Hacker News Reader

Comment by doodlesdev | Hacker News Reader

“Piracy is a service problem.” - Gabe Newell

Also, Arkose Labs CAPTCHA (what HBO Max is using) is awful, please don't use it. There's reCAPTCHA, hCAPTCHA, mCAPTCHA, and now even Cloudflare Turnstile. Or better yet, recognize your costumers can still download the movie for free whether your service exists or not and adapt your strategy to provide them with content easier :)

View on HN

Isn't hCaptcha the one that asks you "Click on all of the bicycles" and then shows a bunch of AI-generated gibberish where fucking none of them is a bicycle but you have to click on the ones that are the most bicycle-like? Because that's fucking garbage and I wish everyone using it would die in a fire.

In case someone as been lucky enough to never have used hCaptcha, it looks like this: https://twitter.com/shaunkruger/status/1660671272672722945

I don't remember the name, but I've seen a Captcha that asks you stuff like "click on the Zerki", "select the Sploinq" with AI images and I have no idea what shape most looks like a Zerki (there was more than one shape with hard edges!) or a Sploinq. And I have a linguistics minor. :(

hCaptcha has absolutely wanted people to click on objects that do not exist even on a conceptual level.

https://www.vice.com/en/article/xgwy5n/captcha-is-asking-use...

hCaptcha is garbage. Also, they use some blockchain/token stuff for no reason, at least the last time I looked.

edit: ah they seemed to have removed all traces of the token stuff from their website, except some small remains in the docs - https://docs.hcaptcha.com/faq/#what-is-one-hmt-worth . I guess they pivoted away, reasonably.

Still better than the google malware that lets you through based on how well they can track you around the web rather than based on a legitimately solvable challenge. At least, I noticed that I never saw anyone but myself getting any challenge at all, let alone the worst CAPTCHAs that google has to offer. Same IP address, the only difference that I could find is not having "auto delete cookies" installed in the browser (wipes localstorage etc. after you closed all tabs of non-whitelisted sites for some seconds).

hCAPTCHA has always been easily solvable for me, haven't seen the one you linked yet but that also looks quite trivial

Ideally one just doesn't use CAPTCHAs at all, but my colleagues disagree and so that's unfortunately the company policy to recommend against login brute force and such

HBO uses Captcha to prevent bots stealing accounts by brute-forcing passwords/reused passwords from other sites.

In other words. It's not anti-piracy mechanism, it's protection against account stealing.

That's what I don't get. What value is there in such an account? The fear that random persons can watch videos without paying until the owner notices they can't stream because someone else is using the account? Are these accounts held for ransom because the owner doesn't want to lose their watchlist? Can you purchase gift subscriptions using the stored payment method perhaps?

It's a nuisance obviously, but for such a tiny fraction of people, honestly not bad if they notice that they got phished or use a password guessable within a handful of tries.

I think they are resold on darknet or something.

Sure, but my question was to what end, what damage is actually occurring

There should be an exemption from the Captcha for users with strong passwords. And if this spreads maybe we can just annoy everyone into good security practices.

Strong password is still bad if you reuse it on a website with a leaked DB.

Or use https://friendlycaptcha.com/.

Reply on news.ycombinator.com