frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

fp.

Open in hackernews

Google Cloud Fraud Defence is just WEI repackaged

https://privatecaptcha.com/blog/google-cloud-fraud-defence-wei/
169•ribtoks•2h ago

Comments

jchw•1h ago
Exactly my thoughts. I am unfathomably angry and I want to contribute to any effort to dismantle Google as a company.
pietervdvn•1h ago
Yeah, same. It is hard; we start to need a collective boycott.

We can all do our part, by using their products as little as possible, contribute to open alternatives (OpenStreetMap, Fediverse, Linux, Nextcloud...) and by stimulating our (non-techie!) friends and family.

But it is a lot of work :(

deaux•1h ago
It's less work than 10 years ago. So many much more mature alternatives.
buran77•56m ago
The technical challenge is actually the smaller one. The real one is to get people to care. Don't be tricked by the HN/techie bubble. Most people don't understand the problem, or don't see it as a problem because nothing smacked them in the face yet. Any attempts to explain it makes you sound like a lunatic to some, or just a bit of a worrier to others.

Whether it's targeted ads, or training AI on their data, or verifying their age and implicitly identity, or "fraud defense", most people happily take it in exchange for a convenient freebie which is why things keep escalating.

It's understandable, people are assaulted with all kinds of abuses from every direction. There are more immediate threats that they can grasp more easily so this stuff has to wait its turn.

JoshTriplett•2m ago
> Most people don't understand the problem, or don't see it as a problem because nothing smacked them in the face yet.

Or don't approach the world with a fundamental mindset of having agency to (help) fix things they see as broken. Just because people see something as bad doesn't mean they inherently see a bright flashing line from that to "so I should do something about it rather than accept it".

7734128•28m ago
It should not be a "vote with your wallet" situation. It should be governments shattering that organization into appropriately sized companies.
quantummagic•11m ago
I wouldn't hold your breath. The government is reliant on them for surveillance, censorship, and propaganda. It is a synergistic relationship, not adversarial.
pessimizer•20m ago
> Yeah, same. It is hard; we start to need a collective boycott.

Feelgood slactivism. They don't care about your boycott. They finance their own alternatives because they know what makes you shut up.

leoc•33m ago
But remember: once again, don't simply get angry at Google the institution. Get angry at Page and Brin personally. They have the power to prevent this, a power they were careful to preserve when they gave Google its IPO. They are fully responsible for Google's choices here. But, partly because they aren't constantly jumping up and down drawing attention to themselves on social media, they've tended to escape the same personal scrutiny given to eg. Elon Musk. That needs to end.
greatgib•22m ago
On that topic, I would highly recommend you to switch to Kagi!

Search is still their workhorse for ad revenue. Less search, less users, in addition to users now just asking chatgpt and co, will hurt them well

tom1337•14m ago
Wouldn’t installing an adblocker basically hurt them as much / more as I still cost them compute but don't get them that sweet ad money?
walletdrainer•1h ago
The only real solution is to aggressively name and shame the engineers who build this tech. They should feel uncomfortable opening their door, walking down the street.

(A bunch of engineers who build this tech will probably be complaining about how unfair my proposal is, boo hoo)

buran77•1h ago
The usual argumentation is "I need to make a living" and "if I didn't build it someone else would have done an even worse job, like this at least I could be an activist on the inside and guide the efforts to make it better".
MSFT_Edging•1h ago
Another method is to stall and sabotage the development via endless bike shedding, language changes, rewrites, refactors. All normal things in every project. Drag those feet.
zihotki•2m ago
And the people will be just simply fired for underperforming. Or anything else, it's easy when you have at will employment.
deaux•56m ago
Which are of course delusional excuses when they come from anyone working at Google.

Then they'll come with "but I have a family and mortgage". No shit, so does literally everyone.

schoen•54m ago
I don't have a family or a mortgage.
nerdsniper•35m ago
I think I'd have to be working at Google to afford a family and/or mortgage!
spankalee•48m ago
You don't think that some people simply disagree with the idea that this is bad? Or like maybe the CAPTCHA company who put out the post has an agenda here? So you want to go after engineers personally?

I wonder what you've done that might warrant harassment?

Look at how complicated CAPTCHAs are getting to try to be unsolvable with AI - it's a losing game. This and the WEI proposal are trying to solve a very, very real problem. If you continue to deny the problem, or every proposal solution without working towards an acceptable one, people will route around the blockage.

baobabKoodaa•39m ago
> You don't think that some people simply disagree with the idea that this is bad?

Where are they? Where? Can you point me to one person in this thread who "disagrees with the idea that this is bad"? Apparently even you don't go that far.

jasonjayr•38m ago
The crux of the problem is that their solution involves making themselves the gatekeepers of who is and isn't allowed. And that's a power that no one unaccountable organization should wield.

Given how important internet is to modern society, letting any one entity decide who should and should not have access is nearing a human rights issue.

techpression•35m ago
This case is trivially circumvented with device farms, much like described in the post. What real problem are they trying to solve? AI bots reading content? That’s not something Google want to prevent, it’s part of their business model, this would allow them to easily circumvent it for themselves though.
walletdrainer•32m ago
> You don't think that some people simply disagree with the idea that this is bad?

Some people think women shouldn’t be allowed to vote, not all opinions are created equal.

troyvit•21m ago
But it's so easily beatable! This might be the result of good intentions (being incredibly generous), but as the article states, any bot can afford a $30 phone and the concomitant hardware as the cost of doing business and bypass this.

Also as the article states (referencing an HN comment):

> How should we realistically teach Susan from HR the difference between a real Google Captcha QR code and a malicious phishing QR code - you (realistically) can’t.

Susan from HR is the least of it. This is a huge vector to increase fraud, not decrease it.

How would an ethical, competent engineer argue against this?

The CAPTCHA company who put this out might have an agenda, but also since they're in the industry they might also have knowledge to impart.

We're reaching an inflection point with the oligarchies where the old ideas of "writing a blistering editorial" or "calling your congress-critter" need to be seriously questioned as useful and other non-violent methods of recapturing digital freedom need to be entertained.

jjulius•39m ago
I think the better alternative to making engineers "feel uncomfortable opening their door, walking down the street" is for us to collectively ask if the solution isn't to touch more grass and rely less on the technology we've all come to blindly accept as required.

I mean, I hate this QR code shit as much as anyone, but c'mon, we can and should be better - both in how we treat others, and how much we rely on this shit.

criticalfault•34m ago
one person's villain is another person's hero.

I imagine if they would be named and shamed, they would get huge contracts in companies like oracle.

amazingamazing•1h ago
AI use is far more prevalent now than then sadly. This kind of scheme is inevitable since compute is not free.
add-sub-mul-div•57m ago
Water use and mass displacement of labor get all the attention but there are so many other more subtle reasons like this that AI is going to be bad for society.
Flimm•57m ago
I disagree that this kind of scheme is inevitable. We can "evit" it through thoughtful discussion, foresight, alternative mitigations, and even regulation. Certainly, Google can choose to avoid it. On the other hand, the AI bubble will inevitably burst, since compute is not free. I look forward to post-bubble AI.
layer8•34m ago
“Evit” is “avoid” in English, they have the same root.
sofixa•21m ago
> We can "evit" it through thoughtful discussion, foresight, alternative mitigations, and even regulation

Such as? I don't see how regulation would apply here without concrete technical solutions that enforce it. So what alternative mitigations do you have in mind?

Analemma_•14m ago
What kind of regulation would that be? The only regulation which can actually stop the problem Google is trying to fix here is government-issued IDs tied to all your internet activity. I’ll take the Google fix instead, thanks.
breakingcups•56m ago
I fucking hate this future. It's bleak. The engineers participating in this should be ashamed.
vrganj•50m ago
They shouldn't just be ashamed. They should be shunned at the very least.

There's a good chance they're on HN FWIW. If you are and you're reading this: Fuck you. Reconsider which side you want to be on!

faust201•22m ago
So many in hn already downvoted you. That says the SV nature and opinions in tech sector.
spankalee•45m ago
Given all the negative comments here - what is anyone's alternate solution for AI-driven fraudulent activity?

CAPTCHAs are increasingly ineffective. Services are either going to go offline or implement some kind of system like this. PII like credit cards or SSNs aren't enough because those are regularly stolen.

So where do things go? Fewer services and infinite fraud?

righthand•42m ago
Captchas were never effective. It’s an arms race to the bottom.
nazgulsenpai•19m ago
Yes, fewer services and infinite fraud is substantially better to me than the web being controlled by Google even more than it already is.
frankchn•11m ago
It will be fewer accessible services for everyone who refuses to use this, that's for sure. In general though, service providers are not going to accept "fewer services and infinite fraud" and thus they will look into implementing this.
iamnothere•18m ago
This doesn’t even solve the problem thanks to device farms. There’s not really a solution for this short of aiming a camera at someone’s retina 24/7 plus a fully locked down hardware path. And even that would surely be compromised given enough incentives.

People are just going to have to find a new way to monetize. Maybe more things will become paywalled, or sponsored long-term like old TV shows. Again, there’s no good way to solve this, and the “solutions” on offer just contribute to the surveillance state without solving the problem.

HackerThemAll•38m ago
We do need to abandon the reality where we use the same few companies on a daily basis and get back to what's now hidden the under-the-surface: forums, blogs, personal websites. We need to re-discover the "free" internet we used to have before Facebook and smartphone dystopia happened.
Havoc•38m ago
Whether it's AMP or manifest 3 or android source shenanigan or attempts to replace cookies with their FLOC nonsense or this...Google is rapidly turning into a malicious force when it comes to the open internet
xenophonf•18m ago
I'm amused at how thoroughly Google adopted Microsoft's playbook. Chrome supplanted Internet Explorer by embracing the open web. But then Google immediately started on extensions, and now they're trying to extinguish the open web with nonsense like Cloud Fraud Defense. All very smoothly done. I mean, people are actually _asking_ for this junk. I'm impressed.
ocdtrekkie•17m ago
> rapidly becoming

Always has been.

Google was creating cartels like the "Open Handset Alliance" literally decades ago.

Via their control of Chrome and Search which are both monopolies, Google holds absolute authority on how websites are rendered and if websites can be found.

ChrisArchitect•35m ago
Related:

Google Cloud fraud defense, the next evolution of reCAPTCHA

https://news.ycombinator.com/item?id=48061938

GranPC•14m ago
Wrong link. https://news.ycombinator.com/item?id=48039362
VBprogrammer•35m ago
In a world where everything is shit, could I at least take away some solace in this helping to reduce Cloudflares hegemony?
spwa4•32m ago
But but but but ... now that huge tech has declared copyright invalid because of AI they must prevent you from copying Mickey Mouse! Urgently.

Of course courts will undo their current copyright stance as soon as someone "uncopyrights" Disney movies, which is of course coming, but for now ...

Will SOMEBODY think of the billions?

tadzikpk•23m ago
This article is full of false assumptions.

For example: > Bot operators point a camera at a screen, a trivial automation with off-the-shelf hardware. For operations that need Play Integrity attestation specifically, a compliant Android device costs approximately $30 at current market prices

A bot farm cannot bypass for long with a $30 phone. Do you seriously think that if Google sees the same hardware identifier 1000s of times a day they are not going to consider that usage to be fraud?

I appreciate that Google's made a real proposal to avoid the web becoming bottomless AI slop. This article hasn't come with a better alternative - I'd love to see one!

iamnothere•13m ago
> Do you seriously think that if Google sees the same hardware identifier 1000s of times a day they are not going to consider that usage to be fraud?

Phones are very cheap, especially refurbished phones. Just have the phones mimic real life sleep/wake cycles and take occasional breaks. Use 25% more devices to account for the loss in uptime.

Besides, some people (often unemployed or disabled, and possibly with sleep disorders or mania) actually don’t do anything other than scroll on their phone all day and night. So you can’t rely on this as a good signal without creating even more blowback. And you really don’t want too much blowback from troubled people who have infinite free time.

munchler•13m ago
I think this is the third HN link I've clicked on in a row that leads to an LLM-generated article. I'm not opposed to AI, but I'm tired of seeing it quietly substituted for human thought and expression.
alex_duf•5m ago
I'm seeing this stance a lot "this is obviously AI generated"

Why? What's LLM generated? How can you tell?

To me what's obvious is that our trust system is already breaking down. Commenters accusing each other of being AIs is also another example of this.

dgrin91•7m ago
Maybe a dumb question, but how is this suppose to work for iphone users? They wont have google play, and it seems like android/google play is required here? There is no way they would cut out such a huge chunk of the market.
gruez•5m ago
iPhones have attestation too: https://developer.apple.com/documentation/devicecheck/establ...

It'll just be more clunky because you have to install their app.

JoshTriplett•5m ago
The claim is that an iPad/iPhone will also work. Not that that makes it acceptable; if anything, it's worse, because if it were Google Play only it'd be more obvious how unacceptable it is, whereas catering to the duopoly makes it less obvious how much it excludes people and builds a reliance on proprietary systems.
SwellJoe•1m ago
[delayed]

Serving a Website on a Raspberry Pi Zero Running in RAM

https://btxx.org/posts/memory/
68•xngbuilds•1h ago•20 comments

Google Cloud Fraud Defence is just WEI repackaged

https://privatecaptcha.com/blog/google-cloud-fraud-defence-wei/
169•ribtoks•2h ago•56 comments

Cartoon Network Flash Games

https://www.webdesignmuseum.org/flash-game-exhibitions/cartoon-network-flash-games
13•willmeyers•25m ago•9 comments

An Introduction to Meshtastic

https://meshtastic.org/docs/introduction/
214•ColinWright•5h ago•84 comments

PC Engine CPU

https://jsgroth.dev/blog/posts/pc-engine-cpu/
59•ibobev•2h ago•13 comments

Poland is now among the 20 largest economies

https://apnews.com/article/poland-economy-growth-g20-gdp-26fe06e120398410f8d773ba5661e7aa
609•surprisetalk•4h ago•520 comments

A web page that shows you everything the browser told it without asking

https://sinceyouarrived.world/taken
159•mwheelz•4h ago•96 comments

Show HN: Git for AI Agents

https://github.com/regent-vcs/re_gent
36•doshay•2h ago•22 comments

Podman rootless containers and the Copy Fail exploit

https://garrido.io/notes/podman-rootless-containers-copy-fail/
53•ggpsv•3h ago•6 comments

Cloudflare to cut about 20% of its workforce

https://www.reuters.com/business/world-at-work/cloudflare-cut-over-1100-jobs-2026-05-07/
1131•PriorityLeft•20h ago•781 comments

Rumors of my death are slightly exaggerated

890•CliffStoll•2d ago•119 comments

Canvas online again as ShinyHunters threatens to leak schools’ data

https://www.theverge.com/tech/926458/canvas-shinyhunters-breach
861•stefanpie•18h ago•567 comments

Mojo 1.0 Beta

https://mojolang.org/
98•sbt567•14h ago•102 comments

GeoJSON

https://geojson.org/
110•tosh•6h ago•47 comments

US Government releases first batch of UAP documents and videos

https://www.war.gov/UFO/
82•david-gpu•4h ago•138 comments

Maybe you shouldn't install new software for a bit

https://xeiaso.net/blog/2026/abstain-from-install/
740•psxuaw•17h ago•394 comments

The surprisingly complex journey to text-selectable client-side generated PDFs

https://sdocs.dev/blogs/journey-to-pdf-generation
46•FailMore•1d ago•45 comments

ClojureScript Gets Async/Await

https://clojurescript.org/news/2026-05-07-release
231•Borkdude•9h ago•55 comments

Dirtyfrag: Universal Linux LPE

https://www.openwall.com/lists/oss-security/2026/05/07/8
737•flipped•21h ago•304 comments

The map that keeps Burning Man honest

https://www.not-ship.com/burning-man-moop/
728•speckx•1d ago•336 comments

Ask HN: We just had an actual UUID v4 collision...

81•mittermayr•8h ago•97 comments

The Disappearance of the Public Bench

https://placesjournal.org/article/the-disappearance-of-the-public-bench/
84•cainxinth•1d ago•101 comments

Pinocchio is weirder than you remembered

https://storica.club/blog/pinocchio-in-italian/
255•cemsakarya•2d ago•104 comments

Dithering with CSS

https://ikesau.co/blog/dithering-with-css/
94•speckx•4d ago•27 comments

Inventing Cyrillic (2024)

https://www.historytoday.com/archive/history-matters/inventing-cyrillic
30•lermontov•2d ago•65 comments

Agents need control flow, not more prompts

https://bsuh.bearblog.dev/agents-need-control-flow/
552•bsuh•1d ago•267 comments

Hackers breach JDownloader's website to serve malware-laced downloads

https://www.neowin.net/news/if-you-downloaded-this-popular-software-recently-you-might-have-insta...
82•bundie•4h ago•25 comments

QBE – Compiler Back End

https://c9x.me/compile/
59•smartmic•9h ago•14 comments

GPT-5.5 Price Increase: What It Costs

https://openrouter.ai/announcements/gpt55-cost-analysis
167•gmays•15h ago•49 comments

Brazil's Pix payment system faces pressure from Visa and Mastercard

https://www.elciudadano.com/en/brazils-pix-payment-system-faces-pressure-from-visa-and-mastercard...
347•wslh•23h ago•292 comments