8 ms·

As far as I know, current ad blockers can't block ads from Widevine (DRM protected) streams, so I guess it's only a matter of time until Chromium team comes up

As far as I know, current ad blockers can't block ads from Widevine (DRM protected) streams, so I guess it's only a matter of time until Chromium team comes up with Widevine for webpages and then it's game over for normal consumers.

allendoerfer 3y ago
Don't be evil.
bawolff 3y ago
While i know its evil, i always wished widevine was an option for creating captchas. Most captcha solutions are defeated by services like 2captcha.net and generally aren't the most privacy respecting.
- Semaphor 3y ago
  Most captcha solutions are also hard for me, but easy for computers to solve. So I really hope their use doesn’t get expanded even further…
  - kedean 3y ago
    "Select every tile with motorcycles", shows an image of a single motorcycle parked on the street. Does the sliver of a tire that shows up in the bottom right tile count, or not? This is never clear, and I end up usually getting it wrong until they show me one that's unambiguous.
    - ghayes 3y ago
      I have never successfully gotten a “click all motorcycle squares” to succeed. With a VPN, nothing usually works until “click until there are no more X.” It’s so consistent that I’m pretty sure it’s designed that way, since the final task is time-gated.
      - Sohcahtoa82 3y ago
        > With a VPN, nothing usually works until [...] Bots are very likely to use VPNs, so captcha services make things a real pain in the ass for anyone connecting from a VPN. It's the same story with Tor. Coming from a VPN/Tor is a strong signal that you're more likely to be a malicious user.
        freedomben 3y ago
        I'm guessing they also use failed CAPTCHA statistics as more "proof" that those users are malicious. How much should we bet that each time I fail a CAPTCHA because it's utter shit, and happen to be on a VPN, somebody somewhere counts it as a "blocked bot" or "blocked attack"? I guess I don't want to know as it will probably make me angry.
      - Nextgrid 3y ago
        ReCaptcha will serve you impossible captchas (as in it will always behave as incorrect even if the answer is correct) if it doesn't like you.
    - arprocter 3y ago
      I've had 'click all the lettuces' - it told me I was wrong for not clicking on a cabbage
      - hunter2_ 3y ago
        It's not comparing your response to some hard truth, it's comparing your response to a typical response. Sort of like how LLMs dish stuff out based on what's probable, not based on hard truth. So when you fail, it's not really saying you're wrong, it's saying you're not like most.
        autoexec 3y ago
        I'm not helping. I always try to get a few wrong just to screw with their training.
    - whitehexagon 3y ago
      The last time I got blocked by captcha I went through a dozen of them in a row before being told I wasnt human enough (possibly true after 30 years in IT!) and so on principal I reject all websites that include captcha. And anyway, why are we training these image recognition tools for free.
      - Sabinus 3y ago
        Were you trying to access archive.is using the CloudFlare DNS resolvers?
        hedora 3y ago
        I used to have an internet connection from a small ISP that used carrier grade nat. Same issue. I think most of these captcha systems basically just look at IP or other reputation, and then make end-users do mechanical turk style work for free. Someday, I'm hoping some sociologists look for evidence of socioeconomic discrimination in captcha implementations. In my experience, performing the exact same actions with your mouse in Mountain View leads to a completely different outcome than it does in lower income areas (red-voting white, ethnic minorities, etc) surrounding the Bay Area.
    - jerf 3y ago
      "This is never clear, and I end up usually getting it wrong until they show me one that's unambiguous." While those CAPTCHAs present a surface narrative of you having to get the problem correct, that's not how they really work. After all, it's not like they are creating those problems by hand. They're pushing the images through computers. You don't even know that what the CAPTCHA server considers correct is even close to objectively correct. Really it's just a hook to engage you to collect a wide variety of streams to try to detect whether or not you are a human, like reaction speeds, how the mouse moves, etc. The correctness of your selection is only one small signal, and not even necessarily a large one. The answer is, stop overthinking it. Your overthinking it is probably sending a signal that you're not a human because it's got all your timings wrong. Do what most humans do: Halfassedly click at the problem until it seems rightish and then click "Submit". Does the sliver of tire that shows up in the bottom right tile count? The human response to that question is "Who cares you dumb computer let me through to the content already", so, to maximize how human you look to the algorithm, channel your fellow human's feelings. If you feel frustrated at the CAPTCHA problem and wiggle your mouse angrily and maybe overshoot some of the squares you mean to click, so much the better and more human looking.
      - xk_id 3y ago
        a tutorial on how to be human on internet
        jerf 3y ago
        Putting Expert Human on my resume now, thanks.
      - freedomben 3y ago
        Interesting, I guess this explains why I can never "solve" the damn things on my desktop. I use an Ultimate Hacking Keyboard which has a mouse layer, so I control the mouse cursor with my keyboard. It means that my mouse always travels in either perfectly horizontal, perfectly vertical, or perfectly diagonal patterns, and at very different timings than a human using a traditional mouse would. But, it pisses me off to no end that I can't use my fucking keyboard the way it is supposed to be used (which is a far superior design to the "normal" setup) to view some websites because it doesn't "look" human to the fucking server who expects me not to be a statistical outlier. As someone who has always been an outlier, I kind of hate the algorithmic future we live in and are headed even further toward. This is why we can't have nice things.
    - darepublic 3y ago
      On these captchas I used to sweat it but now I just think "fuck it" and don't overthink anything. And I always pass, perhaps for a variety of reasons secondary to the actual tiles selected
  - bawolff 3y ago
    Which is mostly because computers are good at solving them. A DRM based captcha wouldn't have that issue in theory.
- costco 3y ago
  Widevine has already been reverse engineered. You just need to extract a device private key and there are numerous methods for doing so. "Web Environment Integrity" will never work.
  - deleted 3y ago
    [deleted]
  - avidiax 3y ago
    It will not work to prevent someone from copying a webpage. It will work to make ad-blocking difficult enough that most people don't bother anymore.
- Adverblessly 3y ago
  I'd prefer to see proof-of-work based captchas. I'd much rather give up 10 minutes of CPU time for a token that can be revoked as soon as I actually use it for evil than give up all of my privacy (and two minutes of my personal time) for the privilege of using your annoying website.
  - Symbiote 3y ago
    That is what those Cloudflare "checking your connection before proceeding" page is doing.
  - YetAnotherNick 3y ago
    Spammers would actually prefer it I think. I think for each captcha solved, spammer are ready to pay more than real users(be it electricity or real money). They were already paying real humans before AI became good enough for solving captcha.
    - avidiax 3y ago
      Spammers are probably not using their own computer or electricity, so this would be very attractive for them.
      - throw10920 3y ago
        No, it would not. Spammers are still paying for the devices - most botnets are built and used (to spam) by different actors. Systems that require more computational power to spam take up more of their resources, making spamming significantly less profitable.
        YetAnotherNick 3y ago
        Depends on how much do you want real users to spend per captcha in electricity cost? If say it is $1/captcha it would be untenable for real users. If it is 0.01 cent, it wouldn't hurt spammer's margins.
- Dwedit 3y ago
  Captchas can be forwarded to other people. Think of things like VNC.
- throw10920 3y ago
  Widevine (or any other DRM-based "proof of human" solution) would be far less compute-freedom and privacy respecting than a captcha. Hashcash[1] was invented two and a half decades ago and is still the best solution. It doesn't require manual work or user privacy invasion and deters mass spammers. [1] https://en.m.wikipedia.org/wiki/Hashcash https://en.m.wikipedia.org/wiki/Hashcash
okasaki 3y ago
They already tried with the Web Integrity Environment, but it wasn't very popular.
xyst 3y ago
Until quantum computing becomes mainstream and then consumers can break drm on the fly!
- thomastjeffery 3y ago
  You don't need quantum computing. You just need a debugger. The user already has the encryption key, else they would not be able to see the content.
  - bawolff 3y ago
    Widevine has different levels. In level 1 & 2 the key is in a TPM. Even for level3, i can only inagine that the amount of obfuscation must be pretty intense.
- xg15 3y ago
  "Post-Quantum" crypto is already being rolled out in expectation of that though.
3pt14159 3y ago
If an ad can be rendered on a page or if it uses audio it can be blocked. We have it easy right now with how trivial it has been to block ads, but we could face off against rendering and wiping them in real time if we need to.
- dannyw 3y ago
  Not really. Modern DRM uses Intel ME / AMD / ARM equivalent. These execute code the OS doesn’t have privilege to access.
  - 3pt14159 3y ago
    Oh really, that's news to me. I thought one could always read the video frames one at a time.
    - dannyw 3y ago
      Nope, it gets access to its own framebuffer that’s composited in the GPU. OS sees a black viewport, and only a black viewport. The comms is encrypted on the bus using strong cryptography, so you can’t sniff it. All these software blobs are signed and encrypted, you can’t replace it without the signing key.
      - 3pt14159 3y ago
        Thanks for letting me know! Really interesting stuff.
Mindwipe 3y ago
> As far as I know, current ad blockers can't block ads from Widevine (DRM protected) streams, so I guess it's only a matter of time until Chromium team comes up with Widevine for webpages and then it's game over for normal consumers. Only where the the adverts are embedded with an encrypted single stream. Hard to do targeted advertising that way though. It is a lever that you can pull that's better than nothing though.
- michaelt 3y ago
  Most modern video formats allow you to splice multiple videos together without recompressing, so long as they use the same codec, resolution and framerate and you do it at an I-frame. So long as you can run code on your CDN edge servers - which Youtube undoubtedly can - there's no technical reason this couldn't be done.
NelsonMinar 3y ago
That'd be a good reason to finally break Widevine.
xg15 3y ago
Didn't they more or less try this with the Web Environment Integrity API? Luckily, people caught on quickly and caused enough backlash for them to abandon it - this time. I'm not sure how things will work out the next time though.
- undefeated 3y ago
  At least we got some of my all-time favorite GitHub issues tho
  - _shantaram 3y ago
    Out of curiosity, could you post a couple?
    - RockRobotRock 3y ago
      https://github.com/explainers-by-googlers/Web-Environment-Integrity/issues/28 https://github.com/explainers-by-googlers/Web-Environment-In...
hereme888 3y ago
By the time that happens my hope is that we might have the new GPT-5 with personal agents curating information for us.
- dpig_ 3y ago
  I already have a personal (NSA) agent that does this for me.
  - hereme888 3y ago
    I'm not sure if I missed a joke about the NSA, or if there's a computer agent you use, in which case i'd love to hear about it.
eipi10_hn 3y ago
Hmm... For example which sites?
musicale 3y ago
It's only a matter of time before I get an AI-fueled graphics overlay that eliminates anything that looks like an ad from my screen (click to reveal false positives), and then it's game over for advertisers. Hopefully HDMI/HDCP splitters will add an adblock feature as well.

allendoerfer 3y ago

Don't be evil.

bawolff 3y ago

While i know its evil, i always wished widevine was an option for creating captchas. Most captcha solutions are defeated by services like 2captcha.net and generally aren't the most privacy respecting.

Semaphor 3y ago
Most captcha solutions are also hard for me, but easy for computers to solve. So I really hope their use doesn’t get expanded even further…
- kedean 3y ago
  "Select every tile with motorcycles", shows an image of a single motorcycle parked on the street. Does the sliver of a tire that shows up in the bottom right tile count, or not? This is never clear, and I end up usually getting it wrong until they show me one that's unambiguous.
  - ghayes 3y ago
    I have never successfully gotten a “click all motorcycle squares” to succeed. With a VPN, nothing usually works until “click until there are no more X.” It’s so consistent that I’m pretty sure it’s designed that way, since the final task is time-gated.
    - Sohcahtoa82 3y ago
      > With a VPN, nothing usually works until [...] Bots are very likely to use VPNs, so captcha services make things a real pain in the ass for anyone connecting from a VPN. It's the same story with Tor. Coming from a VPN/Tor is a strong signal that you're more likely to be a malicious user.
      - freedomben 3y ago
        I'm guessing they also use failed CAPTCHA statistics as more "proof" that those users are malicious. How much should we bet that each time I fail a CAPTCHA because it's utter shit, and happen to be on a VPN, somebody somewhere counts it as a "blocked bot" or "blocked attack"? I guess I don't want to know as it will probably make me angry.
    - Nextgrid 3y ago
      ReCaptcha will serve you impossible captchas (as in it will always behave as incorrect even if the answer is correct) if it doesn't like you.
  - arprocter 3y ago
    I've had 'click all the lettuces' - it told me I was wrong for not clicking on a cabbage
    - hunter2_ 3y ago
      It's not comparing your response to some hard truth, it's comparing your response to a typical response. Sort of like how LLMs dish stuff out based on what's probable, not based on hard truth. So when you fail, it's not really saying you're wrong, it's saying you're not like most.
      - autoexec 3y ago
        I'm not helping. I always try to get a few wrong just to screw with their training.
  - whitehexagon 3y ago
    The last time I got blocked by captcha I went through a dozen of them in a row before being told I wasnt human enough (possibly true after 30 years in IT!) and so on principal I reject all websites that include captcha. And anyway, why are we training these image recognition tools for free.
    - Sabinus 3y ago
      Were you trying to access archive.is using the CloudFlare DNS resolvers?
      - hedora 3y ago
        I used to have an internet connection from a small ISP that used carrier grade nat. Same issue. I think most of these captcha systems basically just look at IP or other reputation, and then make end-users do mechanical turk style work for free. Someday, I'm hoping some sociologists look for evidence of socioeconomic discrimination in captcha implementations. In my experience, performing the exact same actions with your mouse in Mountain View leads to a completely different outcome than it does in lower income areas (red-voting white, ethnic minorities, etc) surrounding the Bay Area.
  - jerf 3y ago
    "This is never clear, and I end up usually getting it wrong until they show me one that's unambiguous." While those CAPTCHAs present a surface narrative of you having to get the problem correct, that's not how they really work. After all, it's not like they are creating those problems by hand. They're pushing the images through computers. You don't even know that what the CAPTCHA server considers correct is even close to objectively correct. Really it's just a hook to engage you to collect a wide variety of streams to try to detect whether or not you are a human, like reaction speeds, how the mouse moves, etc. The correctness of your selection is only one small signal, and not even necessarily a large one. The answer is, stop overthinking it. Your overthinking it is probably sending a signal that you're not a human because it's got all your timings wrong. Do what most humans do: Halfassedly click at the problem until it seems rightish and then click "Submit". Does the sliver of tire that shows up in the bottom right tile count? The human response to that question is "Who cares you dumb computer let me through to the content already", so, to maximize how human you look to the algorithm, channel your fellow human's feelings. If you feel frustrated at the CAPTCHA problem and wiggle your mouse angrily and maybe overshoot some of the squares you mean to click, so much the better and more human looking.
    - xk_id 3y ago
      a tutorial on how to be human on internet
      - jerf 3y ago
        Putting Expert Human on my resume now, thanks.
    - freedomben 3y ago
      Interesting, I guess this explains why I can never "solve" the damn things on my desktop. I use an Ultimate Hacking Keyboard which has a mouse layer, so I control the mouse cursor with my keyboard. It means that my mouse always travels in either perfectly horizontal, perfectly vertical, or perfectly diagonal patterns, and at very different timings than a human using a traditional mouse would. But, it pisses me off to no end that I can't use my fucking keyboard the way it is supposed to be used (which is a far superior design to the "normal" setup) to view some websites because it doesn't "look" human to the fucking server who expects me not to be a statistical outlier. As someone who has always been an outlier, I kind of hate the algorithmic future we live in and are headed even further toward. This is why we can't have nice things.
  - darepublic 3y ago
    On these captchas I used to sweat it but now I just think "fuck it" and don't overthink anything. And I always pass, perhaps for a variety of reasons secondary to the actual tiles selected
- bawolff 3y ago
  Which is mostly because computers are good at solving them. A DRM based captcha wouldn't have that issue in theory.
costco 3y ago
Widevine has already been reverse engineered. You just need to extract a device private key and there are numerous methods for doing so. "Web Environment Integrity" will never work.
- deleted 3y ago
  [deleted]
- avidiax 3y ago
  It will not work to prevent someone from copying a webpage. It will work to make ad-blocking difficult enough that most people don't bother anymore.
Adverblessly 3y ago
I'd prefer to see proof-of-work based captchas. I'd much rather give up 10 minutes of CPU time for a token that can be revoked as soon as I actually use it for evil than give up all of my privacy (and two minutes of my personal time) for the privilege of using your annoying website.
- Symbiote 3y ago
  That is what those Cloudflare "checking your connection before proceeding" page is doing.
- YetAnotherNick 3y ago
  Spammers would actually prefer it I think. I think for each captcha solved, spammer are ready to pay more than real users(be it electricity or real money). They were already paying real humans before AI became good enough for solving captcha.
  - avidiax 3y ago
    Spammers are probably not using their own computer or electricity, so this would be very attractive for them.
    - throw10920 3y ago
      No, it would not. Spammers are still paying for the devices - most botnets are built and used (to spam) by different actors. Systems that require more computational power to spam take up more of their resources, making spamming significantly less profitable.
      - YetAnotherNick 3y ago
        Depends on how much do you want real users to spend per captcha in electricity cost? If say it is $1/captcha it would be untenable for real users. If it is 0.01 cent, it wouldn't hurt spammer's margins.
Dwedit 3y ago
Captchas can be forwarded to other people. Think of things like VNC.
throw10920 3y ago
Widevine (or any other DRM-based "proof of human" solution) would be far less compute-freedom and privacy respecting than a captcha. Hashcash[1] was invented two and a half decades ago and is still the best solution. It doesn't require manual work or user privacy invasion and deters mass spammers. [1] https://en.m.wikipedia.org/wiki/Hashcash https://en.m.wikipedia.org/wiki/Hashcash

okasaki 3y ago

They already tried with the Web Integrity Environment, but it wasn't very popular.

xyst 3y ago

Until quantum computing becomes mainstream and then consumers can break drm on the fly!

thomastjeffery 3y ago
You don't need quantum computing. You just need a debugger. The user already has the encryption key, else they would not be able to see the content.
- bawolff 3y ago
  Widevine has different levels. In level 1 & 2 the key is in a TPM. Even for level3, i can only inagine that the amount of obfuscation must be pretty intense.
xg15 3y ago
"Post-Quantum" crypto is already being rolled out in expectation of that though.

3pt14159 3y ago

If an ad can be rendered on a page or if it uses audio it can be blocked. We have it easy right now with how trivial it has been to block ads, but we could face off against rendering and wiping them in real time if we need to.

dannyw 3y ago
Not really. Modern DRM uses Intel ME / AMD / ARM equivalent. These execute code the OS doesn’t have privilege to access.
- 3pt14159 3y ago
  Oh really, that's news to me. I thought one could always read the video frames one at a time.
  - dannyw 3y ago
    Nope, it gets access to its own framebuffer that’s composited in the GPU. OS sees a black viewport, and only a black viewport. The comms is encrypted on the bus using strong cryptography, so you can’t sniff it. All these software blobs are signed and encrypted, you can’t replace it without the signing key.
    - 3pt14159 3y ago
      Thanks for letting me know! Really interesting stuff.

Mindwipe 3y ago

> As far as I know, current ad blockers can't block ads from Widevine (DRM protected) streams, so I guess it's only a matter of time until Chromium team comes up with Widevine for webpages and then it's game over for normal consumers. Only where the the adverts are embedded with an encrypted single stream. Hard to do targeted advertising that way though. It is a lever that you can pull that's better than nothing though.

michaelt 3y ago
Most modern video formats allow you to splice multiple videos together without recompressing, so long as they use the same codec, resolution and framerate and you do it at an I-frame. So long as you can run code on your CDN edge servers - which Youtube undoubtedly can - there's no technical reason this couldn't be done.

NelsonMinar 3y ago

That'd be a good reason to finally break Widevine.

xg15 3y ago

Didn't they more or less try this with the Web Environment Integrity API? Luckily, people caught on quickly and caused enough backlash for them to abandon it - this time. I'm not sure how things will work out the next time though.

undefeated 3y ago
At least we got some of my all-time favorite GitHub issues tho
- _shantaram 3y ago
  Out of curiosity, could you post a couple?
  - RockRobotRock 3y ago
    https://github.com/explainers-by-googlers/Web-Environment-Integrity/issues/28 https://github.com/explainers-by-googlers/Web-Environment-In...

hereme888 3y ago

By the time that happens my hope is that we might have the new GPT-5 with personal agents curating information for us.

dpig_ 3y ago
I already have a personal (NSA) agent that does this for me.
- hereme888 3y ago
  I'm not sure if I missed a joke about the NSA, or if there's a computer agent you use, in which case i'd love to hear about it.

eipi10_hn 3y ago

Hmm... For example which sites?

musicale 3y ago

It's only a matter of time before I get an AI-fueled graphics overlay that eliminates anything that looks like an ad from my screen (click to reveal false positives), and then it's game over for advertisers. Hopefully HDMI/HDCP splitters will add an adblock feature as well.