HN

Comments (217)

• Menu

  bramhaag
  The requirements for the mobile devices are listed here: https://support.google.com/recaptcha/answer/16609652So it seems that you will need a modern Android device with Google Play Services installed or a modern iPhone/iPad to be allowed to browse the web in the future.No mention of device integrity verification yet, but the writing is on the wall.
• Menu

  codedokode
  Wow. So you will need a mobile device in future to browse the web, and Google will use mobile device identifier to de-anonymize you. And I assume they also carefully designed this to make life little harder for alternative search engines, their competitors. And probably they will not provide collected user data to competing advertising platforms to make them less competitive as well.Also the example is ridiculous, that you need to scan a QR code to place an order. Maybe they should require filing a visa application as well.
• Menu

  devy
  I can't believe promoting the QR code-based challenge as the agentic way of fraud defense. Having non-human readable data input is dangerous if somehow the QR code is comprised with a zero-day URL, it's game-over.Note: I know QR code is ubiquitous these days, but still blinding scanning a QR code to go to accessing an URL is like running a binary downloaded from the internet.Note2: yes, the `curl $URL | bash` installation approach is essentially just that, yet somehow became popular.
• Menu

  driverdan
  Any company that requires me to scan a QR code to make a purchase is losing my purchase.
• Velocifyer
  reCAPTCHA is already so hard that I often can't solve the visual challenges, and Google has been blocking the audio challenges on VPNs (that is horrible for blind people) and also now the audio challenges are super hard.Google Gemini can solve them and I don't think that it will take long for lower power AI systems to be able to solve them.I will be unable to solve the phone verification because I use LineageOS for microG, but any fraudster can just buy a bunch of $30 android phones. Many people have trouble using a smartphone, so they use dumbphones, but they will be locked out. Many people just don't have any mobile phone because they don't think that it is useful.
• Menu

  xacky
  The fact that mobile devices are now mandatory to prove "humanness" means that Google no longer trusts desktop/open platforms anymore.
• davemp
  I think it’s becoming hard to ignore that the Internet has fundamental flaws from a game theoretical view. I hope that we can skip the step of having Google as the feudal lord who saves us from anarchy though.How about we start with some accountability for entities that host fraud? The main reason we can have relative anonymity in public is part trust and partially because you can get physically taken out if you cross the line. I understand there are some real limitations with enforcing accountability on the Internet, but perhaps that’s where we should be focusing.
• Menu

  tech234a
  The QR code feature looks like it could be spoofed to become a Pegasus deployment method once people get used to them.
• bigger_fish
  You mean like the Google login QR I can already bypass with an extension? I'm not sure this is a real step forward in the arms race, and I'm cool with that.
• Menu

  semiquaver
  Serious question: what if you don’t have a (smart)phone?
• dunder_cat
  Is the QR code check mandatory and if not, is it the default?The bulletpoint as-is just says:> AI-resistant challenge: As we identify potentially fraudulent behavior from agents, we enable application providers to deter and mitigate malicious requests by requesting humans to be in the loop using the new QR code-based challenge. This AI-resistant mitigation challenge to prove human presence is designed to make automated fraud economically unviable.Followed by> Existing reCAPTCHA customers are automatically Fraud Defense customers, with no migration required, no action needed, and no change to pricing. Your existing site keys and integrations remain exactly as they are today.It is probably me being a literal reader but "we enable application providers to deter and mitigate malicious requests by requesting humans to be in the loop" feels like it can be read as "Good news: by using reCAPTCHA, we're now interfering with agents that can solve the regular challenges" or "there's now a flag the application developer can set". This is the difference between me swapping off reCAPTCHA ASAP or just editing my configuration. I have to imagine someone somewhere anticipated the kind of reactions a number of us are collectively feeling (I too don't want to use my phone to browse the web more than I already do) and it feels irresponsible to publish a feature announcement without covering basic information like this for site administrators. Maybe they thought the second line about existing reCAPTCHA customers being moved over clears this up, but "Your existing ... integrations remain exactly as they are today" feels like again, literally, you won't have this new attestation requirement being presented to your users... but then why am I Fraud Defense customer!
• Menu

  MichaelNolan
  I’m trying to use my phone less and less. Ideally I’d like to even switch a dumb phone.But tactics like this will make that nearly impossible if every website starts requiring a QR code scan on a authorized smartphone.
• fireant
  I don't really get how this stops captcha solving as a service, which is the actual way that scaled recaptcha solving is done? Those things are incredibly cheap and are staffed by humans anyway. Instead of selecting grainy busses, they will just scan the image with their phones.
• thekevan
  I will STRONGLY consider not using any site that tries to make me do this.
• Menu

  PyWoody
  What funny timing: After being hounded with CAPTCHAs every time I tried to search from the URL bar for the past week, not two hours ago I switched everything over to DDG. Great work, Google!
• Kim_Bruning
  the mobile phone requirement would mean I end up avoiding sites that use that method. I'm not sure how many friends and family can be convinced, but I can try . (most people tend to give up any and all security measures if it means getting to see the fluffy kitten though, so my hopes aren't very high)
• Menu

  SoKamil
  Google clearly wants only Google approved models to traverse the web.
• mzajc
  As expected, they're bringing WEI back under a different name: https://en.wikipedia.org/wiki/Web_Environment_Integrity
• Menu

  akersten
  Hmm, that QR code workflow doesn't look very accessible. Can we preemptively ADA this thing out of existence somehow?
• Menu

  stupidgeek314
  Why can't an AI scan the QR code? Just fire up an emulator if necessary
• basch
  Is this why google was repeatedly telling me I was displaying patterns of being a bot yesterday because I click too fast? I've never gotten the error message as many times as I did yesterday.
• super256
  Looks like Cloudflare has the only user friendly captcha of them all.
• throwaway85825
  Google has a lot of fraud because they have absolutely no standards when it comes to advertising scams and frauds as the first result. Google is a services company for the global crime industry.
• ACCount37
  Prime "drink verification can" bullshit. If you don't have a Google Approved Phone, the solution is to go fuck yourself. But what else would you expect from modern day and age Google?Traditional CAPTCHA was heading for the graveyard for a while now, because the overlap between the dumbest of users and the smartest of AIs is too severe. But aggressively doubling down on the user-hostile garbage isn't the solution.
• 2001zhaozhao
  Inb4 Google 2027: "we sold 30% more Android devices YoY!"(The extra devices are cheap $30 phones all going into reCAPTCHA solve farms)
• anon
  undefined
• Menu

  x3sphere
  I ditched reCaptcha and switched to Cloudflare Turnstile recently. It’s been a lot more effective. Not sure about this but I won’t be switching back for the time being.
• Menu

  graphememes
  yeah im not doing that
• Menu

  mayama
  The site doesn't mention this. But, are they locking down QR code auth for only safetynet authenticated devices and with mobile number verification?
• aboringusername
  I suppose it's now become a default assumption every customer is going to own a smart phone that complies with this requirement?It seems on iOS you'll even need to download an application, which is quite a bit of friction.In the current economic times, adding minutes onto the user journey is not going to result in increased sales, I suspect the data will prove the opposite.Using a mobile device is bad enough as it is: TOTP, email, SMS codes, 3DS etc, while you can say this is part of the "flow", it's too much. I can see many abandoned journeys from this.
• ifh-hn
  Can I confirm that this is more shit from Google trying to lock people into their ecosystem (or Apples) under the guise security?
• ilia-a
  Another nail in the web anonymity sounds like
• Menu

  amazingamazing
  How are people stopping bots reliably?
• Menu

  arian_
  Google building harder walls against bots while simultaneously building AI agents that need to get through them is peak 2026.
• Menu

  kajman
  This would not have ever been announced while Lina Khan was running the FCC.
• nalekberov
  I am almost certain that labs in India and China have already developed a solution to bypass the “Scan this QR” method.What is easier than pointing a camera at a QR code and commanding and an AI bot to follow the next steps?
• greatgib
  > we enable application providers to deter and mitigate malicious requests by requesting humans to be in the loop using the new QR code-based challenge.I'm so pissed off in advance. I hope that Google die and collapse in sudden bankruptcy before we have to support this crappy challenges that are totally user hostile!
• Menu

  catlikesshrimp
  How do I fit TOR in this? Do anonymous users get to use a more anonymous app?
• Menu

  arewethereyeta
  Two mdashes in the first sentence...hmm.
• oybng
  just how evil can google be?
• ptrl600
  Maybe soon there will be a market for a phone specifically for use as a dummy, to get past all this nonsense.
• Menu

  LoganDark
  Human verification via QR code does not mitigate labor farms.
• eddy-sekorti
  Thanks for sharing
• mrguyorama
  Google and the reCAPTCHA network aren't even that good with fraud prevention. You would think being literally omniscient over the whole internet would make it trivial to catch account takeovers, and Gmail has a proven track record at resisting account takeover, but when we tried to integrate their fraud signals, they were worthless, worse than the rest of the industry, worse than our homegrown trash from a decade ago.Because Google doesn't actually care about preventing fraud, they just want the data you feed them and the fraud feedback you provide. It's all take, no mutual business.
• andrepd
  We are much MUCH closer to "drink verification can" than to the time that greentext was written. Like many things in 2026, it's beyond fucking wild, it's a parody of itself.And I don't see it getting better without government regulation. But states are now weaker than corporations. How can we expect them to take charge?
• scotty79
  "This AI-resistant mitigation challenge to prove human presence is designed to make automated fraud economically unviable."Oh, you sweet, summer child.
• liamwei
  [flagged]