The team behind GrapheneOS, a security-focused Android alternative, is calling out Google and Apple for what they describe as anti-competitive behavior dressed up as a security feature.

With the latest Google reCAPTCHA upgrade, if you’re on a Windows PC, Linux machine, or pretty much anything that isn’t a smartphone, you may soon be asked to scan a QR code with your phone to prove you’re human. 

Not just any phone, though. It has to be an Apple device or a Google-certified Android device.

Why should you care about this?

Most coverage of this feature treats it as a minor CAPTCHA update. It’s not. What Google is really doing is bringing hardware attestation to the web. That’s a system where your device has to prove to a server that it’s running approved hardware and software.

Apple uses App Attest, and Google has its Play Integrity API, which these companies use to verify apps. Banks and government services have quietly been adopting these systems for a while now. 

Now, they want to do the same for the web. The result is that if you’re using a less ordinary phone or a more private operating system like GrapheneOS, more and more apps and services simply won’t work for you.

Google is already tightening its APK sideloading rules, and now it seems that the company wants to monopolize the web too. 

So who gets locked out?

Google’s Play Integrity API bans GrapheneOS, which is actually more secure than most certified devices. Meanwhile, it happily approves Android phones that haven’t received a security patch in years. That alone tells you this isn’t really about security.

What it is about is control. Google defines what counts as a certified Android device, and those rules conveniently require manufacturers to bundle Google’s own apps and services.

The GrapheneOS team has blasted Google, saying that this is about enforcing monopolies, not protecting users. And with reCAPTCHA powering a massive chunk of the web, that’s a lot of power for two companies to hold over everyone’s browsing experience.