Now what the fresh fuck is this, then?

[jschauma@mstdn.social]

Now this is some bullshit.

Today: Don't have an "approved" phone? Too bad for you.
Tomorrow: Don't have a Google account? Good bye.

Another nail in the coffin of the Open Web. Those fuckers.

Just a moment...

(thecodersblog.com)

https://cybernews.com/privacy/google-qr-code-recaptcha-requires-approved-phone/

[itgrrl@infosec.exchange]

@bryan @jschauma this one links to a URL in the form of https[://]recaptcha[.]net/qr/xxxxxxxx where xxxxxxxx is an 8-character string of letters & numbers

if you hit the root of the FQDN you get a 404 but if you hit https[://]recaptcha[.]net/qr/ you get redirected to https://support.google.com/recaptcha/answer/16609652 which says that it’s part of “Mobile verification for Google Cloud Fraud Defense” and is “an experimental challenge type in Preview” (screenshot attached)

it then goes on to suggest that you should download the Google reCAPTCHA
app to be able to complete the CAPTCHA (lol nope ‍️ 🤪) and undoubtedly send Google a crap-tonne more info about you & your device

presumably this is because most people are accessing the challenge page on the mobile device that would be required to point its camera at its own screen – as (quite rightly) mobile browsers haven’t (yet) enabled the ability to blithely scan any old QR code displayed on a web page (but I expect this “feature” will be added soon enough to at least some mobile browsers )

[bryan@dusty.ninja]

@itgrrl
thanks for the info!

I hate it.

[drahardja@sfba.social]

@jschauma We all know that training people to scan random QR codes will not lead to anything bad ever happening!

[itgrrl@infosec.exchange]

@bryan same

[ooze@wirejunkie.net]

@jschauma Get out while you can.

[robje@mastodon.social]

@jschauma
there is more

Keep Android Open

Your phone is about to stop being yours. In September 2026, Google will block every Android app whose developer hasn't registered with them.

(keepandroidopen.org)

#keepandroidopen

[mcslibinas@mastodon.social]

@jschauma "Scan to verify your name, surname, age, address, browsing history, balance, also info about relatives"

[toriver@mas.to]

@jschauma They do not see the irony of requiring a computer device to prove you are human?

[leeloo@c.im]

@jschauma
Tomorrow?

The last couple of days, Youtube has been telling me to log in.

I don't have a Google account. How do I log in?

[webhat@infosec.exchange]

@jschauma I saw this recently in a hotel from YouTube on a TV. No, thank you

[f4grx@chaos.social]

@jschauma you have to hit a url to unlock access? Wtf? They want to link phones, right? Also thats the most automatable captcha I have ever seen lol

[hadewych@mastodon.nl]

@leeloo @jschauma I'm throwing away my perfectly fine Fitbit watch as it can now only be used if you connect to Google

[freddy@social.security.plumbing]

@jschauma oh, the QR code has a bubble and the circle around it. authentication can be so fun and playful. yay...... not.

[w00p@infosec.exchange]

@jschauma

[zetabeta@mastodon.social]

@leeloo @jschauma
this might help:
https://docs.invidious.io/instances/

you may also use "yt-dlp" program in some cases.

[mpg@dsmc.space]

@jschauma Revelation 13:16-17: And he causeth all, both small and great, rich and poor, free and bond, to receive a mark in their right hand, or in their foreheads, and that no man might buy or sell, save he that had the mark, or the name of the beast, or the number of his name.

[dreiwert@chaos.social]

@jschauma The caption is inaccurate. It should say "Scan this to verify that you are a US #bigtech customer". Isn't there some regulation that should prevent this kind of misleading advertisement?

[brennan@social.lol]

@jschauma reCAPTCHA has always been an insidious service. It used to be exploitative labour (https://boingboing.net/2025/02/07/recaptcha-819-million-hours-of-wasted-human-time-and-billions-of-dollars-google-profit.html)

The truth is though we have no idea what's going on with its scripting. Any site that uses reCAPTCHA could be logging far more data points about users than is being disclosed. It is a black box that could be keylogging. Literally any alternative is better.

[paul@notnull.space]

@jschauma it's almost as if we haven't included #Quishing attack information in cyber awareness training for the last few years or something.