Icon base by Lorc under CC BY 3.0 with modifications to add a gradient
I encountered this for the first time today while attempting to read something on archive.today.
I confirmed that decoding the qrcode using a computer and following the URL it contains is insufficient; the error it gave directed me here which is what the linked screenshot is of.
The old type of captcha remains available too, for now:
OC writeup by @cypherpunks@lemmy.ml
They better not implement that shit as mandatory because:
That is actually a valid point. It would create a new way to exploit users who don't know any better.
My thoughts. All other issues aside, this sounds like a huge, unnercessary, attack vector.
I keep hearing about malicious QR codes, but how does it actually work? Unless there's a serious vulnerability, how is it different from clicking on any link?
It has been a few years since I worked as a junior in offensive security, but that has been something I could never figure out when I looked into it.
Hmm, I guess you could use it for a pretty good phishing attempt. Just show a fake google login page and you're set, or maybe a fake .apk download "to confirm the captcha", but other than that, I don't really see a vector of attack.
This example might shed some light on how malicious QR codes can work.
There's a lot of car parks in my area which have had QR codes stickered to the payment meters, instructing people to use the QR code to pay for their parking. These are council or private car parks, but the code takes you to a site that accurately mimics a usual carpark payment site. So people think they've paid for parking, but have actually sent money to a scammer, and they also end up with a fine for non-payment from the entity that actually owns the carpark.
That's exactly the attack vector.
The ClickFix social engineering attack is very effective:
Remember, not everyone is as tech savvy as us Lemmings.
For some of them, who mainly use their phones for Facebook or whatever, if they go to log into a website, it pops up a QR code, they’d scan it, install whatever potentially malicious software it told them to, then give it whatever access it wanted. Boom, compromised phone.
One step closer to "Drink verification can to continue."
I had this yesterday, I hate it. Switched to the eyeball icon and proceeded on.
Reminder to NOT use or support archive.today or archive.is
Why, what did they...ooohhh
I'm out of the loop, what did you find?
EDIT: I guess you're talking about this? From a first reddit page about why is it down I could find.
The owner did it to themselves, by mounting a surreptitious DDoS campaign and altering the content of the archives to slander people, thus making it an unreliable source. This prompted Wikipedia to (correctly) remove it from all outbound links.
It's moot if it's online anymore or not - it's not a valid archive.
Fuck Sundar Pichai.
Inaction will do nothing. Commenting and complaining is inaction. Get your family on degoogled ROMs. Use Lineage or iode for devices that are supported, have them buy a used pixel for Graphene or Calyx otherwise. Have them complain to lawmakers. The more people who are with us, the less people to tell us to "get over it and be normal".
"Must"
Eye icon says not must.
Yet.
Absolutely. We should never expect them to be anything less than maximum evil when given the opportunity. If they could assume 100% of people used their OS, or the OS of a carefully studied (or complicit) competitor, we know they would.
The word you're looking for is .. abomination.
"We've trained enough on crosswalks, fire hydrants, and motorbikes... Back to invasive data collection!"
On a serious note, this is the third time I've seen someone getting that new check. It's probably a trial run/slow rollout but they can't be removing accessibility features right? Alienating people because they can't scan seems evil.
Seems like a bear-trashcan problem. There's overlap between the most intelligent bot and least intelligent human.
Speaking of the crossroads and fire hydrants and motorbikes... I fucking hate recaptcha these days. I used to be able to go through those annoying fuckers first try. Now it's either I sit through that slow as hell sequence that fades out and in new pictures at a glacial pace and lose it, or I go through the ones where I'm expected to select several tiles in several big pictures (no longer just a single one) and inevitably I always fail this one. It's gotten so bad I've resorted to audio captchas in a few cases. Am I the only one?
The tile select ones never work for me. I just click random squares until the fading one comes up. And that's only if I really care about whatever link it is. hCaptcha and arkoslabs are so much better
I regularly use two websites which use recaptcha, one is necessary for work and the other is no-ip. The work one is annoying, it's almost every other day that I have to go through it.
Locking down access for everyone not using US based services, should be illegal for sites (also) intended for the European market, quite frankly.
Captchas are human rights violations
EA: "What? You guys don't have phones?"
Google: "Oooh! Write that down! Write that down!"
It was blizzard that said that, not ea :p
Yeah... Even IDK why I put EA when I was thinking of Diablo. They just suck that much. 🤷♂️
I don't like it but I saw this coming.
