“How do we parse that data? Let’s mess with it a little so it becomes code and then we can run it.”

Hasn’t been a good idea back when people used this approach to “parse” JSON, still isn’t a good idea now…

#CommandInjection

RE: https://mstdn.social/@jschauma/116610268796045193

So many levels of wrong here. Google’s newest reCAPTCHA “experiment“ tells people to scan a QR code in order to verify that they are human. Yeah, like scanning a QR code displayed by some random website is a good idea in the first place.

But of course your ability to scan the code isn’t what verifies your human nature. That QR code merely tells you that you need the reCAPTCHA app (on iOS) or newest Google Play services (on Android). In other words, you have to verify that you own a mobile device and are providing data to Google. Which they promise not to share with the website, like that’s what I’m worried about.

This obviously excludes people who don’t have a smartphone, have a de-Googled smartphone or simply don’t want to feed their data to Google. And it again ties a large chunk of the web to Google services. If reCAPTCHA wasn’t evil before (a questionable statement), it definitely is now.