Now what the fresh fuck is this, then?

[f4grx@chaos.social]

@jschauma you have to hit a url to unlock access? Wtf? They want to link phones, right? Also thats the most automatable captcha I have ever seen lol

[hadewych@mastodon.nl]

@leeloo @jschauma I'm throwing away my perfectly fine Fitbit watch as it can now only be used if you connect to Google

[freddy@social.security.plumbing]

@jschauma oh, the QR code has a bubble and the circle around it. authentication can be so fun and playful. yay...... not.

[w00p@infosec.exchange]

@jschauma

[zetabeta@mastodon.social]

@leeloo @jschauma
this might help:
https://docs.invidious.io/instances/

you may also use "yt-dlp" program in some cases.

[mpg@dsmc.space]

@jschauma Revelation 13:16-17: And he causeth all, both small and great, rich and poor, free and bond, to receive a mark in their right hand, or in their foreheads, and that no man might buy or sell, save he that had the mark, or the name of the beast, or the number of his name.

[dreiwert@chaos.social]

@jschauma The caption is inaccurate. It should say "Scan this to verify that you are a US #bigtech customer". Isn't there some regulation that should prevent this kind of misleading advertisement?

[brennan@social.lol]

@jschauma reCAPTCHA has always been an insidious service. It used to be exploitative labour (https://boingboing.net/2025/02/07/recaptcha-819-million-hours-of-wasted-human-time-and-billions-of-dollars-google-profit.html)

The truth is though we have no idea what's going on with its scripting. Any site that uses reCAPTCHA could be logging far more data points about users than is being disclosed. It is a black box that could be keylogging. Literally any alternative is better.

[paul@notnull.space]

@jschauma it's almost as if we haven't included #Quishing attack information in cyber awareness training for the last few years or something.

[paul@notnull.space]

@jschauma ah, wait... Maybe the "proof" that you're human is that you can fall for such an scam

[walruths@mastodon.social]

@jschauma

The open web is fine. None of our sites have this shit on them. If they want to split the web into hell/pleasant, we know who where Pleasantville is.

_stretches out_

[zverik@en.osm.town]

@itgrrl @bryan @jschauma how did they manage to lose the lowercase c letter lol

[itgrrl@infosec.exchange]

@zverik @bryan @jschauma yeah I’ve seen that before – it displays correctly in the web page but when a full page screenshot is taken it gets munged

my assumption is that it’s a unicode char that isn’t supported by whatever tool does the rendering of the full page for the full page screenshot pipeline on iOS ¯_(ツ)_/¯

you can see that a regular screenshot that only takes the visible screen doesn’t have the same problem

[jernej__s@infosec.exchange]

@f4grx @jschauma You have to use an approved iOS or Android device – it won't even work on anything running AOSP.

[f4grx@chaos.social]

@jernej__s @jschauma As a lineage user, I will just say no, nope. never.

[grumpydad@infosec.exchange]

@jschauma That's not a phishing operation I've seen before...

[kierkegaanks@beige.party]

@jschauma well this can fuck aaaall the way off on the rocket with eric schmidt

[peturdainn@mastodon.social]

@jschauma I think the reason was that AI crawlers and bots currently have trouble reading QR codes. Which is weird because the whole point of QR codes is that they are machine readable ‍️

Attention Required! | Cloudflare

(cybernews.com)

[tschach@mastodon.social]

@jschauma Next: Please provide a blood sample to verify you're human!

[stoori@polyglot.city]

@jschauma in addition to all the other obvious problems with this, have they even considered accessibility at all?