Google Cloud fraud defense, the next evolution of reCAPTCHA
52 points by unforgivenpasta 3 hours ago | 36 comments
driverdan 37 seconds ago
Any company that requires me to scan a QR code to make a purchase is losing my purchase.
replyMichaelNolan 14 minutes ago
I’m trying to use my phone less and less. Ideally I’d like to even switch a dumb phone.
replyBut tactics like this will make that nearly impossible if every website starts requiring a QR code scan on a authorized smartphone.
arian_ 2 hours ago
Google building harder walls against bots while simultaneously building AI agents that need to get through them is peak 2026.
replyAnalemma_ 5 minutes ago
It’s the same thing with Sam Altman and Worldcoin: create the problem, then sell people the solution (which also just so happens to shred more privacy). Play both sides and profit; it’s great work if you can get it.
replythrowaway67743 48 minutes ago
With the apparent competence that built Gemini, I have zero faith in Google building or doing anything that works anymore.
replytardedmeme 2 hours ago
They're expecting everyone to whitelist Google agents because Google has the market share for people to complain if Google agents don't work.
replymayama 2 hours ago
The site doesn't mention this. But, are they locking down QR code auth for only safetynet authenticated devices and with mobile number verification?
replybobbiechen 2 hours ago
Yeah, I had the same question myself. I think that's what you would want to do to make it airtight (plus some amount of rate limiting or flagging for devices that are part of dedicated device farms).
replyBut even if not, there's still value in raising the barrier to entry. For example, you can buy 1000 reCaptcha solves for $1-2 from various captcha-solver services. And yet that $0.001-per-request fee does discourage mass-scale bot attacks.
xacky 2 hours ago
The fact that mobile devices are now mandatory to prove "humanness" means that Google no longer trusts desktop/open platforms anymore.
replystupidgeek314 2 hours ago
Why can't an AI scan the QR code? Just fire up an emulator if necessary
replynerdsniper 22 minutes ago
Bluetooth is generally used to prove that the two devices are co-located, which makes it more complex to do your proposed kind of deployment at-scale. Bespoke solutions could perhaps work around for some smaller number of devices, this QR code layer by itself isn't intended to stop 100% of workarounds.
replytardedmeme 2 hours ago
The app that scans the code talks to the TPM in your phone to prove that your phone is running an unmodified Google OS.
replyhellojesus 2 hours ago
I know that's the final destination, but I didn't see that listed in the requirements page linked above. Any proof of this affecting the current implementation?
replythemafia 44 minutes ago
Which would be meaningful if phones weren't remotely controllable.
replySo the net effect is every AI agent will also have and connect to a physical phone.
tardedmeme 35 minutes ago
The attestation will include a unique ID of the phone, so that if you get banned you have to keep buying new phones and keep paying money to Google. Google won't stop this because it makes them money.
replyAnd the official Google OS just won't feature remote-control software.
mrguyorama 48 minutes ago
Google and the reCAPTCHA network aren't even that good with fraud prevention. You would think being literally omniscient over the whole internet would make it trivial to catch account takeovers, and Gmail has a proven track record at resisting account takeover, but when we tried to integrate their fraud signals, they were worthless, worse than the rest of the industry, worse than our homegrown trash from a decade ago.
replyBecause Google doesn't actually care about preventing fraud, they just want the data you feed them and the fraud feedback you provide. It's all take, no mutual business.
So it seems that you will need a modern Android device with Google Play Services installed or a modern iPhone/iPad to be allowed to browse the web in the future.
No mention of device integrity verification yet, but the writing is on the wall.
If Google Play services is listed as a requirement, that implies that a "certified Android" device capable of Play Integrity attestation is required, since that's the only officially supported way to obtain Google Play services. On consumer-facing support articles like this, they don't tend to get into the nitty gritty details like what APIs are being used. If MEETS_DEVICE_INTEGRITY is required, that would probably not be explicitly listed here.
E.g. the consumer documentation for Google Pay just says you need a "certified" Android device and a screen lock set up: https://support.google.com/wallet/answer/12200245
(Yes, if you go deep into the FAQ at the end it eventually states that if you rooted your phone, you can't use tap to pay, but that requirement is implied by the certification requirement [1].)
In Google's eyes, and in the eyes of the law due to trademarks filed by Google, Android == Google Android.
This feature would make little sense if it's not using device attestation because otherwise it would be easy to spoof. I expect that it will initially not use it, and they will start A/B testing device attestation in the coming years.
[1] Expand "What to do if you see device is not certified" -> "Reset device to fix issue" https://support.google.com/android/answer/7165974
Does the iPhone recaptcha app force you to login with a Google account? Seems we didn't need ID verification for the web to lose all anonymity.
I know, people will slavishly knuckle under, but let me dream for a few minutes.
There's some sort of serious issue with learned helplessness or something
So does Binance.