • @dpnash@c.im 2026-05-21 20:07

    @WPalant@infosec.exchange Just barely an hour ago, I got a phish simulation training email at work that *contained a QR code* with the usual urgent call to action to “do the thing”, in this case, scanning a booby-trapped QR code. Jeezus, Google.

    Open ##3164421

  • @WPalant@infosec.exchange or are blind

    Open ##3164424

  • @ihayes@mastodon.au 2026-05-21 23:13

    @WPalant@infosec.exchange this is so easy to scam Google should be ashamed of even suggesting it.

    Open ##3164425

  • @odr_k4tana@infosec.exchange 2026-05-21 23:30

    @WPalant@infosec.exchange yeah. The main issue regarding Google's recent actions is that they are doing everything to become a digitally gated community that everyone needs to do basic things. Once you're in, there's no getting out. It's dystopian but it's what they're doing. Google, the everything app.

    Open ##3164426

  • @huntingdon@mstdn.social 2026-05-21 23:34

    @WPalant@infosec.exchange As I frequently say, fuck Giggle. It's as rapacious as Donald Trump.

    Open ##3164427

  • @acs@mastodon.scot 2026-05-21 23:43

    @WPalant@infosec.exchange so if I understand correctly we are to prove we're human by using a non-human to read an image which is specifically designed to be very easy for a non-human to read. 😱🫣

    Open ##3164428

  • @WPalant@infosec.exchange Closes tab.

    Open ##3164430

  • @nosenkow@mastodon.social 2026-05-22 00:44

    @WPalant@infosec.exchange something like “show we 10 fingers on your hands to prove you are human” 🤦‍♂️ Hint: I personally have only 9 🤷‍♂️ — ‘cos It’s live 🤷‍♂️

    Open ##3164432

  • @Reinald@nrw.social 2026-05-22 04:35

    @WPalant@infosec.exchange do they display that only on PC/Mac Web-Browsers? Or do you get that thing on mobile devices as well?

    Open ##3164433

  • @svenja@mstdn.games 2026-05-22 06:04

    @WPalant@infosec.exchange its also not accessible for me anymore, because I have a hard time scanning QRCodes because I am blind. Wow, now I hate captchas even more.

    Open ##3164436

  • @arjen@idf.social 2026-05-22 06:15

    @WPalant@infosec.exchange if there is one thing you don't do better than a computer as a human, it is reading the qr code, must be a scam!

    Open ##3164442

  • @zollak@bonn.social 2026-05-22 08:53

    @WPalant@infosec.exchange Does this even stop spammers/bots when they have one of the mobile phone farms with racks full of phones? It shouldn't be too hard to just use one of these phones for a quick scan and might even be less effort than solving a captcha?

    Open ##3164444

  • @chewie@mammut.gogreenit.net 2026-05-22 10:48

    @WPalant@infosec.exchange I had to do one yesterday, but I used the audio function, where it read out 2 and a half (wtf?) words. I typed in the 2 understandable words, and it worked 💪

    Open ##3164446

  • @WPalant@infosec.exchange Not to mention people who have a Smartphone that doesn't suck - erm, I mean that isn't running Android or iOS.

    Open ##3164447

  • @calcius@hol.ogra.ph 2026-05-23 18:21

    @WPalant@infosec.exchange The point of forcing interaction onto devices is because apps can gather more data, as how the app interacts with the OS on the device is much more opaque. As far as captchas are concerned I've been waiting for them to take over from pdfs as an attack vector for years.

    Open ##3164448

  • @spuug@furry.engineer 2026-05-25 08:09

    @WPalant@infosec.exchange How does one scan a QR code that is being displayed on ones mobile device screen? I haven't figured that out yet.

    Open ##3164449