Never mind Fancy Bear, or the NSO Group, the biggest threat to the open internet today is from the Big Tech corporations on which it has come to depend. For what else are we to conclude given that Google appears to be working on a system to lock large parts of the internet behind a new form of CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) designed not to tell apart humans from bots, but instead to make an un-person of anyone who doesn’t own an ‘approved’ Android or Apple device.
Google’s reCAPTCHA service is used by a wide variety of websites, many of them independent of Google in every other regard, to limit incoming traffic or data entered into contact forms. It is intended to prevent automated software from accessing these resources and using them to send spam messages or flood websites with denial of service attacks. You have probably encountered it when told to identify all the bicycles in a grid of images.
Under the auspices of its Cloud Fraud Defence programme, Google is introducing a new form of CAPTCHA for which the way to ‘prove’ one is a human is to be in possession of a Google-approved device. Reclaim the Net‘s original reporting focused on the threat to deGoogled phones, meaning phones running Android-like operating systems which have Google’s – often unwelcome – proprietary features removed, such as GrapheneOS or LineageOS. However, just as the dull name of ‘age verification‘ serves as a cloak beneath which schemes to end all truly personal computing can be smuggled, the danger here could be much broader than the technically focused headline implies. As the sources discussing this are relatively few, it is hard to ascertain exactly what has already been rolled out and what is still in the conceptual stages. But it appears that the new style of CAPTCHA threatens not just users with deGoogled phones but anyone without an ‘approved’ device. Google’s own documentation confirms the existence – as a “Preview” in limited use with alternative options presently existing – of CAPTCHAs which require an Apple or Android handset to pass them. But it describes this in a “Mobile Verification” context, which may imply a more limited use than reCAPTCHA in general. However, with such functionality possible, there is no reason that Google could not activate this, without alternative options, everywhere that its reCAPTCHA-branded prompts appear.
Google’s reCAPTCHA service is used by a wide variety of websites, many of them independent of Google in every other regard, to limit incoming traffic or data entered into contact forms. It is intended to prevent automated software from accessing these resources and using them to send spam messages or flood websites with denial of service attacks. You have probably encountered it when told to identify all the bicycles in a grid of images.
Under the auspices of its Cloud Fraud Defence programme, Google is introducing a new form of CAPTCHA for which the way to ‘prove’ one is a human is to be in possession of a Google-approved device. Reclaim the Net‘s original reporting focused on the threat to deGoogled phones, meaning phones running Android-like operating systems which have Google’s – often unwelcome – proprietary features removed, such as GrapheneOS or LineageOS. However, just as the dull name of ‘age verification‘ serves as a cloak beneath which schemes to end all truly personal computing can be smuggled, the danger here could be much broader than the technically focused headline implies. As the sources discussing this are relatively few, it is hard to ascertain exactly what has already been rolled out and what is still in the conceptual stages. But it appears that the new style of CAPTCHA threatens not just users with deGoogled phones but anyone without an ‘approved’ device. Google’s own documentation confirms the existence – as a “Preview” in limited use with alternative options presently existing – of CAPTCHAs which require an Apple or Android handset to pass them. But it describes this in a “Mobile Verification” context, which may imply a more limited use than reCAPTCHA in general. However, with such functionality possible, there is no reason that Google could not activate this, without alternative options, everywhere that its reCAPTCHA-branded prompts appear.
Comment