I saw this coming from miles away. Computers are better at solving CAPTCHAs than people are and people can be bribed or convinced to join botnets so IP whitelisting doesn't work either. Now we have tons of fingerprinting and behaviour analysis but governments are cracking down on that. Plus, YouTube had a massive ad fraud problem with ads being played back in the background in embedded videos, so their detection clearly wasn't good enough.
There aren't many good ways to prove you're not a bot and there are even fewer that don't involve things like ID verification.
Their opt-in approach helps shift the blame to individual web stores for a while, so who knows if this will take off. But either way, in the long term, the open, human internet is either going away or getting locked behind proofs of attestation like this.
Apple built remote attestation into Safari years ago together with Cloudflare and Google is now going one step further, as Apple's approach doesn't work well against bots that can drive browsers rather than scripted automation tools.
Luckily, their current approach can be worked around because it's only targeting things like stores now and you can buy things from other stores. Once stores find out that click farms have hundreds of phones just tapping at remotely served content, uptake will probably be limited.
It'll be a few years before this is everywhere, but unless AI suddenly isn't widely available anymore, it's going to be inevitable.
> saw this coming from miles away. Computers are better at solving CAPTCHAs than people are
good point... it's interesting how Captcha was initially popularized as a reverse Turing test, but it's just variants of Proof of Work today.
And it seemed clever at the time for Google to leverage this for improvement of their OCR models (it was!), and makes you wonder what utility is derived from the proven "work" today.
CAPTCHAs were designed as a type of Turing Test, not a reverse Turing Test. And it’s not surprising at all that their effectiveness has declined now that AI can pass the Turing Test.
I personally think its easier to detect llm controlled browser sessions, the people deploying them are far more naive and inexperienced than traditional scrapers/crawlers.
insert You wouldn't bring a 40 Petabyte Zip Bomb to School, would you? meme
Whether it's AMP or manifest 3 or android source shenanigan or attempts to replace cookies with their FLOC nonsense or this...Google is rapidly turning into a malicious force when it comes to the open internet
Strange analogy considering that RMS got to where he is precisely by finding nails to hit much, much more than occasionally, and much, much more than most hammers.
If RMS said not to trust Google's self-proclaimed altruism and relationship with open source, yeah. I always assumed that was a backstab waiting to happen. But that only meant I used an iPhone and didn't care that it was more closed than Android, not that I got an Arch Linux phone or something. (And a Mac more importantly, but there's not really a Google counterpart to that.)
Last time this happened we got a bunch of Google employees downplaying the impact of WEI and calling it a nothingburger, that people were being hysterical. I just checked, and everyone I saw defending it has since left the company. I'm sure another wave of Google managers, keen to appeal to the higher-ups, will be here to defend this new initiative any minute now.
Google was creating cartels like the "Open Handset Alliance" literally decades ago.
Via their control of Chrome and Search which are both monopolies, Google holds absolute authority on how websites are rendered and if websites can be found.
Lost? No, they shoveled search into the furnace day after day as they prioritized sewage like paid results, link farms, and blog spam while burying the actual result far below, if returned at all. LLM showed up and gave you the direct answer you wanted in <1s; you don't even have to read the shitty troll result page.
It cracks me up when people say Chrome is a monopoly, because a massive amount of computing devices do not even ship with Chrome. Windows computers, Macbooks, and iPhones require users go search out and install Chrome on their own out of their own volition, shipping with entirely functional and decent browsers out of the box that they have lots of patterns to push. Even many Android phones ship with browsers other than Chrome as a default still from what I understand.
How is Chrome, of all things, a monopoly? Have words just entirely lost all meaning and now monopoly just means "things which are popular that I dislike"?
Why do you keep talking about who installs the app? That has nothing to do with whether something is a monopoly, which is primarily about market share.
Chrome is a monopoly by extending the internet in ways that force users into chrome. Due to market share and Google's prevalence, they have the sway to introduce things that cannot meaningfully be avoided without extreme siloing.
Outside of WebUSB I personally haven't meaningfully been impacted in any ways. Can you share which ways this is?
Note, this is separate from a "so many things are just Chromium", which I agree is an issue, but isn't the same as a "Google Chrome is a monopoly". Because in the end there are still many non-Chrome browsers which support WebUSB which do not end up with a lot of the downsides of Chrome specifically about Google harvesting your data and what not.
> You know full well what people mean when they say "Chrome"
Yeah, Chrome, the web browser made by Google that bugs you to sign in with your Google Account. Most people don't mean Microsoft Edge when you say "Chrome". Do you call Microsoft Edge "Chrome"?
Chrome is a product made by Google that is a web browser. If the argument is Chromium is too interwoven, that's a separate argument.
But even then, what does it mean that "Chromium is a monopoly"? Is Linux a monopoly as well? Why or why not?
Note you haven't actually given me any other ways one would be impacted like I asked. What are the other majorly missing features Chrome pushes that other browsers don't have that most sites require? What else am I missing by not using a non-Chromium-based browser?
As someone else said earlier, it is a monopoly by extending the internet in ways that force users into using their browser engine. Due to market share and Google's prevalence, they have the sway to introduce things that cannot meaningfully be avoided without extreme siloing.
> What are the other majorly missing features Chrome pushes that other browsers don't have that most sites require?
This is a different question, please don't move the goalposts.
I’m constantly badgered by google apps on my iPhone to use Chrome. In fact I’m not able to just click a link and open my default browser, I have to see the big chrome logo and a smaller link to choose my default browser.
Ever thought about just not using those apps if you want to avoid the Google ecosystem? Too bad there's just absolutely no mapping application available on iPhone but Google Maps. Too bad there's no way to send an email on an iPhone outside of Gmail.
What's that? A user has to once again go out of their way to install those apps as well? Well isn't that strange. I thought Google was a monopoly on iPhones.
You'd be better off mentioning Safari (17% of users vs. Chrome's 68% and Firefox's 2.2%) and Bing (10% vs Google's 85% and DDG's 1.7%). But nice to know there are two of us!
It's not just Google. It's governments, corporations, all around the world, simultaneously. The noose is being tightened gradually, then all at once. And it's coming for all of us:
The threats above interlock by design or convergence:
Identity layer (1-5) creates the prerequisite for the others. Once identity is established at SIM/account/device level, the carve-outs that make surveillance politically viable become possible (powerful users get exemptions; ordinary users get watched).
Device layer (10-12, 16-19) creates the surveillance endpoint. Once content is scanned on the device before encryption, the cryptographic protections at the communications layer become irrelevant.
Communications layer (6-9) is the most-defended. Mass scanning has been defeated repeatedly. This is the layer where the resistance has the best track record.
Reporting layer (13-15) is nascent. Direct OS-to-government reporting hooks haven't been built yet at scale. The UK's December 2025 proposal is the leading edge.
Platform control (20-24) determines whether alternatives can exist. Browser diversity, app distribution diversity, and engine diversity are the structural protections. All three are narrowing.
A society with all five layers complete has the technical infrastructure for total surveillance with elite carve-outs. We are roughly 40% of the way there. Whether that infrastructure becomes a dystopia depends on political choices, not technical ones.
HN as a whole is surprisingly oblivious to the noose tightening, because many here are super against decentralized distributed things, if they involve any sort of token. You can complain all you want, but downvoting and burying the decentralized alternatives just for groupthink makes you somewhat complicit in the erosion of our privacy and liberties. Even if you might disagree with a project, all the work that goes into it might be a good reason to upvote it instead, considering that without this work, we're basically doomed.
I said 16 years ago that when IPV6 was coming into use was the only reason for a 128 bit address space was so they could tie every packet on the internet back to you as a person. https://news.ycombinator.com/item?id=1464940
> HN as a whole is surprisingly oblivious to the noose tightening, because many here are super against decentralized distributed things, if they involve any sort of token. You can complain all you want, but downvoting and burying the decentralized alternatives just for groupthink makes you somewhat complicit in the erosion of our privacy and liberties. Even if you might disagree with a project, all the work that goes into it might be a good reason to upvote it instead, considering that without this work, we're basically doomed.
Hi chatgpt please point to where HN shat on decentralized alternatives (and I doubt you will because you're a D&C bot).
I refer you to all my own comments about decentralized solutions, which you can see in my history. And the posts that have been flagged after amassing too many upvotes. I think that's sufficient.
I'm amused at how thoroughly Google adopted Microsoft's playbook. Chrome supplanted Internet Explorer by embracing the open web. But then Google immediately started on extensions, and now they're trying to extinguish the open web with nonsense like Cloud Fraud Defense. All very smoothly done. I mean, people are actually _asking_ for this junk. I'm impressed.
No they didn't. Firefox unseated Internet Explorer. Chrome then got big by putting its installer right on the Google homepage and harassing users to install it. And they had it bundled with other software, and would install as a user so that locked down computers could still run it. They absolutely did not win by embracing open standards.
Chrome has gone off doing their own standards to some extent, but you're forgetting what it was like when Internet Explorer dominated. You basically couldn't use the web without IE because they broke so many standards and implemented them in closed source. Then there was ActiveX on top, straight up Windows binaries in web. And besides there being a dominant engine, only one browser could use that engine. Trading that for Chrome dominance was at least a step up.
I use Firefox right now. Occasionally I need to open a site in Chrome instead, but it's rare.
> Firefox usage share grew to a peak of 32.21% in November 2009, with Firefox 3.5 overtaking Internet Explorer 7, although not all versions of Internet Explorer as a whole;
Firefox was the browser that embraced open standards and was unseating IE. And ActiveX was used for corporate stuff, not general web sites, so the main reason it died was that Microsoft gave up.
Chrome and v8 was just stupidly faster than any other browser and JS stack at the time when I first adoped it. It was a lot buggier in many other ways and many sites just didn't work quite right at the time, but the tradeoff on performance in the early days was very much worth it.
People forget that Sundar Pichai's entire claim to success at Google was injecting the Google Toolbar into the Adobe Reader installer which would hijack your search and browsing data on IE, and the launch of Chrome, which was then also injected into the Adobe Reader installer, occurred because Google was concerned IE might block or limit their toolbar.
People absolutely did like Google at the time, but the majority of its growth is actually shoveling hijackers into other software installs just like BonzaiBuddy.
I recommended everyone to use Chrome simply because Microsoft couldn't be bothered to provide built in PDF viewing and creation.
There was a good, long period where Microsoft just decided to let the market run amok with malware for critical software, instead of providing something like Preview on macOS. As a result, the safest option for most lay people was to use Chrome, where they could quickly and easily view, and most important, save pdfs of websites, receipts, etc.
Then, once MacBook Airs were solidified + iPhone, I started recommending people use macOS simply because Preview could edit PDFs and easily allow signing them.
I haven't used Windows in a very long time, so I assume it's still the same situation.
Yeah I remember when Windows lacked every basic utility that Mac OS had. The most common malware was PDF readers, because a very common search was "how to open pdf." Same with zip.
Lots of supposedly technically advanced users switched to Chrome en masse and promoted it on every occasion they could, because it was so much faster, simpler, safer, etc etc. Don't excuse useful idiots from their share of the blame. People warned about dangers of Chrome's growing domination for about as long as I can remember, back to at least 2012, only to be dismissed as paranoid.
If I may tie this into other things going on, The California wealth tax as written would force Larry and Sergei, if they didn't move out of California, to basically sell almost their entire stake in Google, and it would probably wind up owned by State Street and Vanguard who outsource their proxy votes to ESG consultants, who will probably vote for more surveillance.
what alternative to WEI do you propose? it solves a bajillion Internet-existential problems. it is definitely a crisis. the bot problem is at least as serious as facebook, gmail serving without https.
the fact that this kind of comment gets downvoted proves my point. so what if you personally don't like WEI? it doesn't mean the problems aren't real...
that aside, i don't know how people say stuff like "malicious force" and then you go and use a bajillion Google-authored, completely free as in beer and often free as in freedom technologies that nobody obligates you to use at all. It's not like Apple, where their software is so shitty (Messages, Apple Photos, etc.) that the only reason people use it is because it is locked down and forced upon you. it's interesting to me that @dang worries about the tenor of conversation changing - he longs for that 2009 world of university-level math people hanging out and writing comments about LISP or whatever - when the real deficit is not intelligence about math but, at the very least, seeing that things are nuanced, to see more sides to a problem besides the most emotionally powerful and the most mathematically neutral ones.
From "Don't be evil" to building the largest, most invasive, surveillance operation the world has ever seen.
That was true before this, but this indicates nothing will ever be enough. Google will always want to track more of everyone's activity online, and will use every tool at their disposal to do it.
Yeah, same. It is hard; we start to need a collective boycott.
We can all do our part, by using their products as little as possible, contribute to open alternatives (OpenStreetMap, Fediverse, Linux, Nextcloud...) and by stimulating our (non-techie!) friends and family.
I wouldn't hold your breath. The government is reliant on them for surveillance, censorship, and propaganda. It is a synergistic relationship, not adversarial.
It should have been the government providing an identity verification API, like they already do in the physical world with physical IDs. Governments dropped the ball, and so now Apple and Google get to be infrastructure.
Do you think identifies never need to be verified? Seems like a central function in operating an accountable society, hence birth certificates, passports, etc.
There should not be a requirement to verify identity, but if a website owner only wants to provide access to their website to people with verified identities, why is that not their right?
The US government is a feckless facade, the US is a corporation run economic zone. The nice thing about being corporate run is that the rulers are unelected and unaccountable!
We cannot vote with our wallets because there’s no real competition. That’s the problem with the big tech companies and other monopolistic companies in other areas.
Everything that gets money from ads. The network effects are too strong for competition against their ads platform and their ability to do targeted advertising based on data only they have. You can’t build a new ads platform and then use that to monetize your company’s other services, because the existing ad networks are so mature and established.
Phones. Your choice is Apple or Google.
As you said, YouTube. Again, they have users and creators in one place, so it’s hard for a new platform to compete.
There are also a lot of enterprise contracts that bundle many things together. Like cloud and their workplace apps (whatever it is now called).
But also, just their size is a problem. Look at their AI story. First off, many customers get forced into packages where they get Gemini included as part of the bundle (which means they’re paying for it automatically and have less of a reason to pay for something else). But also - Google was slow to build useful products here. Even though they are late and made many failed attempts like Bard, they can afford to take losses for years that no small company - or maybe even large companies that aren’t mega corps - can absorb. Those other competitors would go out of business and have to be careful and move slowly in spending. But Google’s capital lets them make mistake after mistake but still compete and eventually win. So it’s not a fair competition.
These days every time a government as much as thinks of imponging on a supranational corporation's right to do whatever the hell it pleases you'll hear no end of cries ranging from "overregulation" to "tyranny".
The technical challenge is actually the smaller one. The real one is to get people to care. Don't be tricked by the HN/techie bubble. Most people don't understand the problem, or don't see it as a problem because nothing smacked them in the face yet. Any attempts to explain it makes you sound like a lunatic to some, or just a bit of a worrier to others.
Whether it's targeted ads, or training AI on their data, or verifying their age and implicitly identity, or "fraud defense", most people happily take it in exchange for a convenient freebie which is why things keep escalating.
It's understandable, people are assaulted with all kinds of abuses from every direction. There are more immediate threats that they can grasp more easily so this stuff has to wait its turn.
> Most people don't understand the problem, or don't see it as a problem because nothing smacked them in the face yet.
Or don't approach the world with a fundamental mindset of having agency to (help) fix things they see as broken. Just because people see something as bad doesn't mean they inherently see a bright flashing line from that to "so I should do something about it rather than accept it".
IMO the biggest issue is that some non-tech people will occasionally be straight up hostile and will whine about not having "features", but then again it only takes a small amount of people taking action inflict real change. Also medium term we need to start making phones (smart OR dumb) that are FOSS as possible.
> Linux
Open/FreeBSD too, we need to have more redundancy.
But remember: once again, don't simply get angry at Google the institution. Get angry at Page and Brin personally. They have the power to prevent this, a power they were careful to preserve when they gave Google its IPO. They are fully responsible for Google's choices here. But, partly because they aren't constantly jumping up and down drawing attention to themselves on social media, they've tended to escape the same personal scrutiny given to eg. Elon Musk. That needs to end.
You think systems that have adblockers installed will keep being able to pass WEI / Google Cloud Fraud Defence checks?
This is an attestation scheme. Attestation is about controlling what software you are and aren't allowed to run. If a future version of this allows desktop browsers rather than just phones, it will almost certainly try to do similar forms of attestation, and prevent you from controlling your own software stack.
The problem is this type of controlling move, that will be used to benefit their company, is one among many things a company like Google can do that is unethical. They won’t stop. They are too powerful and can get away with it repeatedly. Even if this one thing is stopped, there will always be another dark pattern or another privacy violation or another anti-competitive thing.
We really need brand new legislation that makes it much easier to break up companies that are too big, and also to tax mega corporations at a much higher rate than all other companies. Then we can have fair competition and the power of choice. But the existing laws end up with no real consequence for these companies, and even if there’s some slap on the wrist, it takes years in court. New laws must make it very fast and low cost for society to take action.
This is truly disturbing, and trying to sneak it in like this without public discussion is disingenous. Hopefully it will be shot down like last time - at the very least, there are surely antitrust issues here.
Last time they tried this they laundered it though an employee's personal github to distance it from google itself, then framed the proposal in the most disingenuous manner possible, as if it was something that users wanted rather than another mechanism for google to exercise control
Maybe a dumb question, but how is this suppose to work for iphone users? They wont have google play, and it seems like android/google play is required here? There is no way they would cut out such a huge chunk of the market.
hacker news when discovering that apple deployed WEI, for ages, with beloved IT company Cloudflare, affecting hundreds of millions of users: "aww, you're sweet"
hacker news when reading that google is doing the same thing for the rest of the userbase: "hello, human resources?"
The claim is that an iPad/iPhone will also work. Not that that makes it acceptable; if anything, it's worse, because if it were Google Play only it'd be more obvious how unacceptable it is, whereas catering to the duopoly makes it less obvious how much it excludes people and builds a reliance on proprietary systems.
One company can soon dictate who can enter the websites.
And only two commercial operating systems are viable in the world after this change.
Not nice.
I believe the latest versions of iOS just work from the browser, you only need to install the app for older versions of the OS.
I don't know what technology they're using, but when I scanned the QR code it launched (downloaded?) an iOS app of sorts with one tap, similar to the way Google tried Instant Apps a few years back. Didn't even need to double tap the power button like usual.
Are you genuinely asking? To pay your taxes, order items online, access your bank account, log into your favorite AI service, there are very often CAPTCHAs involved. Try going a month with CAPTCHAs blocked in uBlock Origin, and you will find yourself unable to do many basic things.
Not saying this is any better, but IRS partnered with id.me to enforce ID + face recognition before you can log in to view your records. We are truly doomed.
Even besides services you might need to access, as pointed out in another response (e.g., banks, shops), how are you going to check the veracity and understand the context of the information you seek without going to the (possibly hallucinated!) sources? But I guess a lot of people who are into using AI like that just don't care.
This API also works on the desktop. In fact, you can't use this system without a phone if your browser isn't Google enough.
We are going to see sooooo many scams out there. No wonder Google is locking down third party Android apps outside of their control, getting a user to install "device verification.apk" will become super trivial after people have clicked through these popups a couple times.
A device I have no choice in owning because modern employers assume you have sometime to install an authenticator app on. That's what it is for me. Also, sadly, it's an anchor for Signal. Otherwise I don't use the stupid thing.
A smart phone _could_ be legitimate and free and open, but in practice it's not. This is a constraint based on the reality of the market, not really based on what is strictly possible with the technology. I don't get too deep into this, but at a very high level, this is what I dislike about smartphones.
- Touchscreen user interface is objectively worse than a mouse and keyboard. Portability is the the only benefit to this interface, but this also works strongly to attack impulse control. It's always on you, just a moment away.
- Smartphones are significantly worse for privacy. In a LOT of ways. We can discuss this if you're interested.
- Many smartphone apps exist solely because a website would be less addicting and would also not be able to collect as much data as an app. ie, it's a choice that's worse for you and better for the company.
- They're significantly less open. Yes, grapheneOS and other alternatives exist, however it's not like a computer where I can just install whatever I want without asking the provider permission to unlock the device.
- I touched on this in two other bullets, but it's worth highlighting here: they're built intentionally to be addictive.
- The operating system and hardware are effectively interlocked. (yes, I know grapheneOS exists) but for any modern thing you might actually require a smartphone for (banking app, OTP app, etc) you must be using Apple or Google.
- Providers don't produce security updates well enough; Apple is "better" here, but my 10-15 year old computer can run modern Linux. People brag about 7 years of support on an iPhone. I'm under the impression that Android is better than it used to be, but in the old days any random vendor would give you about 1 year of update support and then you'd be hosed running old Android until you bought a new phone.
- Nobody cares if I own a desktop computer or not, but it's getting to the point that businesses will not work with me unless I have a modern smartphone.
I could probably go on, but I really hate these things.
Yeah I'm aware of all of this, it's just the framing that confused me. A lot of these boil down to "nobody should own or use a smart phone to do anything" which is a bit of a different and less specific pitch than "nobody should browse the web on a smart phone".
It is, just like a calculator is a small computer. It's not a personal computing device though, in the sense that the user can't develop and deploy their own software/tools on it.
No one should ever browse the web from an ESP32 either. Like seriously the dark patterns are bad enough from a desktop where you've actually got the screen real estate to see the whole page, have other sites open for comparison, have a keyboard to type your own notes, etc. Most browsing can simply wait, especially the adversarial-commercial type we're talking about here.
I think this is the third HN link I've clicked on in a row that leads to an LLM-generated article. I'm not opposed to AI, but I'm tired of seeing it quietly substituted for human thought and expression.
Look at the number of : per paragraph. What human puts two : in a single sentence?
"One additional failure worth noting: one incident response professional in the HN thread, raised a concern that operates independently of the bot problem: …"
The ersatz Ted Talk meets LinkedInfluencer rhythm of sentences, the throat clearing fillers as connective tissue…
1. The high number of (em) dashes is suspect, though it's unclear whether they manually replaced the em dashes or is actually human generated.
2. "One additional failure worth noting: one incident response professional in the HN thread, raised a concern that operates independently of the bot problem" feels out of place for a content marketing piece. HN isn't popular enough to be invoked as a source, and referencing it as "the HN thread" seems even weirder, as if the author prompted "write a piece about how google cloud defense sucks, here are some sources: ..."
3. This passage is also suspect because it follows the chained negation pattern, though it's n=1
>No hardware identifier is transmitted. No attestation is required. No certification layer determines who may participate.
edit:
I also noticed there are 2 other comments that are flagged/dead expressing their reasons.
The entire article is just one long stream of short, punchy, declarative sentences. The latest Claude models are notorious for writing like this.
There's also a few cookie-cutter patterns that should immediately jump out at you if you're at all familiar with AI writing, such as:
> No hardware identifier is transmitted. No attestation is required. No certification layer determines who may participate. User privacy is structurally preserved, not promised.
> Google Cloud Fraud Defense is not a reCAPTCHA update. The QR code is the visible mechanism, but device attestation is the real product.
We see the fundamental forces of capitalism at work: To justify valuation, Google needs to grow. When they feel a ceiling, they broaden their search to anything legal that makes customers pay - even if it contradicts their longterm interests. This created countless attack angles for startups.
The good news: we already have a solution! Monopoly laws. In case of the internet, no company should be able to have this much power.
The bad news: US decided to weaponize big tech’s leverage over the world and does not enforce these laws anymore that fix vanilla capitalism.
>We see the fundamental forces of capitalism at work: To justify valuation, Google needs to grow.
You’re confusing markets with capitalism.
Market Socialism (the only reasonable kind) would have these same issues. If Google was owned by the workers instead of capitalists, it would still have incentive to grow. The worker owners would have the exact same incentives as current owners. The only difference would be who the owners are.
Capitalism is not actually “the final boss” that internet leftists make it out to be. Socialism is not the panacea that leftists make it out to be. Surveillance is not a “capitalist only” thing.
I think the idea is good if it could actually curb bot traffic that currently plagues the Internet.
However, a lot of recent bot traffic are sophisticated scrappers called "LLM's." You can tell claude to "research X from this www.example.com" and will automatically scrape it and summarize it, something that a LLM is perfect for. Gemini tends to share links instead, presumably because most of Google's revenue comes from ads served on those websites, so if it completely killed the traffic to those websites it would just make less money. Incidentally, I wonder if Claude/Gemini use an search engine-like "index" of all websites or it refuses to cache anything to always fetch "fresh" data.
If this is employed, I don't think the web is only going to be gatekept to Google devices. I think it will also be gatekept to Google's AI's.
Google would be able to display a captcha that no LLM could defeat, and then just let its own LLM pass through.
The same could be said about its other bots, such as the web crawler. Google's bot could crawl webpages that no other crawler would ever be able to simply because it has free pass to captcha-gated GETs. Although the same could be true already today.
Their product page is full of info about how this works with "agentic" cruft. They're still permitting your regular old scrapers and bots for as long as they like you. Hope you're not thinking of running an independent system instead of a large cloud platform!
We do need to abandon the reality where we use the same few companies on a daily basis and get back to what's now hidden the under-the-surface: forums, blogs, personal websites. We need to re-discover the "free" internet we used to have before Facebook and smartphone dystopia happened.
For example:
> Bot operators point a camera at a screen, a trivial automation with off-the-shelf hardware. For operations that need Play Integrity attestation specifically, a compliant Android device costs approximately $30 at current market prices
A bot farm cannot bypass for long with a $30 phone. Do you seriously think that if Google sees the same hardware identifier 1000s of times a day they are not going to consider that usage to be fraud?
I appreciate that Google's made a real proposal to avoid the web becoming bottomless AI slop. This article hasn't come with a better alternative - I'd love to see one!
> Do you seriously think that if Google sees the same hardware identifier 1000s of times a day they are not going to consider that usage to be fraud?
Phones are very cheap, especially refurbished phones. Just have the phones mimic real life sleep/wake cycles and take occasional breaks. Use 25% more devices to account for the loss in uptime.
Besides, some people (often unemployed or disabled, and possibly with sleep disorders or mania) actually don’t do anything other than scroll on their phone all day and night. So you can’t rely on this as a good signal without creating even more blowback. And you really don’t want too much blowback from troubled people who have infinite free time.
It is particularly funny because this is content marketing for a computational proof of work "captcha". Those are pure snakeoil, with economics that are probably at least four orders of magnitude more favorable to the abusers than this attestation would be.
I'm pretty sure that the Ai copied the $30 number from my hacker news comments. However in the USA it is true. https://www.walmart.com/ip/Straight-Talk-Motorola-Moto-g-202... (carrier locks don't matter for this usecase.)
I am not sure that that storing unique device identifiers is legal in the EU.
I remembered $30 from some comment I read, but didn't look for it later. If it was yours, thank you! (def. thank you for the Wallmart link! - would you like a credit in the blogpost like a quote?
Water use and mass displacement of labor get all the attention but there are so many other more subtle reasons like this that AI is going to be bad for society.
I disagree that this kind of scheme is inevitable. We can "evit" it through thoughtful discussion, foresight, alternative mitigations, and even regulation. Certainly, Google can choose to avoid it. On the other hand, the AI bubble will inevitably burst, since compute is not free. I look forward to post-bubble AI.
> We can "evit" it through thoughtful discussion, foresight, alternative mitigations, and even regulation
Such as? I don't see how regulation would apply here without concrete technical solutions that enforce it. So what alternative mitigations do you have in mind?
Among many other things: Regulate the use of AI to imitate or impersonate human activity. Regulate AI crawling/scraping. Ban scraping entirely, and all models based on it. Regulate maximum model size.
These wouldn't eliminate the problem, but they'd change it from "many people do this" to "this is always a malicious attack, react accordingly".
None of those would work without enforcement. Scams are banned, but that doesn't stop Chinese mafia from operating prison camps that run scams scamming people all around the world.
Given all the negative comments here - what is anyone's alternate solution for AI-driven fraudulent activity?
CAPTCHAs are increasingly ineffective. Services are either going to go offline or implement some kind of system like this. PII like credit cards or SSNs aren't enough because those are regularly stolen.
So where do things go? Fewer services and infinite fraud?
It will be fewer accessible services for everyone who refuses to use this, that's for sure. In general though, service providers are not going to accept "fewer services and infinite fraud" and thus they will look into implementing this.
This doesn’t even solve the problem thanks to device farms. There’s not really a solution for this short of aiming a camera at someone’s retina 24/7 plus a fully locked down hardware path. And even that would surely be compromised given enough incentives.
People are just going to have to find a new way to monetize. Maybe more things will become paywalled, or sponsored long-term like old TV shows. Again, there’s no good way to solve this, and the “solutions” on offer just contribute to the surveillance state without solving the problem.
I don't know which activity you're referring to, but why are you trying to discriminate between humans and bots? Because bots don't pay? So demand payment.. Demand like payment per account creation, then set appropriate rate limits per account.
As much as I hate whatever google's doing, this article has some issues:
>For operations that need Play Integrity attestation specifically, a compliant Android device costs approximately $30 at current market prices
This assumes the logic on google's side is something like `if(attestationResult == "success") allow()`, but it's not hard to imagine the device type being factored into some sort of fraud score. For instance, expensive devices might have a lower fraud score than cheaper devices, to deter buying a bunch of cheap devices. They might also analyze the device mix for a given site, so if thousands of Chinese phones suddenly start signing up for Anne's Muffin Shop, those will get a higher fraud score.
>Firefox for Android does not appear in Google’s stated browser support list for Fraud Defense.
The browser only needs to show a QR code, so if you're on firefox mobile they'll either open a deeplink to google play services on the phone itself, or show a qr code.
>One human solving a single challenge pays a negligible cost. A bot farm running concurrent sessions faces exponential compute costs with each additional attempt - and AI agents, which consume GPU cycles to operate, face identical penalties regardless of how sophisticated their reasoning is.
PoW for bot protection basically never caught on because javascript performance is poor, and human time is worth more than a computer's time. An attacker doesn't care if some server has to wait 10s to solve a PoW challenge, but a human would. An 8-core server costs 10 cents per hour on hetzner. Even if you assume everyone has a 8-core desktop-class CPU at their disposal (ie. no mobile devices), a 6 minute challenge would cost an attacker a penny. On the other hand how much do you think the average person values 6 minutes of their time?
I saw this coming from miles away. Computers are better at solving CAPTCHAs than people are and people can be bribed or convinced to join botnets so IP whitelisting doesn't work either. Now we have tons of fingerprinting and behaviour analysis but governments are cracking down on that. Plus, YouTube had a massive ad fraud problem with ads being played back in the background in embedded videos, so their detection clearly wasn't good enough.
There aren't many good ways to prove you're not a bot and there are even fewer that don't involve things like ID verification.
Their opt-in approach helps shift the blame to individual web stores for a while, so who knows if this will take off. But either way, in the long term, the open, human internet is either going away or getting locked behind proofs of attestation like this.
Apple built remote attestation into Safari years ago together with Cloudflare and Google is now going one step further, as Apple's approach doesn't work well against bots that can drive browsers rather than scripted automation tools.
Luckily, their current approach can be worked around because it's only targeting things like stores now and you can buy things from other stores. Once stores find out that click farms have hundreds of phones just tapping at remotely served content, uptake will probably be limited.
It'll be a few years before this is everywhere, but unless AI suddenly isn't widely available anymore, it's going to be inevitable.
> saw this coming from miles away. Computers are better at solving CAPTCHAs than people are
good point... it's interesting how Captcha was initially popularized as a reverse Turing test, but it's just variants of Proof of Work today.
And it seemed clever at the time for Google to leverage this for improvement of their OCR models (it was!), and makes you wonder what utility is derived from the proven "work" today.
CAPTCHAs were designed as a type of Turing Test, not a reverse Turing Test. And it’s not surprising at all that their effectiveness has declined now that AI can pass the Turing Test.
I personally think its easier to detect llm controlled browser sessions, the people deploying them are far more naive and inexperienced than traditional scrapers/crawlers.
insert You wouldn't bring a 40 Petabyte Zip Bomb to School, would you? meme
Whether it's AMP or manifest 3 or android source shenanigan or attempts to replace cookies with their FLOC nonsense or this...Google is rapidly turning into a malicious force when it comes to the open internet
Turns out RMS has always been right. How surprising.
Indeed, occasionally hammers do find nails to hit.
Strange analogy considering that RMS got to where he is precisely by finding nails to hit much, much more than occasionally, and much, much more than most hammers.
The analogy works if you think of RMS as a nailgun.
A nailgun hitting nails? This is going nowhere..
well it drives nails, we've lost the plot!
If RMS said not to trust Google's self-proclaimed altruism and relationship with open source, yeah. I always assumed that was a backstab waiting to happen. But that only meant I used an iPhone and didn't care that it was more closed than Android, not that I got an Arch Linux phone or something. (And a Mac more importantly, but there's not really a Google counterpart to that.)
Last time this happened we got a bunch of Google employees downplaying the impact of WEI and calling it a nothingburger, that people were being hysterical. I just checked, and everyone I saw defending it has since left the company. I'm sure another wave of Google managers, keen to appeal to the higher-ups, will be here to defend this new initiative any minute now.
> rapidly becoming
Always has been.
Google was creating cartels like the "Open Handset Alliance" literally decades ago.
Via their control of Chrome and Search which are both monopolies, Google holds absolute authority on how websites are rendered and if websites can be found.
They lost their search monopoly when LLMs came.
Lost? No, they shoveled search into the furnace day after day as they prioritized sewage like paid results, link farms, and blog spam while burying the actual result far below, if returned at all. LLM showed up and gave you the direct answer you wanted in <1s; you don't even have to read the shitty troll result page.
It cracks me up when people say Chrome is a monopoly, because a massive amount of computing devices do not even ship with Chrome. Windows computers, Macbooks, and iPhones require users go search out and install Chrome on their own out of their own volition, shipping with entirely functional and decent browsers out of the box that they have lots of patterns to push. Even many Android phones ship with browsers other than Chrome as a default still from what I understand.
How is Chrome, of all things, a monopoly? Have words just entirely lost all meaning and now monopoly just means "things which are popular that I dislike"?
Why do you keep talking about who installs the app? That has nothing to do with whether something is a monopoly, which is primarily about market share.
Chrome is a monopoly by extending the internet in ways that force users into chrome. Due to market share and Google's prevalence, they have the sway to introduce things that cannot meaningfully be avoided without extreme siloing.
Outside of WebUSB I personally haven't meaningfully been impacted in any ways. Can you share which ways this is?
Note, this is separate from a "so many things are just Chromium", which I agree is an issue, but isn't the same as a "Google Chrome is a monopoly". Because in the end there are still many non-Chrome browsers which support WebUSB which do not end up with a lot of the downsides of Chrome specifically about Google harvesting your data and what not.
Ah, the "this doesn't fit my very specific technicality argument"
You know full well what people mean when they say "Chrome"
> You know full well what people mean when they say "Chrome"
Yeah, Chrome, the web browser made by Google that bugs you to sign in with your Google Account. Most people don't mean Microsoft Edge when you say "Chrome". Do you call Microsoft Edge "Chrome"?
Chrome is a product made by Google that is a web browser. If the argument is Chromium is too interwoven, that's a separate argument.
But even then, what does it mean that "Chromium is a monopoly"? Is Linux a monopoly as well? Why or why not?
Note you haven't actually given me any other ways one would be impacted like I asked. What are the other majorly missing features Chrome pushes that other browsers don't have that most sites require? What else am I missing by not using a non-Chromium-based browser?
> what does it mean that "Chromium is a monopoly"
As someone else said earlier, it is a monopoly by extending the internet in ways that force users into using their browser engine. Due to market share and Google's prevalence, they have the sway to introduce things that cannot meaningfully be avoided without extreme siloing.
> What are the other majorly missing features Chrome pushes that other browsers don't have that most sites require?
This is a different question, please don't move the goalposts.
> by extending the internet in ways that force users into using their browser engine
And yet after multiple times of me asking you've yet to give me a single real feature lost.
> This is a different question
Its literally the thing you're saying is the problem, how is it a different question entirely?!
Do you actually think the majority of everyone else is being just as pedantic (or cares) about Google Chrome vs chromium-based?
For most, for the purposes of market share (the type of "monopoly" I believe they are referring to), I think they count it as one and the same.
Do most people call Microsoft Edge or Safari "Chrome"?
Are the security and privacy implications the same for Edge, Safari, and Chrome?
Seems to me like they're still quite different products despite having some similar codebases!
I’m constantly badgered by google apps on my iPhone to use Chrome. In fact I’m not able to just click a link and open my default browser, I have to see the big chrome logo and a smaller link to choose my default browser.
> by google apps on my iPhone
Ever thought about just not using those apps if you want to avoid the Google ecosystem? Too bad there's just absolutely no mapping application available on iPhone but Google Maps. Too bad there's no way to send an email on an iPhone outside of Gmail.
What's that? A user has to once again go out of their way to install those apps as well? Well isn't that strange. I thought Google was a monopoly on iPhones.
and even the iPhone Chrome doesn't use the Chromium engine, it's Safari under the hood
> Windows computers
Ship with a chromium fork called Edge
> Chrome and Search which are both monopolies
I'm on Firefox and use DuckDuckGo.
You'd be better off mentioning Safari (17% of users vs. Chrome's 68% and Firefox's 2.2%) and Bing (10% vs Google's 85% and DDG's 1.7%). But nice to know there are two of us!
Don't you see it closing all around you?
It's not just Google. It's governments, corporations, all around the world, simultaneously. The noose is being tightened gradually, then all at once. And it's coming for all of us:
https://community.qbix.com/t/increasing-state-of-surveillanc...
The threats above interlock by design or convergence: Identity layer (1-5) creates the prerequisite for the others. Once identity is established at SIM/account/device level, the carve-outs that make surveillance politically viable become possible (powerful users get exemptions; ordinary users get watched).
Device layer (10-12, 16-19) creates the surveillance endpoint. Once content is scanned on the device before encryption, the cryptographic protections at the communications layer become irrelevant.
Communications layer (6-9) is the most-defended. Mass scanning has been defeated repeatedly. This is the layer where the resistance has the best track record.
Reporting layer (13-15) is nascent. Direct OS-to-government reporting hooks haven't been built yet at scale. The UK's December 2025 proposal is the leading edge.
Platform control (20-24) determines whether alternatives can exist. Browser diversity, app distribution diversity, and engine diversity are the structural protections. All three are narrowing.
A society with all five layers complete has the technical infrastructure for total surveillance with elite carve-outs. We are roughly 40% of the way there. Whether that infrastructure becomes a dystopia depends on political choices, not technical ones.
HN as a whole is surprisingly oblivious to the noose tightening, because many here are super against decentralized distributed things, if they involve any sort of token. You can complain all you want, but downvoting and burying the decentralized alternatives just for groupthink makes you somewhat complicit in the erosion of our privacy and liberties. Even if you might disagree with a project, all the work that goes into it might be a good reason to upvote it instead, considering that without this work, we're basically doomed.
I said 16 years ago that when IPV6 was coming into use was the only reason for a 128 bit address space was so they could tie every packet on the internet back to you as a person. https://news.ycombinator.com/item?id=1464940
> HN as a whole is surprisingly oblivious to the noose tightening, because many here are super against decentralized distributed things, if they involve any sort of token. You can complain all you want, but downvoting and burying the decentralized alternatives just for groupthink makes you somewhat complicit in the erosion of our privacy and liberties. Even if you might disagree with a project, all the work that goes into it might be a good reason to upvote it instead, considering that without this work, we're basically doomed.
Hi chatgpt please point to where HN shat on decentralized alternatives (and I doubt you will because you're a D&C bot).
I refer you to all my own comments about decentralized solutions, which you can see in my history. And the posts that have been flagged after amassing too many upvotes. I think that's sufficient.
I'm amused at how thoroughly Google adopted Microsoft's playbook. Chrome supplanted Internet Explorer by embracing the open web. But then Google immediately started on extensions, and now they're trying to extinguish the open web with nonsense like Cloud Fraud Defense. All very smoothly done. I mean, people are actually _asking_ for this junk. I'm impressed.
No they didn't. Firefox unseated Internet Explorer. Chrome then got big by putting its installer right on the Google homepage and harassing users to install it. And they had it bundled with other software, and would install as a user so that locked down computers could still run it. They absolutely did not win by embracing open standards.
Chrome has gone off doing their own standards to some extent, but you're forgetting what it was like when Internet Explorer dominated. You basically couldn't use the web without IE because they broke so many standards and implemented them in closed source. Then there was ActiveX on top, straight up Windows binaries in web. And besides there being a dominant engine, only one browser could use that engine. Trading that for Chrome dominance was at least a step up.
I use Firefox right now. Occasionally I need to open a site in Chrome instead, but it's rare.
Chrome didn't solve that though. Quoth Wikipedia:
> Firefox usage share grew to a peak of 32.21% in November 2009, with Firefox 3.5 overtaking Internet Explorer 7, although not all versions of Internet Explorer as a whole;
Firefox was the browser that embraced open standards and was unseating IE. And ActiveX was used for corporate stuff, not general web sites, so the main reason it died was that Microsoft gave up.
Eh, it was brief and never majority. Chrome was the first to truly usurp IE.
Chrome and v8 was just stupidly faster than any other browser and JS stack at the time when I first adoped it. It was a lot buggier in many other ways and many sites just didn't work quite right at the time, but the tradeoff on performance in the early days was very much worth it.
People forget that Sundar Pichai's entire claim to success at Google was injecting the Google Toolbar into the Adobe Reader installer which would hijack your search and browsing data on IE, and the launch of Chrome, which was then also injected into the Adobe Reader installer, occurred because Google was concerned IE might block or limit their toolbar.
People absolutely did like Google at the time, but the majority of its growth is actually shoveling hijackers into other software installs just like BonzaiBuddy.
I recommended everyone to use Chrome simply because Microsoft couldn't be bothered to provide built in PDF viewing and creation.
There was a good, long period where Microsoft just decided to let the market run amok with malware for critical software, instead of providing something like Preview on macOS. As a result, the safest option for most lay people was to use Chrome, where they could quickly and easily view, and most important, save pdfs of websites, receipts, etc.
Then, once MacBook Airs were solidified + iPhone, I started recommending people use macOS simply because Preview could edit PDFs and easily allow signing them.
I haven't used Windows in a very long time, so I assume it's still the same situation.
Yeah I remember when Windows lacked every basic utility that Mac OS had. The most common malware was PDF readers, because a very common search was "how to open pdf." Same with zip.
I recall Chrome being a superior browser in the early days, prompting many to switch and evangelizing it.
It was the first to do a separate process per tab, which had security and stability benefits. But it also used like 2x the RAM from the start.
Lots of supposedly technically advanced users switched to Chrome en masse and promoted it on every occasion they could, because it was so much faster, simpler, safer, etc etc. Don't excuse useful idiots from their share of the blame. People warned about dangers of Chrome's growing domination for about as long as I can remember, back to at least 2012, only to be dismissed as paranoid.
If I may tie this into other things going on, The California wealth tax as written would force Larry and Sergei, if they didn't move out of California, to basically sell almost their entire stake in Google, and it would probably wind up owned by State Street and Vanguard who outsource their proxy votes to ESG consultants, who will probably vote for more surveillance.
what alternative to WEI do you propose? it solves a bajillion Internet-existential problems. it is definitely a crisis. the bot problem is at least as serious as facebook, gmail serving without https.
the fact that this kind of comment gets downvoted proves my point. so what if you personally don't like WEI? it doesn't mean the problems aren't real...
that aside, i don't know how people say stuff like "malicious force" and then you go and use a bajillion Google-authored, completely free as in beer and often free as in freedom technologies that nobody obligates you to use at all. It's not like Apple, where their software is so shitty (Messages, Apple Photos, etc.) that the only reason people use it is because it is locked down and forced upon you. it's interesting to me that @dang worries about the tenor of conversation changing - he longs for that 2009 world of university-level math people hanging out and writing comments about LISP or whatever - when the real deficit is not intelligence about math but, at the very least, seeing that things are nuanced, to see more sides to a problem besides the most emotionally powerful and the most mathematically neutral ones.
From "Don't be evil" to building the largest, most invasive, surveillance operation the world has ever seen.
That was true before this, but this indicates nothing will ever be enough. Google will always want to track more of everyone's activity online, and will use every tool at their disposal to do it.
Exactly my thoughts. I am unfathomably angry and I want to contribute to any effort to dismantle Google as a company.
Yeah, same. It is hard; we start to need a collective boycott.
We can all do our part, by using their products as little as possible, contribute to open alternatives (OpenStreetMap, Fediverse, Linux, Nextcloud...) and by stimulating our (non-techie!) friends and family.
But it is a lot of work :(
It should not be a "vote with your wallet" situation. It should be governments shattering that organization into appropriately sized companies.
I wouldn't hold your breath. The government is reliant on them for surveillance, censorship, and propaganda. It is a synergistic relationship, not adversarial.
It should have been the government providing an identity verification API, like they already do in the physical world with physical IDs. Governments dropped the ball, and so now Apple and Google get to be infrastructure.
"Don't worry! I'm from the government and I'm here to ~~help~~ identify you to everyone else on the planet."
That's no better, and in many ways far worse, than the corpos doing it.
Do you think identifies never need to be verified? Seems like a central function in operating an accountable society, hence birth certificates, passports, etc.
There should not be a requirement to verify identity, but if a website owner only wants to provide access to their website to people with verified identities, why is that not their right?
The US government is a feckless facade, the US is a corporation run economic zone. The nice thing about being corporate run is that the rulers are unelected and unaccountable!
We cannot vote with our wallets because there’s no real competition. That’s the problem with the big tech companies and other monopolistic companies in other areas.
In what area is there no real competition? I can think of real competition in everything Google does with the possible exception of YouTube.
Everything that gets money from ads. The network effects are too strong for competition against their ads platform and their ability to do targeted advertising based on data only they have. You can’t build a new ads platform and then use that to monetize your company’s other services, because the existing ad networks are so mature and established.
Phones. Your choice is Apple or Google.
As you said, YouTube. Again, they have users and creators in one place, so it’s hard for a new platform to compete.
There are also a lot of enterprise contracts that bundle many things together. Like cloud and their workplace apps (whatever it is now called).
But also, just their size is a problem. Look at their AI story. First off, many customers get forced into packages where they get Gemini included as part of the bundle (which means they’re paying for it automatically and have less of a reason to pay for something else). But also - Google was slow to build useful products here. Even though they are late and made many failed attempts like Bard, they can afford to take losses for years that no small company - or maybe even large companies that aren’t mega corps - can absorb. Those other competitors would go out of business and have to be careful and move slowly in spending. But Google’s capital lets them make mistake after mistake but still compete and eventually win. So it’s not a fair competition.
These days every time a government as much as thinks of imponging on a supranational corporation's right to do whatever the hell it pleases you'll hear no end of cries ranging from "overregulation" to "tyranny".
For an example, see EU's GDPR, DMA etc.
They're trying to block your ability to boycott. https://en.wikipedia.org/wiki/Anti-BDS_laws
Those are specifically targeted to boycotts of Israel, which ties it to anti-racial discrimination law.
It's less work than 10 years ago. So many much more mature alternatives.
The technical challenge is actually the smaller one. The real one is to get people to care. Don't be tricked by the HN/techie bubble. Most people don't understand the problem, or don't see it as a problem because nothing smacked them in the face yet. Any attempts to explain it makes you sound like a lunatic to some, or just a bit of a worrier to others.
Whether it's targeted ads, or training AI on their data, or verifying their age and implicitly identity, or "fraud defense", most people happily take it in exchange for a convenient freebie which is why things keep escalating.
It's understandable, people are assaulted with all kinds of abuses from every direction. There are more immediate threats that they can grasp more easily so this stuff has to wait its turn.
> Most people don't understand the problem, or don't see it as a problem because nothing smacked them in the face yet.
Or don't approach the world with a fundamental mindset of having agency to (help) fix things they see as broken. Just because people see something as bad doesn't mean they inherently see a bright flashing line from that to "so I should do something about it rather than accept it".
IMO the biggest issue is that some non-tech people will occasionally be straight up hostile and will whine about not having "features", but then again it only takes a small amount of people taking action inflict real change. Also medium term we need to start making phones (smart OR dumb) that are FOSS as possible. > Linux Open/FreeBSD too, we need to have more redundancy.
> Yeah, same. It is hard; we start to need a collective boycott.
Feelgood slactivism. They don't care about your boycott. They finance their own alternatives because they know what makes you shut up.
But remember: once again, don't simply get angry at Google the institution. Get angry at Page and Brin personally. They have the power to prevent this, a power they were careful to preserve when they gave Google its IPO. They are fully responsible for Google's choices here. But, partly because they aren't constantly jumping up and down drawing attention to themselves on social media, they've tended to escape the same personal scrutiny given to eg. Elon Musk. That needs to end.
On that topic, I would highly recommend you to switch to Kagi!
Search is still their workhorse for ad revenue. Less search, less users, in addition to users now just asking chatgpt and co, will hurt them well
Wouldn’t installing an adblocker basically hurt them as much / more as I still cost them compute but don't get them that sweet ad money?
You think systems that have adblockers installed will keep being able to pass WEI / Google Cloud Fraud Defence checks?
This is an attestation scheme. Attestation is about controlling what software you are and aren't allowed to run. If a future version of this allows desktop browsers rather than just phones, it will almost certainly try to do similar forms of attestation, and prevent you from controlling your own software stack.
The problem is this type of controlling move, that will be used to benefit their company, is one among many things a company like Google can do that is unethical. They won’t stop. They are too powerful and can get away with it repeatedly. Even if this one thing is stopped, there will always be another dark pattern or another privacy violation or another anti-competitive thing.
We really need brand new legislation that makes it much easier to break up companies that are too big, and also to tax mega corporations at a much higher rate than all other companies. Then we can have fair competition and the power of choice. But the existing laws end up with no real consequence for these companies, and even if there’s some slap on the wrist, it takes years in court. New laws must make it very fast and low cost for society to take action.
I strongly suggest people move away from chrome. They lost all sense of respect.
I know it is a small move, but as it happened when chrome started, this opens opportunities for other players
This is truly disturbing, and trying to sneak it in like this without public discussion is disingenous. Hopefully it will be shot down like last time - at the very least, there are surely antitrust issues here.
Last time they tried this they laundered it though an employee's personal github to distance it from google itself, then framed the proposal in the most disingenuous manner possible, as if it was something that users wanted rather than another mechanism for google to exercise control
I do wonder how people who work on this don't see themselves as the bad guy.
They have blinders on made out of money.
Maybe a dumb question, but how is this suppose to work for iphone users? They wont have google play, and it seems like android/google play is required here? There is no way they would cut out such a huge chunk of the market.
Apple has device attestation deployed like one year before Google even proposed it: https://httptoolkit.com/blog/apple-private-access-tokens-att...
hacker news when discovering that apple deployed WEI, for ages, with beloved IT company Cloudflare, affecting hundreds of millions of users: "aww, you're sweet"
hacker news when reading that google is doing the same thing for the rest of the userbase: "hello, human resources?"
The claim is that an iPad/iPhone will also work. Not that that makes it acceptable; if anything, it's worse, because if it were Google Play only it'd be more obvious how unacceptable it is, whereas catering to the duopoly makes it less obvious how much it excludes people and builds a reliance on proprietary systems.
One company can soon dictate who can enter the websites. And only two commercial operating systems are viable in the world after this change. Not nice.
iPhone users will have to install the "reCAPTCHA" app. https://apps.apple.com/us/app/recaptcha/id6746882749
This is detailed at https://support.google.com/recaptcha/answer/16609652
iPhones have attestation too: https://developer.apple.com/documentation/devicecheck/establ...
It'll just be more clunky because you have to install their app.
I believe the latest versions of iOS just work from the browser, you only need to install the app for older versions of the OS.
I don't know what technology they're using, but when I scanned the QR code it launched (downloaded?) an iOS app of sorts with one tap, similar to the way Google tried Instant Apps a few years back. Didn't even need to double tap the power button like usual.
They also have Private Access Tokens: https://developer.apple.com/news/?id=huqjyh7k
Why should I even care anymore? I no longer need to access random websites to find information since I can just ask the AIs.
Are you genuinely asking? To pay your taxes, order items online, access your bank account, log into your favorite AI service, there are very often CAPTCHAs involved. Try going a month with CAPTCHAs blocked in uBlock Origin, and you will find yourself unable to do many basic things.
Not saying this is any better, but IRS partnered with id.me to enforce ID + face recognition before you can log in to view your records. We are truly doomed.
Even besides services you might need to access, as pointed out in another response (e.g., banks, shops), how are you going to check the veracity and understand the context of the information you seek without going to the (possibly hallucinated!) sources? But I guess a lot of people who are into using AI like that just don't care.
Where do you think the AI gets this information?
They also need to browse the web, and are more likely to be blocked by these measures than humans
No one should ever browse the web on a smart phone. Not joking.
This API also works on the desktop. In fact, you can't use this system without a phone if your browser isn't Google enough.
We are going to see sooooo many scams out there. No wonder Google is locking down third party Android apps outside of their control, getting a user to install "device verification.apk" will become super trivial after people have clicked through these popups a couple times.
And also don't install apps? What's left then?
A device I have no choice in owning because modern employers assume you have sometime to install an authenticator app on. That's what it is for me. Also, sadly, it's an anchor for Signal. Otherwise I don't use the stupid thing.
That war was lost in the 2010s, around the same time as the vertical video war.
Phone is small computer
Sure, and the north korean Linux distro also runs on a computer. I still wouldn't touch it.
Is it just a matter of not trusting the OS? I'm trying to figure out why "smart phone" is the discriminator here.
A smart phone _could_ be legitimate and free and open, but in practice it's not. This is a constraint based on the reality of the market, not really based on what is strictly possible with the technology. I don't get too deep into this, but at a very high level, this is what I dislike about smartphones.
- Touchscreen user interface is objectively worse than a mouse and keyboard. Portability is the the only benefit to this interface, but this also works strongly to attack impulse control. It's always on you, just a moment away.
- Smartphones are significantly worse for privacy. In a LOT of ways. We can discuss this if you're interested.
- Many smartphone apps exist solely because a website would be less addicting and would also not be able to collect as much data as an app. ie, it's a choice that's worse for you and better for the company.
- They're significantly less open. Yes, grapheneOS and other alternatives exist, however it's not like a computer where I can just install whatever I want without asking the provider permission to unlock the device.
- I touched on this in two other bullets, but it's worth highlighting here: they're built intentionally to be addictive.
- The operating system and hardware are effectively interlocked. (yes, I know grapheneOS exists) but for any modern thing you might actually require a smartphone for (banking app, OTP app, etc) you must be using Apple or Google.
- Providers don't produce security updates well enough; Apple is "better" here, but my 10-15 year old computer can run modern Linux. People brag about 7 years of support on an iPhone. I'm under the impression that Android is better than it used to be, but in the old days any random vendor would give you about 1 year of update support and then you'd be hosed running old Android until you bought a new phone.
- Nobody cares if I own a desktop computer or not, but it's getting to the point that businesses will not work with me unless I have a modern smartphone.
I could probably go on, but I really hate these things.
Yeah I'm aware of all of this, it's just the framing that confused me. A lot of these boil down to "nobody should own or use a smart phone to do anything" which is a bit of a different and less specific pitch than "nobody should browse the web on a smart phone".
It is, just like a calculator is a small computer. It's not a personal computing device though, in the sense that the user can't develop and deploy their own software/tools on it.
Even if that were true, that has nothing to do with browsing the web on it
No one should ever browse the web from an ESP32 either. Like seriously the dark patterns are bad enough from a desktop where you've actually got the screen real estate to see the whole page, have other sites open for comparison, have a keyboard to type your own notes, etc. Most browsing can simply wait, especially the adversarial-commercial type we're talking about here.
well that just seems counterproductive and unreasonable but it's Friday so what do I care
-- sent from Chrome on Android
I think this is the third HN link I've clicked on in a row that leads to an LLM-generated article. I'm not opposed to AI, but I'm tired of seeing it quietly substituted for human thought and expression.
I'm seeing this stance a lot "this is obviously AI generated"
Why? What's LLM generated? How can you tell?
To me what's obvious is that our trust system is already breaking down. Commenters accusing each other of being AIs is also another example of this.
Look at the number of : per paragraph. What human puts two : in a single sentence?
"One additional failure worth noting: one incident response professional in the HN thread, raised a concern that operates independently of the bot problem: …"
The ersatz Ted Talk meets LinkedInfluencer rhythm of sentences, the throat clearing fillers as connective tissue…
Or Wikipedia: https://en.wikipedia.org/wiki/Wikipedia:Signs_of_AI_writing
>Why? What's LLM generated? How can you tell?
Not the guy you're responding to, but:
1. The high number of (em) dashes is suspect, though it's unclear whether they manually replaced the em dashes or is actually human generated.
2. "One additional failure worth noting: one incident response professional in the HN thread, raised a concern that operates independently of the bot problem" feels out of place for a content marketing piece. HN isn't popular enough to be invoked as a source, and referencing it as "the HN thread" seems even weirder, as if the author prompted "write a piece about how google cloud defense sucks, here are some sources: ..."
3. This passage is also suspect because it follows the chained negation pattern, though it's n=1
>No hardware identifier is transmitted. No attestation is required. No certification layer determines who may participate.
edit:
I also noticed there are 2 other comments that are flagged/dead expressing their reasons.
> actually human generated
Human written, not generated.
> HN isn't popular enough to be invoked as a source
Excuse me, what do you mean there? The author happens to read HN too.
Looks like the moderators are actively deleting comments that call out AI generated articles now. Grim. This comment will probably be deleted too.
mods hastening dead internet theory
The choppy language is the biggest trigger for me. Examples:
* "With Fraud Defense, there was no process to respond to. The product launched. The requirements page went live."
* "That is not a technical limitation waiting to be engineered around. It is the mechanism."
* "The defeat is mechanical. Bot operators point a camera at a screen, a trivial automation with off-the-shelf hardware."
I could be wrong, of course. Maybe humans are starting to write like LLM's, or maybe it's just confirmation bias on my part.
The entire article is just one long stream of short, punchy, declarative sentences. The latest Claude models are notorious for writing like this.
There's also a few cookie-cutter patterns that should immediately jump out at you if you're at all familiar with AI writing, such as:
> No hardware identifier is transmitted. No attestation is required. No certification layer determines who may participate. User privacy is structurally preserved, not promised.
> Google Cloud Fraud Defense is not a reCAPTCHA update. The QR code is the visible mechanism, but device attestation is the real product.
Very funny that if you want to start a bot farm you also go and buy a bunch of random android devices.
For merchants who don't want geeks as customers, cool
As a web-wide captcha replacement, not cool
For those who don't know: WEI is a boy band known for singles such as "Twilight"[0].
[0]: https://youtu.be/4BYkuPUQoWE
We see the fundamental forces of capitalism at work: To justify valuation, Google needs to grow. When they feel a ceiling, they broaden their search to anything legal that makes customers pay - even if it contradicts their longterm interests. This created countless attack angles for startups. The good news: we already have a solution! Monopoly laws. In case of the internet, no company should be able to have this much power.
The bad news: US decided to weaponize big tech’s leverage over the world and does not enforce these laws anymore that fix vanilla capitalism.
>We see the fundamental forces of capitalism at work: To justify valuation, Google needs to grow.
You’re confusing markets with capitalism.
Market Socialism (the only reasonable kind) would have these same issues. If Google was owned by the workers instead of capitalists, it would still have incentive to grow. The worker owners would have the exact same incentives as current owners. The only difference would be who the owners are.
Capitalism is not actually “the final boss” that internet leftists make it out to be. Socialism is not the panacea that leftists make it out to be. Surveillance is not a “capitalist only” thing.
In a world where everything is shit, could I at least take away some solace in this helping to reduce Cloudflares hegemony?
I think the idea is good if it could actually curb bot traffic that currently plagues the Internet.
However, a lot of recent bot traffic are sophisticated scrappers called "LLM's." You can tell claude to "research X from this www.example.com" and will automatically scrape it and summarize it, something that a LLM is perfect for. Gemini tends to share links instead, presumably because most of Google's revenue comes from ads served on those websites, so if it completely killed the traffic to those websites it would just make less money. Incidentally, I wonder if Claude/Gemini use an search engine-like "index" of all websites or it refuses to cache anything to always fetch "fresh" data.
If this is employed, I don't think the web is only going to be gatekept to Google devices. I think it will also be gatekept to Google's AI's.
Google would be able to display a captcha that no LLM could defeat, and then just let its own LLM pass through.
The same could be said about its other bots, such as the web crawler. Google's bot could crawl webpages that no other crawler would ever be able to simply because it has free pass to captcha-gated GETs. Although the same could be true already today.
Their product page is full of info about how this works with "agentic" cruft. They're still permitting your regular old scrapers and bots for as long as they like you. Hope you're not thinking of running an independent system instead of a large cloud platform!
We do need to abandon the reality where we use the same few companies on a daily basis and get back to what's now hidden the under-the-surface: forums, blogs, personal websites. We need to re-discover the "free" internet we used to have before Facebook and smartphone dystopia happened.
I keep banning gogol Ipv4 ranges because of scanners, script kiddies (and maybe worse). Yes, I am self-hosted, and without paying the DNS mob.
This article is full of false assumptions.
For example: > Bot operators point a camera at a screen, a trivial automation with off-the-shelf hardware. For operations that need Play Integrity attestation specifically, a compliant Android device costs approximately $30 at current market prices
A bot farm cannot bypass for long with a $30 phone. Do you seriously think that if Google sees the same hardware identifier 1000s of times a day they are not going to consider that usage to be fraud?
I appreciate that Google's made a real proposal to avoid the web becoming bottomless AI slop. This article hasn't come with a better alternative - I'd love to see one!
> Do you seriously think that if Google sees the same hardware identifier 1000s of times a day they are not going to consider that usage to be fraud?
Phones are very cheap, especially refurbished phones. Just have the phones mimic real life sleep/wake cycles and take occasional breaks. Use 25% more devices to account for the loss in uptime.
Besides, some people (often unemployed or disabled, and possibly with sleep disorders or mania) actually don’t do anything other than scroll on their phone all day and night. So you can’t rely on this as a good signal without creating even more blowback. And you really don’t want too much blowback from troubled people who have infinite free time.
It is particularly funny because this is content marketing for a computational proof of work "captcha". Those are pure snakeoil, with economics that are probably at least four orders of magnitude more favorable to the abusers than this attestation would be.
I'm pretty sure that the Ai copied the $30 number from my hacker news comments. However in the USA it is true. https://www.walmart.com/ip/Straight-Talk-Motorola-Moto-g-202... (carrier locks don't matter for this usecase.) I am not sure that that storing unique device identifiers is legal in the EU.
I remembered $30 from some comment I read, but didn't look for it later. If it was yours, thank you! (def. thank you for the Wallmart link! - would you like a credit in the blogpost like a quote?
>would you like a credit in the blogpost like a quote?
I guess so....
Related:
Google Cloud fraud defense, the next evolution of reCAPTCHA
https://news.ycombinator.com/item?id=48061938
Wrong link. https://news.ycombinator.com/item?id=48039362
This is security theatre. This isn't going to help against bots in any way.
I fucking hate this future. It's bleak. The engineers participating in this should be ashamed.
They shouldn't just be ashamed. They should be shunned at the very least.
There's a good chance they're on HN FWIW. If you are and you're reading this: Fuck you. Reconsider which side you want to be on!
So many in hn already downvoted you. That says the SV nature and opinions in tech sector.
But but but but ... now that huge tech has declared copyright invalid because of AI they must prevent you from copying Mickey Mouse! Urgently.
Of course courts will undo their current copyright stance as soon as someone "uncopyrights" Disney movies, which is of course coming, but for now ...
Will SOMEBODY think of the billions?
"ChatGPT, generate a blog post that packages an ad for my service that competes with Google by harvesting HN's latent anti-Google rage."
AI use is far more prevalent now than then sadly. This kind of scheme is inevitable since compute is not free.
Water use and mass displacement of labor get all the attention but there are so many other more subtle reasons like this that AI is going to be bad for society.
I disagree that this kind of scheme is inevitable. We can "evit" it through thoughtful discussion, foresight, alternative mitigations, and even regulation. Certainly, Google can choose to avoid it. On the other hand, the AI bubble will inevitably burst, since compute is not free. I look forward to post-bubble AI.
“Evit” is “avoid” in English, they have the same root.
> We can "evit" it through thoughtful discussion, foresight, alternative mitigations, and even regulation
Such as? I don't see how regulation would apply here without concrete technical solutions that enforce it. So what alternative mitigations do you have in mind?
Among many other things: Regulate the use of AI to imitate or impersonate human activity. Regulate AI crawling/scraping. Ban scraping entirely, and all models based on it. Regulate maximum model size.
These wouldn't eliminate the problem, but they'd change it from "many people do this" to "this is always a malicious attack, react accordingly".
None of those would work without enforcement. Scams are banned, but that doesn't stop Chinese mafia from operating prison camps that run scams scamming people all around the world.
None of these proposals are enforceable in any meaningful way.
Given all the negative comments here - what is anyone's alternate solution for AI-driven fraudulent activity?
CAPTCHAs are increasingly ineffective. Services are either going to go offline or implement some kind of system like this. PII like credit cards or SSNs aren't enough because those are regularly stolen.
So where do things go? Fewer services and infinite fraud?
Yes, fewer services and infinite fraud is substantially better to me than the web being controlled by Google even more than it already is.
It will be fewer accessible services for everyone who refuses to use this, that's for sure. In general though, service providers are not going to accept "fewer services and infinite fraud" and thus they will look into implementing this.
> Given all the negative comments here - what is anyone's alternate solution for AI-driven fraudulent activity?
A combination of "regulate AI" and "The optimal amount of fraud is not zero". https://www.bitsaboutmoney.com/archive/optimal-amount-of-fra...
Why do you continue to extend the benefit of the doubt to your former employer when they have shown themselves to be untrustworthy again and again?
For one, I got to see how utterly insane and off-base many of the conspiracy theories around Chrome were compared to reality.
This doesn’t even solve the problem thanks to device farms. There’s not really a solution for this short of aiming a camera at someone’s retina 24/7 plus a fully locked down hardware path. And even that would surely be compromised given enough incentives.
People are just going to have to find a new way to monetize. Maybe more things will become paywalled, or sponsored long-term like old TV shows. Again, there’s no good way to solve this, and the “solutions” on offer just contribute to the surveillance state without solving the problem.
I don't know which activity you're referring to, but why are you trying to discriminate between humans and bots? Because bots don't pay? So demand payment.. Demand like payment per account creation, then set appropriate rate limits per account.
Captchas were never effective. It’s an arms race to the bottom.
As much as I hate whatever google's doing, this article has some issues:
>For operations that need Play Integrity attestation specifically, a compliant Android device costs approximately $30 at current market prices
This assumes the logic on google's side is something like `if(attestationResult == "success") allow()`, but it's not hard to imagine the device type being factored into some sort of fraud score. For instance, expensive devices might have a lower fraud score than cheaper devices, to deter buying a bunch of cheap devices. They might also analyze the device mix for a given site, so if thousands of Chinese phones suddenly start signing up for Anne's Muffin Shop, those will get a higher fraud score.
>Firefox for Android does not appear in Google’s stated browser support list for Fraud Defense.
The browser only needs to show a QR code, so if you're on firefox mobile they'll either open a deeplink to google play services on the phone itself, or show a qr code.
>One human solving a single challenge pays a negligible cost. A bot farm running concurrent sessions faces exponential compute costs with each additional attempt - and AI agents, which consume GPU cycles to operate, face identical penalties regardless of how sophisticated their reasoning is.
PoW for bot protection basically never caught on because javascript performance is poor, and human time is worth more than a computer's time. An attacker doesn't care if some server has to wait 10s to solve a PoW challenge, but a human would. An 8-core server costs 10 cents per hour on hetzner. Even if you assume everyone has a 8-core desktop-class CPU at their disposal (ie. no mobile devices), a 6 minute challenge would cost an attacker a penny. On the other hand how much do you think the average person values 6 minutes of their time?