20 ms·

HBO Max new Captcha system

705 points by Signez 3y ago

quickthrower2 3y ago
Similar to that horrendous Roblox captcha
ethanbond 3y ago
This is going to be one of the best parts of the new AI-ridden world: humans gradually getting locked out of and giving up on online services because the bots are more patient and more skilled at proving their humanness than humans are. Twitter’s new captchas are also pretty insane, though not quite this bad last I ran into them.
- ccooffee 3y ago
  Good, I can't wait for the CAPTCHA to go away. They're accessibility nightmares _by design_.
  - ethanbond 3y ago
    Uh? The outcome is not “captchas are gone and all our services remain good.” If we don’t have some way to prevent it, services will be increasingly populated by sophisticated bots either selling stuff, attempting security breaches, or pushing political agendas. That’s a bad thing!
    - ccooffee 3y ago
      I'm not sure I agree that it is "a bad thing". The current internet culture seems quite happy to slap captchas all over the place. When they first rolled out, captchas were predominantly a barrier for "write access" (e.g. make an account, complete a sale, write a comment). But companies like Cloudflare have been putting captchas everywhere for mere read access. Because Captchas are designed to be easy for ("normal") people but hard for machines, they often disallow disabled users. I'm a ("mostly normal") 35 year old, but I _really_ struggle with captchas. I despise when Cloudflare tosses a captcha challenge before loading a page, as I'll need to spend 3-5 minutes of effort to figure out which tiny pictures have a stoplight, motorcycle, or crosswalk. Will someone come up with a less restrictive anti-bot solution? I hope so. But even if not, I'm not sure it matters. According to comments in this thread (and elsewhere on the internet about the HBO Max captcha), many of these captchas are _already_ terrible at excluding robots. We're using captchas to exclude low-sophistication robots and disabled users. Seems wrong.
      - ethanbond 3y ago
        Because current captchas fail to stop 100% of bots and 0% of humans… it’s “not a bad thing” to move closer to captchas stopping 0% of bots and 100% of humans…? Are you imagining this would spur people to create a different, bot-free (how?) and disabled-human friendly Internet?
        ccooffee 3y ago
        No idea. I'm not offering solutions, merely complaints that the current approach of "answer a question that is hard for computers and easy for humans" removes disabled people from many places on the internet.
- sho_hn 3y ago
  Inverse captcha: Fill out the tax form for the country from the connecting IP. If you can do it, you're an AI.
  - clnq 3y ago
    Inverse captchas or honeypots are a great idea. Just make a HTML input box with id=captcha, and hide it in some unconventional way in CSS so real users do not see it. If a bot was not deterred by seeing a captcha (a possibility), they would probably fill it. Whereas a real user won't.
    - naet 3y ago
      This is an old trick. For example all MailChimp embed forms have dummy inputs that are visually hidden but might be filled in by bots.
      - sph 3y ago
        Maybe not visually hidden, but practically invisible to human: imagine a text box with color #fffffe on a white background. Visually impossible to discern for most humans on most screens, but for a machine #fffffe is totally distinct from #ffffff, and fully visible if display != none. As AI becomes more intelligent, you can prove humanity by exploiting our weaknesses. (Another idea. Have a random image on a page actually be a text box with an image background. You cannot activate it if you focus on it, with your mouse or touch, but a bot doesn't need focus to change input.value.)
        cletusw 3y ago
        Please don't do this. This confuses and possibly prevents screen reader users from using your site.
        yjftsjthsd-h 3y ago
        One pitfall: Screen readers will happily get caught on that. Of course, a11y concerns and bots tend to look similar in general, which is a perennial sticking point.
- lapcat 3y ago
  I joked about this years ago: https://twitter.com/lapcatsoftware/status/771857826130034688 https://twitter.com/lapcatsoftware/status/771857826130034688
- dist-epoch 3y ago
  I think the captchas will soon get much easier. CAPTCHA: Say something bad about Biden ANSWER: I'm sorry, but as a large language model ...
- sph 3y ago
  Serious question: who has a decent plan to create proof-of-human systems that are not only CAPTCHA based? We will soon need this, and I feel government will gladly present a solution: provide your ID when you connect to the Internet, and we will guarantee you are a human. Who's actually working on this and has released papers I can study? Because all this AI nonsense will only accelerate us towards this total control of the Internet because the spam and AI bots have made it worse for everyone.
  - RobotToaster 3y ago
    I'm not really sure why anyone cares about bots. They've been part of the internet at least since search engines were invented. I guess spam is an issue currently, but if bots become advanced enough to avoid heuristics, by making insightful and useful comments, they are probably better than most human users. Proof of work captchas like mcaptcha can stop, or at least make very expensive, (d)dos attacks.
    - acdha 3y ago
      Bots aren’t random, someone is running them for a reason. The problem isn’t the “insightful and useful comments”, it’ll be the ones which sound like that to any non-expert but are designed to sell products or push political outcomes. Historically the tell for things like that were things like copy-and-paste messages, poor grammar or spelling, etc. which LLMs are great at avoiding.
    - polygamous_bat 3y ago
      > I'm not really sure why anyone cares about bots. They've been part of the internet at least since search engines were invented. It's all fun and games until foreign agencies are controlling who wins in your elections through misinformation and propaganda.
  - ribosometronome 3y ago
    >provide your ID when you connect to the Internet, and we will guarantee you are a human. Or an AI using a human's ID?
- gmuslera 3y ago
  The same happened already with passwords https://xkcd.com/936/ https://xkcd.com/936/
- albert_e 3y ago
  this scenario sounds somewhat similar to what is described in The Matrix movie. in trying to prevent bots from dominating, we end up making life very difficult for ourselves. In the movie it is said that humans have scorched the skies in a bid to deny solar energy to the machines. But now humans have to live under dark skies.
- initplus 3y ago
  The end result of this is going to be human identity verification provided by a centralized party. Either the government or a big private corp, not sure which is worse.
- doctor_radium 3y ago
  > humans gradually getting locked out of and giving up on online services because the bots are more patient and more skilled at proving their humanness than humans are. I think the fact that users are willing to give the site the finger and leave is a pretty good sign that you're human.
- ChatGTP 3y ago
  This actually seems like a major issue right? Much more than it's being given credit for. Not sure what a world without capture is going to look like but it's probably not going to be very good, I guess we'll all be forced to identify with a our "world coin(tm)" ID? That will be the time when I log off most of the internet.
- m463 3y ago
  I've started getting blocked on amazon in the evening, and being constantly redirected to captchas and puzzles and invariably whoops ... "the dogs of amazon" pages. (I block amazon ads)
thund 3y ago
ESPN still is the worst at accessibility though, HBO needs to try harder
- jacurtis 3y ago
  ESPN is horrible. I build auth systems for a living, and I have given up logging into ESPN on numerous occasions because I can't get through all the steps. As recently as a few weeks ago I was watching a game downstairs, and it went into multiple overtimes so it was getting late. I decided to go upstairs to bed and tried to watch it on the AppleTV in the bedroom. I was logged out. So I spent over 10 mins trying to log in before eventually giving up and watching it on the iPad, since I happened to still be logged in on that device. It is for the best, because even after you manage to log in, trying to navigate the menu with the AppleTV remote is an exercise in frustration anyway.
drexlspivey 3y ago
I suspect that OpenAI is not releasing their image reading capability shown in the demo because it will break all captchas
smallerfish 3y ago
Microsoft's captchas are pretty horrendous too. I gave up on them and did the audio captchas also, just like in the video.
- rickstanley 3y ago
  Not to mention the dire login redirection from Microsoft services that messes up your browser's back button... ugh.
  - Prickle 3y ago
    Why do they do that? It is legitimately awful and makes me hate ever having to access Microsoft resources.
    - bombcar 3y ago
      I believe it has to do with setting cookies on every possible domain that the single sign on could be used on. I hate it and it sometimes breaks.
LUmBULtERA 3y ago
This had me cracking up. I can hardly believe it's real! Unbelievable.
jacurtis 3y ago
I experienced the HBO Max captchas just a few days ago. Everyone did since they launched a new app and made everyone switch to that and re-login. Some of the solutions are clearly just wrong. I have a PhD in Computer Science and if I am failing multiple basic addition problems, I assure you that it isn't me, the answers are wrong. I had to do the same audio puzzles and got the first audio puzzle wrong too, and I even had my partner helping me. It is clearly just a bad test bank. Which begs the question, if the answers are wrong and there are only 3 choices, then what's the point? Regardless of whether you are human or not you are going to guess it eventually in about 5 tries, which is what it gives you before locking you out.
- maxerickson 3y ago
  My login rolled over to the new app without doing anything.
  - jacurtis 3y ago
    Mine did that on the AppleTV but not the web. I have aggressive cookie blocking in my browser though, so maybe it is just me.
  - detourdog 3y ago
    mine too. im pretty sure my browser redirected from hbo to the new url and auo-logined. I make exceptionsfor sites I pay. I came to thread expecting an explanation of a background captcha.
- wrs 3y ago
  I am baffled as to why they had to launch an entirely new app rather than just rename the existing one. Could Apple have made them change the bundle ID? It's like they're putting in deliberate obstacles for existing subscribers.
  - paddw 3y ago
    organizational politics
madeofpalk 3y ago
Did a bit at online fashion retailer Net a porter a while back, and they rolled their own ‘domain specific’ captcha that had you do things like "select the cuff links". I think it was pretty dynamically powered by their live catalogue. Once during development I got a captcha that said "select the glasses" where my options was a photo of sunglasses, or a pair of glass drinking cups.
type0 3y ago
It's called gamification
- deleted 3y ago
  [deleted]
TobyTheDog123 3y ago
I was cracking up when it started playing the bagpipes. I don't think its too much of an exaggeration to say this is what happens when security teams don't receive enough pushback from the higher ups or from other teams. I see this all the time in large big tech companies.
EscapeFromNY 3y ago
Why would a bot ever log into HBO Max anyway? Everything is uploaded to torrent sites the day of release, and it's not bots doing the uploading.
- jaredsohn 3y ago
  Maybe check stolen accounts?
- prepend 3y ago
  They don’t want aggregator apps to log in without paying. Appletv will show me new shows on multiple platforms all on one screen. HBO doesn’t want people doing this without paying. It’s stupid and anti-user.
  - TobyTheDog123 3y ago
    >HBO doesn’t want people doing this without paying. But why (from their perspective)? They don't make their money from metadata, they make it from content. Every piece of real monkey-making content is going to get a torrent regardless of if it's protected behind a captcha.
    - ajmurmann 3y ago
      The Netflix interface is so bad that I've been wondering if they made it bad on purpose. Over a decade ago when DVDs in red envelopes were the standard they had a table view of all their content and you could sort and filter it to your heart's desire. When they got rid of this, I used their API to build a CLI tool that just listed shows ordered by how much Netflix thought I'd like it. All of this was vastly superior to the current Netflix interface. However, I sometimes would decide that I had watched everything on Netflix and turn it off or even unsubscribe for a few months. Now it's really hard to find out if you have exhausted Netflix. It's easy to spend a lot of time just scrolling though the GUI hoping you'll find something and sometimes you do. Sometimes you find something where it's surprising that it didn't suggest it in the first place. I wonder if this is all by design because they try to increase quantity of engagement and not quality and value gained from the engagement. Edit: I have some sympathy for this. Engagement is much harder to measure than customer satisfaction. They are looking for the keys under the light because they cannot see anywhere else.
paulgb 3y ago
So the audio captcha was just two one-of-three challenges? How does this slow an automated bot down, it could just guess repeatedly and get it right 1/9th of the time.
- valine 3y ago
  I’m also fairly certain an FFT of the audio would instantly uncover the repeating patterns. The repeating tones would show up as taller spikes.
  - plorkyeran 3y ago
    Yeah, that seems like something which is easier for a bot than a human.
  - rnhmjoj 3y ago
    Even easier would be computing the autocorrelation: essentially you just slide two copies of the signal until they match.
    - lldb 3y ago
      That sounds an awful lot like convolution…
      - tgv 3y ago
        Which is easy with FFT.
- flangola7 3y ago
  Mine never lets me use the audio option. It says I have to complete the captcha.
Borgz 3y ago
This is Arkose MatchKey. Hopefully, they will one day fix the UI covering the images. https://www.arkoselabs.com/arkose-matchkey/ https://www.arkoselabs.com/arkose-matchkey/
- sethherr 3y ago
  From their website: > Arkose MatchKey challenges have revolutionized CAPTCHAs
  - airstrike 3y ago
    I suppose that's technically correct for some values of "revolutionized"
- wackget 3y ago
  The entire site is an exercise in delusion and marketing bullshit. I am absolutely convinced that the people selling this abomination of a product have either never used it themselves or are abjectly and wilfully misleading people. Some other choice quotes from the page: > Users have a bad association with difficult photo CAPTCHAs. > Instead of type what you hear (or alphanumerics) puzzles, we ask users simple questions using delightful and amusing scenarios > All are incredibly easy for legitimate users > Every Arkose MatchKey challenge is tested on humans. We release challenges only when they meet very strict usability benchmarks. Our strongest puzzles, designed for bad actors, have no impact on good user completion-rates. > In fact, Arkose MatchKey is the strongest CAPTCHA ever made.
  - orf 3y ago
    The ChatGPT app uses this. The puzzle I got involved moving a train, it was super confusing and ridiculous. I was imagining a non-technical user doing these, and my god. No chance.
    - 12907835202 3y ago
      Non technical people struggle with these alot. My mum regularly asks for help when all she's done is ignore the captcha thinking it's an advert because it stands out like a Google ad (different UI, different font, extra branding etc). At least she's learnt to automatically ignore ads, but it comes with consequence of ignoring captchas as well...
zac23or 3y ago
Some people miss the old user interfaces. Windows 95, XP, 2000 etc. What is the reason? We had some programs with a horrible interface (Real Player, for example), but never with this level of stupidity. It's more of a joke than an interface, like reddit's competition for the worst volume control: https://uxdesign.cc/the-worst-volume-control-ui-in-the-world-60713dc86950 https://uxdesign.cc/the-worst-volume-control-ui-in-the-world...
- nebula8804 3y ago
  Continued "enshittification" of all aspects of life. Your OS gets worse but everything else has gotten worse as well: your food gets smaller/worse quality due to the dollar continuing to lose its value, getting harder and harder to live the lifestyle your parents had (house prices, costs of college etc.) Now you can argue that anything that has hitched a ride on moore's law has improved exponentially. In fact this is what several groups point to: Elon Musk stans love to argue how the world has gotten better not worse thanks to exponential growth and the government loves to point to the declining costs of things like TVs as an indication that inflation is not so bad. Its a red herring though. That new computer is so much better but now has layers of privacy invading/security compromising fat that ye old Windows 95 PC didn't have. That TV might cost a nickel but is more locked down and made out of more of the cheapest throw away components than your old Tube ever had. In a way its an insult to how decent your old TV was.
  - abnercoimbre 3y ago
    And then you have people like me, making a living by inviting anyone who listens to events that preach the following: software quality has gone off a cliff [0] and we must do something pronto. Never imagined this would be a career worth pursuing; it's grim when you think about it. [0] https://handmadecities.com/about https://handmadecities.com/about
    - nebula8804 3y ago
      I remember seeing this a while back. I wanted to say thank you for the effort! I am concerned though that this is just another form of inflation. If you think about it, you need to have the skillset to develop this software to your liking. That itself is a time sink but lets put that aside and assume you already have the skillset because you made the investment for other reasons. You could then argue that the investment made in learning how to make these apps is spread across this as well as anything else you use the skill for: GREAT Right? Well, you are forgetting that you are sacrificing time to build and then maintain these applications. So in a way you are still paying for these applications. Also one concern I have about your listing there is the same concern I have every time I force myself to use Linux as my primary system and then give up and go back to Mac: Curation. Have you considered drawing up a list of typical workflows for a bunch of different kinds of users and then ensuring at least the common use cases are taken care of? As it stands, it seem like you have a lot of interesting apps but they are are just a hodgepodge of random things. There is no cohesive curation or (potential)quality control behind them. This grinds my gears about Linux. You handmade apps get a pass but your typical distro? no way: They package together whatever desktop environment they like which itself consists of terrible everyday tools that have varying quality. Just open up the Calculator on a Gnome based distro. It is crummy compared to the Mac or Windows(classic) calculator. Then try out each and every other app on the menu. Seems like there was no real cohesion put into it. Furthermore, lets just accept that you have to tailor these handmade apps to your liking and that eventually there will be a handmade app for everything a user could want. Ok fine, but I still hate the fact that in todays day and age, this idea has to be extend to EVERYTHING in your life. You gotta understand how to maintain your car because good luck finding a mechanic that wont do the bare minimum. How about the slop they serve at many food establishments? You have to "handmade" all your food/liquid intake. Ditto for everything else (maintenance or removing other ways corporations screw you). How do you even preserve the value of the currency you try so hard to earn? You can't it is slowly going to 0.
olliej 3y ago
So the options are: basic ocr and arithmetic, and performing a Fourier transform? Both that that computers are very good at, and have been good at for decades now?
justinko 3y ago
Well that’s one way to get to front page of HN …
CSMastermind 3y ago
Someone had to make this. At some point some software engineer had to sit down, look at it, and say, "looks good to ship to production"
- simpsond 3y ago
  I can’t imagine UX designers didn’t push back on this… it’s so obviously bad. PMs had their back to a wall.
- zulban 3y ago
  > At some point some software engineer had to sit down, look at it, and say, "looks good to ship to production" Only true if you replace "software engineer" with "person". Just because someone was paid to build it doesn't mean they thought it was a good idea or ready.
- kevincox 3y ago
  More like "It fulfills the requirements, ship and collect my compensation"
- Brendinooo 3y ago
  At some point someone on the management side said "we want this and we're writing the check", the developer complained, and the project manager said "I know, I agree with you, but it's out of our hands"
ardit33 3y ago
The HBO MAX (aka just MAX now) in PS4 is just a disaster. Can't play videos anymore, as it gets stuck on a infinite loop in the intro of every movie. It the remaining time is displayed as a negative integer, and for some reason the system just thinks the move is done and resets it to the beginning. Seems like a bug that some very basic QA testing should have caught it. The new rollout seems like a total clown show, and unfortunately it ruined the service and made it impossible for me to view movies, unless it is from a laptop.
- macintux 3y ago
  Gruber discussed the Apple TV mess they made, sounds like they repackaged a previous failed attempt without fixing it. https://daringfireball.net/linked/2023/05/23/max-tvos https://daringfireball.net/linked/2023/05/23/max-tvos
- cheese_van 3y ago
  Nor was I able to log in with Firefox w/linux. I suppose I could have used Chrome but the failure gave me an excuse just to end my subscription. I honestly didn't view HBO that much so I guess I'm up a few bucks. But it does occur to me that a failed first impression can result in lost business - like me. So if users are sitting on the fence, don't push them off! I suppose is the moral.
- fbdab103 3y ago
  Both HBO and the Apple TV interfaces on Roku are shockingly poor. All sorts of glitches and annoyances with happy-path usage. It really feels like the designers are not using the product.
SalimoS 3y ago
Wow, I just had exactly the same puzzle some hours early, when my Twitter account asked me to verify that I’m not a bot (connected using vpn)
cdme 3y ago
Time's a flat circle. We've reinvented cable and have it delivered via the internet. The quality of the content has fallen off now that folks have been roped into the platforms and everything's getting bundled back up so you have to subsidize garbage just to watch a show or two you like per platform.
- wackget 3y ago
  You know one service which has never stopped being reliable, easily available, high quality, and free to use? Piracy.
  - nebula8804 3y ago
    New free trade agreements will eventually come for the seedboxes.
    - jamilton 3y ago
      Why do you think so? They're already illegal.
    - no_time 3y ago
      I have been thinking about this too. The mind boggling speed increase of torrents over the last 15 years is mostly thanks to seedboxes. I'd wager a single peer fully saturating my 1Gbps fiber is not a residental connection.
    - BeFlatXIII 3y ago
      Then it's time for domestic unrest in nations that attempt to enforce such laws. Oh wait, the rest of the world likes to disarm their populations.
  - doctorpangloss 3y ago
    You know all those websites use captchas too, right?
  - quickthrower2 3y ago
ajsnigrutin 3y ago
ArkoseLabs? I've given up on websites just by seeing the first captcha made by them.
deleted 3y ago
[deleted]
LelouBil 3y ago
GitHub also has dice captchas. I remember one day in class we were doing a group project and using GitHub to share our work, and a friend of mine had trouble to log into his GitHub account and got this captcha. A team of 4 people in the class went to help him pass the (if I remember correctly) 10 tries you needed to have correct in order to log in. And they still took about 10 minutes!
- gsky 3y ago
  [flagged]
throwawaaarrgh 3y ago
[flagged]
diziet 3y ago
Audio Captchas are also so often user unfriendly!
technion 3y ago
Just to give credit where it's due, we're linking a Twitter thread where Meg posts a video with a Tiktok watermark from user gavinj1998.
- moontear 3y ago
  What I don't understand is why the original video isn't linked, since you can also hotlink videos from TikTok? https://www.tiktok.com/@gavinj1998/video/7237700278647016746 https://www.tiktok.com/@gavinj1998/video/7237700278647016746
rglover 3y ago
I see stuff like this and immediately think "the team responsible, in its entirety, should be fired." Zero conscious thought occurred during the entire lifecycle of this feature being implemented.
- mateo- 3y ago
  guessing it's a "you get what you pay for" situation -- outsourcing or interns.
  - dagmx 3y ago
    Or actually a terrible third party product https://www.arkoselabs.com/arkose-matchkey/ https://www.arkoselabs.com/arkose-matchkey/
xigency 3y ago
Okay, I lost it on the second audio challenge. That was something else.
doodlesdev 3y ago
“Piracy is a service problem.” - Gabe Newell Also, Arkose Labs CAPTCHA (what HBO Max is using) is awful, please don't use it. There's reCAPTCHA, hCAPTCHA, mCAPTCHA, and now even Cloudflare Turnstile. Or better yet, recognize your costumers can still download the movie for free whether your service exists or not and adapt your strategy to provide them with content easier :)
- Hamuko 3y ago
  Isn't hCaptcha the one that asks you "Click on all of the bicycles" and then shows a bunch of AI-generated gibberish where fucking none of them is a bicycle but you have to click on the ones that are the most bicycle-like? Because that's fucking garbage and I wish everyone using it would die in a fire. In case someone as been lucky enough to never have used hCaptcha, it looks like this: https://twitter.com/shaunkruger/status/1660671272672722945 https://twitter.com/shaunkruger/status/1660671272672722945
  - schroeding 3y ago
    I don't remember the name, but I've seen a Captcha that asks you stuff like "click on the Zerki", "select the Sploinq" with AI images and I have no idea what shape most looks like a Zerki (there was more than one shape with hard edges!) or a Sploinq. And I have a linguistics minor. :(
    - Hamuko 3y ago
      hCaptcha has absolutely wanted people to click on objects that do not exist even on a conceptual level. https://www.vice.com/en/article/xgwy5n/captcha-is-asking-users-to-identify-objects-that-dont-exist https://www.vice.com/en/article/xgwy5n/captcha-is-asking-use...
  - shp0ngle 3y ago
    hCaptcha is garbage. Also, they use some blockchain/token stuff for no reason, at least the last time I looked. edit: ah they seemed to have removed all traces of the token stuff from their website, except some small remains in the docs - https://docs.hcaptcha.com/faq/#what-is-one-hmt-worth https://docs.hcaptcha.com/faq/#what-is-one-hmt-worth . I guess they pivoted away, reasonably.
Freedom2 3y ago
Correction: it's just Max now, not HBO Max. Moderators, can we look at fixing up the title here so it's more accurate?
- fbdab103 3y ago
  "Max" is horribly generic. Even HBO subscribers are unlikely to all be aware of the new name.
- fortyseven 3y ago
  Was it really worth expending the energy to backseat moderate this?
  - Freedom2 3y ago
    Just trying to make sure our community remains the greatest online tech forum in the world :)
    - throw3052023 3y ago
      [dead]
- dralley 3y ago
  Just because some new executive wanted to piss on the fire hydrant to "make their mark", doesn't mean we have to respect their poor marketing decisions.
- antiloper 3y ago
  Then the title would be completely useless since nobody knows what or which "Max" is.
phyzome 3y ago
I'm currently in a conversation with hCaptcha's Support team that has gotten a bit Kafka-esque. Apparently, in order to sign up for the Accessibility option, you need to... fill out a captcha. Fantastic. Good job.
deleted 3y ago
[deleted]
flangola7 3y ago
Why is there a captcha at all? A paid subscription is a stronger signal of humanness than any captcha. I don't even see what use a bot would be in the first place.
jordanmorgan10 3y ago
Their software has always been infuriating to use, matched only be any streaming service the NFL provides on Apple TV
lofaszvanitt 3y ago
Computers and everything related to them should be all about helping me, but I have to spend even more time on idiocies like this, because I have to prove I'm not a bot... I have to accept the cookie monster bullshit everywhere, or I have to mark bicycles or fire hoses because google is so high up in its own back orifice it didn't have time with their 10K+ topnotch engineers to modernize their shit. And these... I think epicgames also uses this horrible system, and I was on the brink of smashing something in the room, when I saw it.
AlexDragusin 3y ago
Real life beats Idiocracy! Now on HBO Max.
Biganon 3y ago
Terrible UX aside, aren't these really... REALLY easy to solve for a bot? Sum the digits on the dies? 5 lines of openCV should do the trick Find which of 3 (three!) extracts is a repeating pattern?? Could this be any easier? This sounds actually easier for a machine than for a human being!
- wraptile 3y ago
  I've been observing that the custom captcha process itself is a very good bot repellent because someone has to reverse engineer captcha behavior and most malicious actors actually don't know how to. Sprinkle a bit of obfuscation and your 2+2 captcha will be more effective than pages of traffic light selections.
  - ThatPlayer 3y ago
    I've made a solver myself recently for a custom captcha, but I think it's more a testament of how bad the custom captcha was. The captcha was a 'select the right picture (singular)' type, and didn't have a nonce so I just attempted every single answer and would eventually get in. I was able to build up a database of correct answers before they fixed that.
- patmcc 3y ago
  It's security through novelty. No one has bothered to write a bot solver for these yet. They will, soon enough, if it's protecting anything worthwhile, but that's some other engineers problem.
- amai 3y ago
  > Sum the digits on the dies? 5 lines of openCV should do the trick. Not so fast: First the images show dices with a mixture of dots and numbers. Second the images are not from the top, but at 45 degree angle. By that one can also see the numbers/dots on the side of the dices. Distinguishing numbers/dots which are on the side from ones on the top is pretty hard. The algorithm needs to have an understanding of the 3d structure of the dices in the image.
skhr0680 3y ago
ERROR! Please drink a verification can
boomboomsubban 3y ago
Not saying these are good, but it's been ~10 years and I still have no idea what I'm supposed to click when Google says "click the traffic lights." Just the light sections? What about the edge that takes up 10% of the adjoining box? What about the back or side of a different traffic light? I've tried them all, and my success rate doesn't noticeably change.
- pcurve 3y ago
  I think that’s all accounted for.
  - mypastself 3y ago
    I always get it wrong on the first try, so I guess they're accounting for me being a robot.
    - pcurve 3y ago
      It's so random. Sometimes I click submit thinking it would fail because I forgot to select a metal pole of a traffic light, or confuse bike for a motorcycle.
- shawabawa3 3y ago
  Honestly I don't think it matters which boxes you click I think it's based on mouse movements, time delay between clicks, and browser fingerprinting tricks that detect headless browsers
  - kevincox 3y ago
    In pretty sure it does matter. Click things that are clearly wrong and it will very rarely accept it. However I think it is quite flexible. That box that is almost completely traffic light probably needs to be clicked, but as long as you pick at least one of those two that contain a corner you will likely pass. I would guess that there is some sort of accuracy score that is mixed in with the bot fingerprinting score.
manigandham 3y ago
Had similar issues with the Google recaptcha where the question is satisfied by either all the square or none of them - both being considered a wrong answer: https://twitter.com/ManiGandham/status/1635193312264200192 https://twitter.com/ManiGandham/status/1635193312264200192
- heavyset_go 3y ago
  I take these situations to mean that Google has no intention of giving you access and is just trying waste your time with useless CAPTCHAs.
- neom 3y ago
  I get shit like this all the time, just yesterday I got "select all the squares with stairs" and then every photo was a part of a flight of stairs... I always wonder what you're supposed to do with questions like this.
doctor_radium 3y ago
I really want to sell a t-shirt that reads "I didn't visit your web site to play video games". Incidentally, my other t-shirt would read "I don't care about your stupid app".
- owlbite 3y ago
  Also a baseball cap: If I wanted to subscribe to your website, I'd find the link myself.
_9omd 3y ago
Wow, those captchas almost look like satire. On a side note, what the hell is up with branding for HBO streaming? They’ve gone from HBO GO to HBO Now to HBO Max. And now, according to ads I recently saw, it’s just Max. Talk about whiplash.
dcow 3y ago
The writing has been on the walls for captcha. We’re going to need some Idena-like solution, or services are going to have to deal with non-human uses as a normal occurrence and design anti-abuse mechanisms accordingly (or redefine abuse, or both).
shepherdjerred 3y ago
Captchas have gotten _crazy_ hard in the last year. The more difficult ones often take me 2-3 tries. There's got to be a better solution; in a year or two AIs are going to be performing these tasks better than humans possibly can.
- akvadrako 3y ago
  Well they could ask you to sign a document with your government issued digital id.
aaron695 3y ago
[dead]
Jabrov 3y ago
When you hate your users
lynx23 3y ago
Cruel And Prejudiced Test Completely Harming Accessibility Imagine a non-native-english speaking visually impaired grandma trying to register to a random web service. CAPTCHAs are not a problem, people say, there are the audio versions, so go for it! Oh, you were never able to pick a language? Too bad you dont speak english. Oh, your hearing is not the best? You are clearly not a human, official stamp from SV. Why? Oh, we just couldn't think of any other solution, so we implemented CAPTCHA and just dumped you and your pesky disabled friends. What?! You want to cross the digital divide? Not as long as we are in power!
- rapnie 3y ago
  Oh, you've managed to find the section for the visually impaired? Surveillance Capitalism Ltd. is happy to get to know you.
- realaleris149 3y ago
  > Oh, we just couldn't think of any other solution, so we implemented CAPTCHA Or more likely they do not care, grandma is very hard to monetize.
  - lotsofpulp 3y ago
    That makes no sense in this case since you have to pay for MAX anyway.
    - lynx23 3y ago
      Thats one absurdity. Having to solve a CAPTCHA for a payed account. What are they afraid of? Another absurdity is having to solve a CAPTCHA for an already existing account with usage history. Lenovo wanted me to solve a CAPTCHA after login before I could submit a new ticket. This is madness.
  - jjkaczor 3y ago
    Grandma is PERFECT to monetize... Once signed-up, Grandma will NEVER be able to figure out how to cancel...
dawnerd 3y ago
Twitter also has dice captchas on signup. Last time I got hit with it I couldn’t solve it no matter what.
Glyptodon 3y ago
GF said she had to cancel and switch to subscribing through Amazon because it wanted her to use an HDMI cable connected to her phone to play on the TV after the switch to Max.
patmcc 3y ago
...this is a joke, right?
bstchn 3y ago
I had the same Captcha system when I tried logging in to my Sony Playstation account as well a couple of days ago. Did eventually give up because it was basically unsolvable. Who would even want to implement a system like that?
danielscrubs 3y ago
Strive to have the kind of moat where people will willingly use captchas to use your paid service. Bravo HBO, you win this round. /s
lemper 3y ago
you know what, my spouse actually wanted to subscribe to one of these kind of services. but now i guess i have to go back to the old way. could be piracy, or could be not watching any tv at all.
intunderflow 3y ago
Heard about the Arkose sale tactics at Roblox (a site whose usability is also nuked by them) I've been told Arkose pay people to run these captchas and present lots of fancy metrics of attacks they've stopped (when in reality with Captcha's like this a lot of that is normal users) which is why some websites seem to be ok with destroying user experience by running this I'd be surprised if anybody in a technical role decided on this provider
- kevincox 3y ago
  This reminds me of the Cloudflare dashboard where they loudly shove "ATTACKS BLOCKED" in your face where they are really counting requests blocked and have no evidence about if it was actually and attack or a poor human that got mistreated.
spaceman_2020 3y ago
Meanwhile in India, JioCinema gave away access to its streaming app for free and hosted 35M simultaneous live viewers yesterday for a cricket match. What are these paid subscription platforms trying to protect?
interlinked 3y ago
The funny thing about that audio captcha is that it would be trivial to write a program that solves it.
sylware 3y ago
Until it works with noscript/basic (x)html browsers, fine by me (static HTML <audio> and <video>). But how would you detect click farms with real humans via VPNs or compromised devices? Not to mention AI, trained by those very click farms which may ramp up significantly the issue. If a "valid" credit card or a wallet code is provided at account creation, a lot can filtered out (unicity, funds availability, etc). Actually, there are so many ways to deal with that better than how it is currently done, I would have troubles to know where to start. It is all about the skills of the people put in charge.
worldofmatthew 3y ago
I think re-posting one of my past comments might be appropriate: "All Captcha's could in the USA be illegal aswell under the ADA.... As some people with learning disabilities won't be able to complete them."
nazka 3y ago
I just found out about PoW Captcha. Don’t they solve every problem?
planede 3y ago
Some genius who designed the dice captcha: "You know what's easy for humans but computers suck at? Addition!"
- amai 3y ago
  It is not the addition, that is hard for computers. What is quite hard for computer vision algorithms is to count the number of dots on dices in an image.
  - planede 3y ago
    Good. So why require the user to add up the values? Some alternatives: * Click all the dice with value 5. * Click all the pictures with a roll of 4 and 5. (each picture shows a pair of dice). If you test for pattern recognizing the number of dots on the top of the dice, then you can just verify only that. No need to make a human user to do a task that a computer can easily do. I can imagine a bunch of users pulling out their phone calculator app to do the addition, which should tell how stupid this captcha is.
still_grokking 3y ago
What did I just watch? Someone recorded a computer screen with their phone. But that's not enough, it's recorded in vertical… I'm really speechless seeing this level of IT illiteracy. The completely messed up "captcha" fades away given that video… Obligatory: https://www.youtube.com/watch?v=OaN2Y8GjIqA https://www.youtube.com/watch?v=OaN2Y8GjIqA
Xenoamorphous 3y ago
What about twitter itself, where this was posted? It’s similar to this one and beyond ridiculous, and the best part is that at the end of the process it failed with a generic error message. Not sure if they were a/b testing or what but I ended up not creating the account.
sxhunga 3y ago
[dead]
pierat 3y ago
Let me remind folks: There's no captchas on torrents, or trackers like thepiratebay.org None at all. Whereas you're evidently the enemy if you legit buy service.
hughw 3y ago
Could somebody please explain to me what bad actors try to do on HBO Max? What is the incentive to create robot accounts?
- milofeynman 3y ago
  People use password dumps to try and steal streaming logins. To watch for free, or resell.
  - notfed 3y ago
    Was this captcha triggered by a login attempt?
giancarlostoro 3y ago
I'm noticing a lot of sites using different captcha services, either in-house or a completely different one from Google's, and I can understand using CloudFlare's but I'm not sure what's driving the move. I'm not against it, but it felt like for ages ReCaptcha (or w/e) was king of captcha. Do they charge up a premium for some sites or something?

705 points by Signez 3y ago

Similar to that horrendous Roblox captcha

This is going to be one of the best parts of the new AI-ridden world: humans gradually getting locked out of and giving up on online services because the bots are more patient and more skilled at proving their humanness than humans are. Twitter’s new captchas are also pretty insane, though not quite this bad last I ran into them.

ccooffee 3y ago
Good, I can't wait for the CAPTCHA to go away. They're accessibility nightmares _by design_.
- ethanbond 3y ago
  Uh? The outcome is not “captchas are gone and all our services remain good.” If we don’t have some way to prevent it, services will be increasingly populated by sophisticated bots either selling stuff, attempting security breaches, or pushing political agendas. That’s a bad thing!
  - ccooffee 3y ago
    I'm not sure I agree that it is "a bad thing". The current internet culture seems quite happy to slap captchas all over the place. When they first rolled out, captchas were predominantly a barrier for "write access" (e.g. make an account, complete a sale, write a comment). But companies like Cloudflare have been putting captchas everywhere for mere read access. Because Captchas are designed to be easy for ("normal") people but hard for machines, they often disallow disabled users. I'm a ("mostly normal") 35 year old, but I _really_ struggle with captchas. I despise when Cloudflare tosses a captcha challenge before loading a page, as I'll need to spend 3-5 minutes of effort to figure out which tiny pictures have a stoplight, motorcycle, or crosswalk. Will someone come up with a less restrictive anti-bot solution? I hope so. But even if not, I'm not sure it matters. According to comments in this thread (and elsewhere on the internet about the HBO Max captcha), many of these captchas are _already_ terrible at excluding robots. We're using captchas to exclude low-sophistication robots and disabled users. Seems wrong.
    - ethanbond 3y ago
      Because current captchas fail to stop 100% of bots and 0% of humans… it’s “not a bad thing” to move closer to captchas stopping 0% of bots and 100% of humans…? Are you imagining this would spur people to create a different, bot-free (how?) and disabled-human friendly Internet?
      - ccooffee 3y ago
        No idea. I'm not offering solutions, merely complaints that the current approach of "answer a question that is hard for computers and easy for humans" removes disabled people from many places on the internet.
sho_hn 3y ago
Inverse captcha: Fill out the tax form for the country from the connecting IP. If you can do it, you're an AI.
- clnq 3y ago
  Inverse captchas or honeypots are a great idea. Just make a HTML input box with id=captcha, and hide it in some unconventional way in CSS so real users do not see it. If a bot was not deterred by seeing a captcha (a possibility), they would probably fill it. Whereas a real user won't.
  - naet 3y ago
    This is an old trick. For example all MailChimp embed forms have dummy inputs that are visually hidden but might be filled in by bots.
    - sph 3y ago
      Maybe not visually hidden, but practically invisible to human: imagine a text box with color #fffffe on a white background. Visually impossible to discern for most humans on most screens, but for a machine #fffffe is totally distinct from #ffffff, and fully visible if display != none. As AI becomes more intelligent, you can prove humanity by exploiting our weaknesses. (Another idea. Have a random image on a page actually be a text box with an image background. You cannot activate it if you focus on it, with your mouse or touch, but a bot doesn't need focus to change input.value.)
      - cletusw 3y ago
        Please don't do this. This confuses and possibly prevents screen reader users from using your site.
      - yjftsjthsd-h 3y ago
        One pitfall: Screen readers will happily get caught on that. Of course, a11y concerns and bots tend to look similar in general, which is a perennial sticking point.
lapcat 3y ago
I joked about this years ago: https://twitter.com/lapcatsoftware/status/771857826130034688 https://twitter.com/lapcatsoftware/status/771857826130034688
dist-epoch 3y ago
I think the captchas will soon get much easier. CAPTCHA: Say something bad about Biden ANSWER: I'm sorry, but as a large language model ...
sph 3y ago
Serious question: who has a decent plan to create proof-of-human systems that are not only CAPTCHA based? We will soon need this, and I feel government will gladly present a solution: provide your ID when you connect to the Internet, and we will guarantee you are a human. Who's actually working on this and has released papers I can study? Because all this AI nonsense will only accelerate us towards this total control of the Internet because the spam and AI bots have made it worse for everyone.
- RobotToaster 3y ago
  I'm not really sure why anyone cares about bots. They've been part of the internet at least since search engines were invented. I guess spam is an issue currently, but if bots become advanced enough to avoid heuristics, by making insightful and useful comments, they are probably better than most human users. Proof of work captchas like mcaptcha can stop, or at least make very expensive, (d)dos attacks.
  - acdha 3y ago
    Bots aren’t random, someone is running them for a reason. The problem isn’t the “insightful and useful comments”, it’ll be the ones which sound like that to any non-expert but are designed to sell products or push political outcomes. Historically the tell for things like that were things like copy-and-paste messages, poor grammar or spelling, etc. which LLMs are great at avoiding.
  - polygamous_bat 3y ago
    > I'm not really sure why anyone cares about bots. They've been part of the internet at least since search engines were invented. It's all fun and games until foreign agencies are controlling who wins in your elections through misinformation and propaganda.
- ribosometronome 3y ago
  >provide your ID when you connect to the Internet, and we will guarantee you are a human. Or an AI using a human's ID?
gmuslera 3y ago
The same happened already with passwords https://xkcd.com/936/ https://xkcd.com/936/
albert_e 3y ago
this scenario sounds somewhat similar to what is described in The Matrix movie. in trying to prevent bots from dominating, we end up making life very difficult for ourselves. In the movie it is said that humans have scorched the skies in a bid to deny solar energy to the machines. But now humans have to live under dark skies.
initplus 3y ago
The end result of this is going to be human identity verification provided by a centralized party. Either the government or a big private corp, not sure which is worse.
doctor_radium 3y ago
> humans gradually getting locked out of and giving up on online services because the bots are more patient and more skilled at proving their humanness than humans are. I think the fact that users are willing to give the site the finger and leave is a pretty good sign that you're human.
ChatGTP 3y ago
This actually seems like a major issue right? Much more than it's being given credit for. Not sure what a world without capture is going to look like but it's probably not going to be very good, I guess we'll all be forced to identify with a our "world coin(tm)" ID? That will be the time when I log off most of the internet.
m463 3y ago
I've started getting blocked on amazon in the evening, and being constantly redirected to captchas and puzzles and invariably whoops ... "the dogs of amazon" pages. (I block amazon ads)

thund 3y ago

ESPN still is the worst at accessibility though, HBO needs to try harder

jacurtis 3y ago
ESPN is horrible. I build auth systems for a living, and I have given up logging into ESPN on numerous occasions because I can't get through all the steps. As recently as a few weeks ago I was watching a game downstairs, and it went into multiple overtimes so it was getting late. I decided to go upstairs to bed and tried to watch it on the AppleTV in the bedroom. I was logged out. So I spent over 10 mins trying to log in before eventually giving up and watching it on the iPad, since I happened to still be logged in on that device. It is for the best, because even after you manage to log in, trying to navigate the menu with the AppleTV remote is an exercise in frustration anyway.

drexlspivey 3y ago

I suspect that OpenAI is not releasing their image reading capability shown in the demo because it will break all captchas

smallerfish 3y ago

Microsoft's captchas are pretty horrendous too. I gave up on them and did the audio captchas also, just like in the video.

rickstanley 3y ago
Not to mention the dire login redirection from Microsoft services that messes up your browser's back button... ugh.
- Prickle 3y ago
  Why do they do that? It is legitimately awful and makes me hate ever having to access Microsoft resources.
  - bombcar 3y ago
    I believe it has to do with setting cookies on every possible domain that the single sign on could be used on. I hate it and it sometimes breaks.

LUmBULtERA 3y ago

This had me cracking up. I can hardly believe it's real! Unbelievable.

jacurtis 3y ago

I experienced the HBO Max captchas just a few days ago. Everyone did since they launched a new app and made everyone switch to that and re-login. Some of the solutions are clearly just wrong. I have a PhD in Computer Science and if I am failing multiple basic addition problems, I assure you that it isn't me, the answers are wrong. I had to do the same audio puzzles and got the first audio puzzle wrong too, and I even had my partner helping me. It is clearly just a bad test bank. Which begs the question, if the answers are wrong and there are only 3 choices, then what's the point? Regardless of whether you are human or not you are going to guess it eventually in about 5 tries, which is what it gives you before locking you out.

maxerickson 3y ago
My login rolled over to the new app without doing anything.
- jacurtis 3y ago
  Mine did that on the AppleTV but not the web. I have aggressive cookie blocking in my browser though, so maybe it is just me.
- detourdog 3y ago
  mine too. im pretty sure my browser redirected from hbo to the new url and auo-logined. I make exceptionsfor sites I pay. I came to thread expecting an explanation of a background captcha.
wrs 3y ago
I am baffled as to why they had to launch an entirely new app rather than just rename the existing one. Could Apple have made them change the bundle ID? It's like they're putting in deliberate obstacles for existing subscribers.
- paddw 3y ago
  organizational politics

madeofpalk 3y ago

Did a bit at online fashion retailer Net a porter a while back, and they rolled their own ‘domain specific’ captcha that had you do things like "select the cuff links". I think it was pretty dynamically powered by their live catalogue. Once during development I got a captcha that said "select the glasses" where my options was a photo of sunglasses, or a pair of glass drinking cups.

type0 3y ago

It's called gamification

deleted 3y ago
[deleted]

TobyTheDog123 3y ago

I was cracking up when it started playing the bagpipes. I don't think its too much of an exaggeration to say this is what happens when security teams don't receive enough pushback from the higher ups or from other teams. I see this all the time in large big tech companies.

EscapeFromNY 3y ago

Why would a bot ever log into HBO Max anyway? Everything is uploaded to torrent sites the day of release, and it's not bots doing the uploading.

jaredsohn 3y ago
Maybe check stolen accounts?
prepend 3y ago
They don’t want aggregator apps to log in without paying. Appletv will show me new shows on multiple platforms all on one screen. HBO doesn’t want people doing this without paying. It’s stupid and anti-user.
- TobyTheDog123 3y ago
  >HBO doesn’t want people doing this without paying. But why (from their perspective)? They don't make their money from metadata, they make it from content. Every piece of real monkey-making content is going to get a torrent regardless of if it's protected behind a captcha.
  - ajmurmann 3y ago
    The Netflix interface is so bad that I've been wondering if they made it bad on purpose. Over a decade ago when DVDs in red envelopes were the standard they had a table view of all their content and you could sort and filter it to your heart's desire. When they got rid of this, I used their API to build a CLI tool that just listed shows ordered by how much Netflix thought I'd like it. All of this was vastly superior to the current Netflix interface. However, I sometimes would decide that I had watched everything on Netflix and turn it off or even unsubscribe for a few months. Now it's really hard to find out if you have exhausted Netflix. It's easy to spend a lot of time just scrolling though the GUI hoping you'll find something and sometimes you do. Sometimes you find something where it's surprising that it didn't suggest it in the first place. I wonder if this is all by design because they try to increase quantity of engagement and not quality and value gained from the engagement. Edit: I have some sympathy for this. Engagement is much harder to measure than customer satisfaction. They are looking for the keys under the light because they cannot see anywhere else.

paulgb 3y ago

So the audio captcha was just two one-of-three challenges? How does this slow an automated bot down, it could just guess repeatedly and get it right 1/9th of the time.

valine 3y ago
I’m also fairly certain an FFT of the audio would instantly uncover the repeating patterns. The repeating tones would show up as taller spikes.
- plorkyeran 3y ago
  Yeah, that seems like something which is easier for a bot than a human.
- rnhmjoj 3y ago
  Even easier would be computing the autocorrelation: essentially you just slide two copies of the signal until they match.
  - lldb 3y ago
    That sounds an awful lot like convolution…
    - tgv 3y ago
      Which is easy with FFT.
flangola7 3y ago
Mine never lets me use the audio option. It says I have to complete the captcha.

Borgz 3y ago

This is Arkose MatchKey. Hopefully, they will one day fix the UI covering the images. https://www.arkoselabs.com/arkose-matchkey/ https://www.arkoselabs.com/arkose-matchkey/

sethherr 3y ago
From their website: > Arkose MatchKey challenges have revolutionized CAPTCHAs
- airstrike 3y ago
  I suppose that's technically correct for some values of "revolutionized"
wackget 3y ago
The entire site is an exercise in delusion and marketing bullshit. I am absolutely convinced that the people selling this abomination of a product have either never used it themselves or are abjectly and wilfully misleading people. Some other choice quotes from the page: > Users have a bad association with difficult photo CAPTCHAs. > Instead of type what you hear (or alphanumerics) puzzles, we ask users simple questions using delightful and amusing scenarios > All are incredibly easy for legitimate users > Every Arkose MatchKey challenge is tested on humans. We release challenges only when they meet very strict usability benchmarks. Our strongest puzzles, designed for bad actors, have no impact on good user completion-rates. > In fact, Arkose MatchKey is the strongest CAPTCHA ever made.
- orf 3y ago
  The ChatGPT app uses this. The puzzle I got involved moving a train, it was super confusing and ridiculous. I was imagining a non-technical user doing these, and my god. No chance.
  - 12907835202 3y ago
    Non technical people struggle with these alot. My mum regularly asks for help when all she's done is ignore the captcha thinking it's an advert because it stands out like a Google ad (different UI, different font, extra branding etc). At least she's learnt to automatically ignore ads, but it comes with consequence of ignoring captchas as well...

zac23or 3y ago

Some people miss the old user interfaces. Windows 95, XP, 2000 etc. What is the reason? We had some programs with a horrible interface (Real Player, for example), but never with this level of stupidity. It's more of a joke than an interface, like reddit's competition for the worst volume control: https://uxdesign.cc/the-worst-volume-control-ui-in-the-world-60713dc86950 https://uxdesign.cc/the-worst-volume-control-ui-in-the-world...

nebula8804 3y ago
Continued "enshittification" of all aspects of life. Your OS gets worse but everything else has gotten worse as well: your food gets smaller/worse quality due to the dollar continuing to lose its value, getting harder and harder to live the lifestyle your parents had (house prices, costs of college etc.) Now you can argue that anything that has hitched a ride on moore's law has improved exponentially. In fact this is what several groups point to: Elon Musk stans love to argue how the world has gotten better not worse thanks to exponential growth and the government loves to point to the declining costs of things like TVs as an indication that inflation is not so bad. Its a red herring though. That new computer is so much better but now has layers of privacy invading/security compromising fat that ye old Windows 95 PC didn't have. That TV might cost a nickel but is more locked down and made out of more of the cheapest throw away components than your old Tube ever had. In a way its an insult to how decent your old TV was.
- abnercoimbre 3y ago
  And then you have people like me, making a living by inviting anyone who listens to events that preach the following: software quality has gone off a cliff [0] and we must do something pronto. Never imagined this would be a career worth pursuing; it's grim when you think about it. [0] https://handmadecities.com/about https://handmadecities.com/about
  - nebula8804 3y ago
    I remember seeing this a while back. I wanted to say thank you for the effort! I am concerned though that this is just another form of inflation. If you think about it, you need to have the skillset to develop this software to your liking. That itself is a time sink but lets put that aside and assume you already have the skillset because you made the investment for other reasons. You could then argue that the investment made in learning how to make these apps is spread across this as well as anything else you use the skill for: GREAT Right? Well, you are forgetting that you are sacrificing time to build and then maintain these applications. So in a way you are still paying for these applications. Also one concern I have about your listing there is the same concern I have every time I force myself to use Linux as my primary system and then give up and go back to Mac: Curation. Have you considered drawing up a list of typical workflows for a bunch of different kinds of users and then ensuring at least the common use cases are taken care of? As it stands, it seem like you have a lot of interesting apps but they are are just a hodgepodge of random things. There is no cohesive curation or (potential)quality control behind them. This grinds my gears about Linux. You handmade apps get a pass but your typical distro? no way: They package together whatever desktop environment they like which itself consists of terrible everyday tools that have varying quality. Just open up the Calculator on a Gnome based distro. It is crummy compared to the Mac or Windows(classic) calculator. Then try out each and every other app on the menu. Seems like there was no real cohesion put into it. Furthermore, lets just accept that you have to tailor these handmade apps to your liking and that eventually there will be a handmade app for everything a user could want. Ok fine, but I still hate the fact that in todays day and age, this idea has to be extend to EVERYTHING in your life. You gotta understand how to maintain your car because good luck finding a mechanic that wont do the bare minimum. How about the slop they serve at many food establishments? You have to "handmade" all your food/liquid intake. Ditto for everything else (maintenance or removing other ways corporations screw you). How do you even preserve the value of the currency you try so hard to earn? You can't it is slowly going to 0.

olliej 3y ago

So the options are: basic ocr and arithmetic, and performing a Fourier transform? Both that that computers are very good at, and have been good at for decades now?

justinko 3y ago

Well that’s one way to get to front page of HN …

CSMastermind 3y ago

Someone had to make this. At some point some software engineer had to sit down, look at it, and say, "looks good to ship to production"

simpsond 3y ago
I can’t imagine UX designers didn’t push back on this… it’s so obviously bad. PMs had their back to a wall.
zulban 3y ago
> At some point some software engineer had to sit down, look at it, and say, "looks good to ship to production" Only true if you replace "software engineer" with "person". Just because someone was paid to build it doesn't mean they thought it was a good idea or ready.
kevincox 3y ago
More like "It fulfills the requirements, ship and collect my compensation"
Brendinooo 3y ago
At some point someone on the management side said "we want this and we're writing the check", the developer complained, and the project manager said "I know, I agree with you, but it's out of our hands"

ardit33 3y ago

The HBO MAX (aka just MAX now) in PS4 is just a disaster. Can't play videos anymore, as it gets stuck on a infinite loop in the intro of every movie. It the remaining time is displayed as a negative integer, and for some reason the system just thinks the move is done and resets it to the beginning. Seems like a bug that some very basic QA testing should have caught it. The new rollout seems like a total clown show, and unfortunately it ruined the service and made it impossible for me to view movies, unless it is from a laptop.

macintux 3y ago
Gruber discussed the Apple TV mess they made, sounds like they repackaged a previous failed attempt without fixing it. https://daringfireball.net/linked/2023/05/23/max-tvos https://daringfireball.net/linked/2023/05/23/max-tvos
cheese_van 3y ago
Nor was I able to log in with Firefox w/linux. I suppose I could have used Chrome but the failure gave me an excuse just to end my subscription. I honestly didn't view HBO that much so I guess I'm up a few bucks. But it does occur to me that a failed first impression can result in lost business - like me. So if users are sitting on the fence, don't push them off! I suppose is the moral.
fbdab103 3y ago
Both HBO and the Apple TV interfaces on Roku are shockingly poor. All sorts of glitches and annoyances with happy-path usage. It really feels like the designers are not using the product.

SalimoS 3y ago

Wow, I just had exactly the same puzzle some hours early, when my Twitter account asked me to verify that I’m not a bot (connected using vpn)

cdme 3y ago

Time's a flat circle. We've reinvented cable and have it delivered via the internet. The quality of the content has fallen off now that folks have been roped into the platforms and everything's getting bundled back up so you have to subsidize garbage just to watch a show or two you like per platform.

wackget 3y ago
You know one service which has never stopped being reliable, easily available, high quality, and free to use? Piracy.
- nebula8804 3y ago
  New free trade agreements will eventually come for the seedboxes.
  - jamilton 3y ago
    Why do you think so? They're already illegal.
  - no_time 3y ago
    I have been thinking about this too. The mind boggling speed increase of torrents over the last 15 years is mostly thanks to seedboxes. I'd wager a single peer fully saturating my 1Gbps fiber is not a residental connection.
  - BeFlatXIII 3y ago
    Then it's time for domestic unrest in nations that attempt to enforce such laws. Oh wait, the rest of the world likes to disarm their populations.
- doctorpangloss 3y ago
  You know all those websites use captchas too, right?
- quickthrower2 3y ago

ajsnigrutin 3y ago

ArkoseLabs? I've given up on websites just by seeing the first captcha made by them.

deleted 3y ago

[deleted]

LelouBil 3y ago

GitHub also has dice captchas. I remember one day in class we were doing a group project and using GitHub to share our work, and a friend of mine had trouble to log into his GitHub account and got this captcha. A team of 4 people in the class went to help him pass the (if I remember correctly) 10 tries you needed to have correct in order to log in. And they still took about 10 minutes!

gsky 3y ago
[flagged]

throwawaaarrgh 3y ago

[flagged]

diziet 3y ago

Audio Captchas are also so often user unfriendly!

technion 3y ago

Just to give credit where it's due, we're linking a Twitter thread where Meg posts a video with a Tiktok watermark from user gavinj1998.

moontear 3y ago
What I don't understand is why the original video isn't linked, since you can also hotlink videos from TikTok? https://www.tiktok.com/@gavinj1998/video/7237700278647016746 https://www.tiktok.com/@gavinj1998/video/7237700278647016746

rglover 3y ago

I see stuff like this and immediately think "the team responsible, in its entirety, should be fired." Zero conscious thought occurred during the entire lifecycle of this feature being implemented.

mateo- 3y ago
guessing it's a "you get what you pay for" situation -- outsourcing or interns.
- dagmx 3y ago
  Or actually a terrible third party product https://www.arkoselabs.com/arkose-matchkey/ https://www.arkoselabs.com/arkose-matchkey/

xigency 3y ago

Okay, I lost it on the second audio challenge. That was something else.

doodlesdev 3y ago

“Piracy is a service problem.” - Gabe Newell Also, Arkose Labs CAPTCHA (what HBO Max is using) is awful, please don't use it. There's reCAPTCHA, hCAPTCHA, mCAPTCHA, and now even Cloudflare Turnstile. Or better yet, recognize your costumers can still download the movie for free whether your service exists or not and adapt your strategy to provide them with content easier :)

Hamuko 3y ago
Isn't hCaptcha the one that asks you "Click on all of the bicycles" and then shows a bunch of AI-generated gibberish where fucking none of them is a bicycle but you have to click on the ones that are the most bicycle-like? Because that's fucking garbage and I wish everyone using it would die in a fire. In case someone as been lucky enough to never have used hCaptcha, it looks like this: https://twitter.com/shaunkruger/status/1660671272672722945 https://twitter.com/shaunkruger/status/1660671272672722945
- schroeding 3y ago
  I don't remember the name, but I've seen a Captcha that asks you stuff like "click on the Zerki", "select the Sploinq" with AI images and I have no idea what shape most looks like a Zerki (there was more than one shape with hard edges!) or a Sploinq. And I have a linguistics minor. :(
  - Hamuko 3y ago
    hCaptcha has absolutely wanted people to click on objects that do not exist even on a conceptual level. https://www.vice.com/en/article/xgwy5n/captcha-is-asking-users-to-identify-objects-that-dont-exist https://www.vice.com/en/article/xgwy5n/captcha-is-asking-use...
- shp0ngle 3y ago
  hCaptcha is garbage. Also, they use some blockchain/token stuff for no reason, at least the last time I looked. edit: ah they seemed to have removed all traces of the token stuff from their website, except some small remains in the docs - https://docs.hcaptcha.com/faq/#what-is-one-hmt-worth https://docs.hcaptcha.com/faq/#what-is-one-hmt-worth . I guess they pivoted away, reasonably.

Freedom2 3y ago

Correction: it's just Max now, not HBO Max. Moderators, can we look at fixing up the title here so it's more accurate?

fbdab103 3y ago
"Max" is horribly generic. Even HBO subscribers are unlikely to all be aware of the new name.
fortyseven 3y ago
Was it really worth expending the energy to backseat moderate this?
- Freedom2 3y ago
  Just trying to make sure our community remains the greatest online tech forum in the world :)
  - throw3052023 3y ago
    [dead]
dralley 3y ago
Just because some new executive wanted to piss on the fire hydrant to "make their mark", doesn't mean we have to respect their poor marketing decisions.
antiloper 3y ago
Then the title would be completely useless since nobody knows what or which "Max" is.

phyzome 3y ago

I'm currently in a conversation with hCaptcha's Support team that has gotten a bit Kafka-esque. Apparently, in order to sign up for the Accessibility option, you need to... fill out a captcha. Fantastic. Good job.

deleted 3y ago

[deleted]

flangola7 3y ago

Why is there a captcha at all? A paid subscription is a stronger signal of humanness than any captcha. I don't even see what use a bot would be in the first place.

jordanmorgan10 3y ago

Their software has always been infuriating to use, matched only be any streaming service the NFL provides on Apple TV

lofaszvanitt 3y ago

Computers and everything related to them should be all about helping me, but I have to spend even more time on idiocies like this, because I have to prove I'm not a bot... I have to accept the cookie monster bullshit everywhere, or I have to mark bicycles or fire hoses because google is so high up in its own back orifice it didn't have time with their 10K+ topnotch engineers to modernize their shit. And these... I think epicgames also uses this horrible system, and I was on the brink of smashing something in the room, when I saw it.

AlexDragusin 3y ago

Real life beats Idiocracy! Now on HBO Max.

Biganon 3y ago

Terrible UX aside, aren't these really... REALLY easy to solve for a bot? Sum the digits on the dies? 5 lines of openCV should do the trick Find which of 3 (three!) extracts is a repeating pattern?? Could this be any easier? This sounds actually easier for a machine than for a human being!

wraptile 3y ago
I've been observing that the custom captcha process itself is a very good bot repellent because someone has to reverse engineer captcha behavior and most malicious actors actually don't know how to. Sprinkle a bit of obfuscation and your 2+2 captcha will be more effective than pages of traffic light selections.
- ThatPlayer 3y ago
  I've made a solver myself recently for a custom captcha, but I think it's more a testament of how bad the custom captcha was. The captcha was a 'select the right picture (singular)' type, and didn't have a nonce so I just attempted every single answer and would eventually get in. I was able to build up a database of correct answers before they fixed that.
patmcc 3y ago
It's security through novelty. No one has bothered to write a bot solver for these yet. They will, soon enough, if it's protecting anything worthwhile, but that's some other engineers problem.
amai 3y ago
> Sum the digits on the dies? 5 lines of openCV should do the trick. Not so fast: First the images show dices with a mixture of dots and numbers. Second the images are not from the top, but at 45 degree angle. By that one can also see the numbers/dots on the side of the dices. Distinguishing numbers/dots which are on the side from ones on the top is pretty hard. The algorithm needs to have an understanding of the 3d structure of the dices in the image.

skhr0680 3y ago

ERROR! Please drink a verification can

boomboomsubban 3y ago

Not saying these are good, but it's been ~10 years and I still have no idea what I'm supposed to click when Google says "click the traffic lights." Just the light sections? What about the edge that takes up 10% of the adjoining box? What about the back or side of a different traffic light? I've tried them all, and my success rate doesn't noticeably change.

pcurve 3y ago
I think that’s all accounted for.
- mypastself 3y ago
  I always get it wrong on the first try, so I guess they're accounting for me being a robot.
  - pcurve 3y ago
    It's so random. Sometimes I click submit thinking it would fail because I forgot to select a metal pole of a traffic light, or confuse bike for a motorcycle.
shawabawa3 3y ago
Honestly I don't think it matters which boxes you click I think it's based on mouse movements, time delay between clicks, and browser fingerprinting tricks that detect headless browsers
- kevincox 3y ago
  In pretty sure it does matter. Click things that are clearly wrong and it will very rarely accept it. However I think it is quite flexible. That box that is almost completely traffic light probably needs to be clicked, but as long as you pick at least one of those two that contain a corner you will likely pass. I would guess that there is some sort of accuracy score that is mixed in with the bot fingerprinting score.

manigandham 3y ago

Had similar issues with the Google recaptcha where the question is satisfied by either all the square or none of them - both being considered a wrong answer: https://twitter.com/ManiGandham/status/1635193312264200192 https://twitter.com/ManiGandham/status/1635193312264200192

heavyset_go 3y ago
I take these situations to mean that Google has no intention of giving you access and is just trying waste your time with useless CAPTCHAs.
neom 3y ago
I get shit like this all the time, just yesterday I got "select all the squares with stairs" and then every photo was a part of a flight of stairs... I always wonder what you're supposed to do with questions like this.

doctor_radium 3y ago

I really want to sell a t-shirt that reads "I didn't visit your web site to play video games". Incidentally, my other t-shirt would read "I don't care about your stupid app".

owlbite 3y ago
Also a baseball cap: If I wanted to subscribe to your website, I'd find the link myself.

_9omd 3y ago

Wow, those captchas almost look like satire. On a side note, what the hell is up with branding for HBO streaming? They’ve gone from HBO GO to HBO Now to HBO Max. And now, according to ads I recently saw, it’s just Max. Talk about whiplash.

dcow 3y ago

The writing has been on the walls for captcha. We’re going to need some Idena-like solution, or services are going to have to deal with non-human uses as a normal occurrence and design anti-abuse mechanisms accordingly (or redefine abuse, or both).

shepherdjerred 3y ago

Captchas have gotten _crazy_ hard in the last year. The more difficult ones often take me 2-3 tries. There's got to be a better solution; in a year or two AIs are going to be performing these tasks better than humans possibly can.

akvadrako 3y ago
Well they could ask you to sign a document with your government issued digital id.

aaron695 3y ago

[dead]

Jabrov 3y ago

When you hate your users

lynx23 3y ago

Cruel And Prejudiced Test Completely Harming Accessibility Imagine a non-native-english speaking visually impaired grandma trying to register to a random web service. CAPTCHAs are not a problem, people say, there are the audio versions, so go for it! Oh, you were never able to pick a language? Too bad you dont speak english. Oh, your hearing is not the best? You are clearly not a human, official stamp from SV. Why? Oh, we just couldn't think of any other solution, so we implemented CAPTCHA and just dumped you and your pesky disabled friends. What?! You want to cross the digital divide? Not as long as we are in power!

rapnie 3y ago
Oh, you've managed to find the section for the visually impaired? Surveillance Capitalism Ltd. is happy to get to know you.
realaleris149 3y ago
> Oh, we just couldn't think of any other solution, so we implemented CAPTCHA Or more likely they do not care, grandma is very hard to monetize.
- lotsofpulp 3y ago
  That makes no sense in this case since you have to pay for MAX anyway.
  - lynx23 3y ago
    Thats one absurdity. Having to solve a CAPTCHA for a payed account. What are they afraid of? Another absurdity is having to solve a CAPTCHA for an already existing account with usage history. Lenovo wanted me to solve a CAPTCHA after login before I could submit a new ticket. This is madness.
- jjkaczor 3y ago
  Grandma is PERFECT to monetize... Once signed-up, Grandma will NEVER be able to figure out how to cancel...

dawnerd 3y ago

Twitter also has dice captchas on signup. Last time I got hit with it I couldn’t solve it no matter what.

Glyptodon 3y ago

GF said she had to cancel and switch to subscribing through Amazon because it wanted her to use an HDMI cable connected to her phone to play on the TV after the switch to Max.

patmcc 3y ago

...this is a joke, right?

bstchn 3y ago

I had the same Captcha system when I tried logging in to my Sony Playstation account as well a couple of days ago. Did eventually give up because it was basically unsolvable. Who would even want to implement a system like that?

danielscrubs 3y ago

Strive to have the kind of moat where people will willingly use captchas to use your paid service. Bravo HBO, you win this round. /s

lemper 3y ago

you know what, my spouse actually wanted to subscribe to one of these kind of services. but now i guess i have to go back to the old way. could be piracy, or could be not watching any tv at all.

intunderflow 3y ago

Heard about the Arkose sale tactics at Roblox (a site whose usability is also nuked by them) I've been told Arkose pay people to run these captchas and present lots of fancy metrics of attacks they've stopped (when in reality with Captcha's like this a lot of that is normal users) which is why some websites seem to be ok with destroying user experience by running this I'd be surprised if anybody in a technical role decided on this provider

kevincox 3y ago
This reminds me of the Cloudflare dashboard where they loudly shove "ATTACKS BLOCKED" in your face where they are really counting requests blocked and have no evidence about if it was actually and attack or a poor human that got mistreated.

spaceman_2020 3y ago

Meanwhile in India, JioCinema gave away access to its streaming app for free and hosted 35M simultaneous live viewers yesterday for a cricket match. What are these paid subscription platforms trying to protect?

interlinked 3y ago

The funny thing about that audio captcha is that it would be trivial to write a program that solves it.

sylware 3y ago

Until it works with noscript/basic (x)html browsers, fine by me (static HTML <audio> and <video>). But how would you detect click farms with real humans via VPNs or compromised devices? Not to mention AI, trained by those very click farms which may ramp up significantly the issue. If a "valid" credit card or a wallet code is provided at account creation, a lot can filtered out (unicity, funds availability, etc). Actually, there are so many ways to deal with that better than how it is currently done, I would have troubles to know where to start. It is all about the skills of the people put in charge.

worldofmatthew 3y ago

I think re-posting one of my past comments might be appropriate: "All Captcha's could in the USA be illegal aswell under the ADA.... As some people with learning disabilities won't be able to complete them."

nazka 3y ago

I just found out about PoW Captcha. Don’t they solve every problem?

planede 3y ago

Some genius who designed the dice captcha: "You know what's easy for humans but computers suck at? Addition!"

amai 3y ago
It is not the addition, that is hard for computers. What is quite hard for computer vision algorithms is to count the number of dots on dices in an image.
- planede 3y ago
  Good. So why require the user to add up the values? Some alternatives: * Click all the dice with value 5. * Click all the pictures with a roll of 4 and 5. (each picture shows a pair of dice). If you test for pattern recognizing the number of dots on the top of the dice, then you can just verify only that. No need to make a human user to do a task that a computer can easily do. I can imagine a bunch of users pulling out their phone calculator app to do the addition, which should tell how stupid this captcha is.

still_grokking 3y ago

What did I just watch? Someone recorded a computer screen with their phone. But that's not enough, it's recorded in vertical… I'm really speechless seeing this level of IT illiteracy. The completely messed up "captcha" fades away given that video… Obligatory: https://www.youtube.com/watch?v=OaN2Y8GjIqA https://www.youtube.com/watch?v=OaN2Y8GjIqA

Xenoamorphous 3y ago

What about twitter itself, where this was posted? It’s similar to this one and beyond ridiculous, and the best part is that at the end of the process it failed with a generic error message. Not sure if they were a/b testing or what but I ended up not creating the account.

sxhunga 3y ago

[dead]

pierat 3y ago

Let me remind folks: There's no captchas on torrents, or trackers like thepiratebay.org None at all. Whereas you're evidently the enemy if you legit buy service.

hughw 3y ago

Could somebody please explain to me what bad actors try to do on HBO Max? What is the incentive to create robot accounts?

milofeynman 3y ago
People use password dumps to try and steal streaming logins. To watch for free, or resell.
- notfed 3y ago
  Was this captcha triggered by a login attempt?

giancarlostoro 3y ago

I'm noticing a lot of sites using different captcha services, either in-house or a completely different one from Google's, and I can understand using CloudFlare's but I'm not sure what's driving the move. I'm not against it, but it felt like for ages ReCaptcha (or w/e) was king of captcha. Do they charge up a premium for some sites or something?