Hacker News Reader

Comment by alkonaut | Hacker News Reader

How do they detect account borrowing? only through simultaneous use? When I pay for the service I expect some low number of simultaneous clients (say 2-4) to be able to stream. Obviously sharing my password means sharing that quota and if the number of concurrent streams is 1 then the password isn't shareable at all.

What I don't like though is when there can only be a fixed number of authenticated devices, whether they are ever used or not. Once you have logged in to N devices (5, for one service I subscribe to) you can't log in to a sixth. Even if the first 3 are phones that are on the bottom of the ocean. At that point you need to call customer support to clear your authenticated devices. Hassle.

What kind of crackdown did they pull here? in legal terms only? Or in number of concurrent streams? or in number of authenticated devices?

View on HN

You have to tell to Netflix what Wi-Fi network are you using (your usual Wi-Fi is assigned by default). If your device doesn't connect to that Wi-Fi network at least once in a month, your device is blocked. You can still share accounts using a personal VPN network.

> At that point you need to call customer support to clear your authenticated devices. Hassle.

Yikes, which services require you to call support in such an instance? In my experience you can often kick out old devices right from the new device that you are trying to use (annoying, but manageable).

This is a swedish sports streaming service (cmore). Not sure if they have fixed so that this is possible to do by the end user now or no longer required, was a couple of years since I last did it.

Probably geo IP and calculating feasible travel times. E.g. if 2 clients connect that are 50 miles away within 5 minutes creds are obviously being shared.

That would give way WAY too many false positives. If I'm watching on the bus while my wife watches at home it would trigger. Similar if we have 2 homes etc. It would also rule out anyone using VPNs etc. Seems like a complete no-go and would see a huge chunk of paying users go simply because the product is now much worse for people who are not sharing accounts. That just can't be it.

Probably they recognize ips so they'll realize that you are sharing if you are logging in from another ip over time. I think it's like at least once every 30 days or so, that'll protect most people from false positives when travelling.

They probably also fingerprint devices as well and correlate those times the devices are in the same area, etc. With user agents/device IDs, IPs and time you can work out quite a few relationships.

If I'm ever blocked on some fuzzy reason I'd leave the service in a heartbeat. If they have clear rules then at least I can somehow learn to avoid the traps, such as having to connect from an IP or having a specified number of devices. But if I can get kicked out of the service right before/in the middle of a game, then I'd quit my subscription in a hurry. They just can't use some method similar to how financial fraud is detected. But while fuzzy rules don't fly, I can't see any rigid rules that also wouldn't be a hassle for paying customers.

If you and a partner share an account and live in the same household, and someone goes on a trip and takes their phone/laptop. What then?

Reply on news.ycombinator.com