Hacker News Reader

Comment by tptacek | Hacker News Reader

Lots of sites use "DRM" (content protection, obfuscation) techniques to fingerprint for anti-abuse. Somewhere, there's a truly excellent writeup from (I think?) Mike Hearn about the work they had to do to build anti-abuse for Youtube; it involved nested VMs implemented in Javascript.

View on HN

I’ve never heard obfuscation referred to as DRM. The author is referring to the DRM browser checks.

> Specfically, it looks for Widevine, PlayReady, Clearkey, and Adobe Primetime

DRM and obfuscation are traditionally related because unobfuscated DRM wouldn't be effective for long. Hardware assisted DRM is newer and a bit different.

Perhaps you mean encryption, not obfuscation.

For content-controlled code, meaningful encryption tend to imply obfuscation.

That talk sounds interesting. I tried searching but didn't find anything like that about a nested VMs in js. Any idea if the talk is online. I am curious to see why they needed nested VMs.

What are they trying to detect?

Non-interactive account signups, in their case. Success measured in the black market price for fresh working accounts, if I remember correctly.

Later

[wait, no, I'm wrong about that link]

Later

[wait, no, I was wrong about being wrong; here's the link. Thanks, Pinboard!]

https://moderncrypto.org/mail-archive/messaging/2014/000780....

Great read in the link

Was that nesting server side?

No, it was all content Javascript.

Reply on news.ycombinator.com