4 ms·

I'm a bit uneducated when it comes to the cryptography involved, but I'm wondering why people here are so determined DRM can't ever work? Is it because someone

I'm a bit uneducated when it comes to the cryptography involved, but I'm wondering why people here are so determined DRM can't ever work? Is it because someone will somehow get a copy and upload to torrents/streaming sites which of course won't have DRM. Thus only potentially annoying legitimate (eg. Netflix) users? Or are there other concerns?

Fej 9y ago
DRM doesn't work. Every form of DRM has historically been broken in one way or another. There are a couple of current systems that haven't been broken yet but it doesn't matter; content will be available from unauthorized sources the day they are released for streaming and no technical means is going to stop that. Even Denuvo, the darling of the major games publishers, is broken on a regular basis. The company acknowledges that their software doesn't last forever (they tout '300 days' on their website as the longest any of their DRM schemes has held up, it usually is broken in a couple of weeks) and that the value is protecting the profits during that period.
- CMay 9y ago
  DRM does work. Whether Denuvo is successful depends on how it is implemented. Implementations of Denuvo have survived a year+ without being cracked. As you said, DRM often isn't intended to be secure forever, just for long enough that the major sales buzz is over anyway. You can also think of DRM as branching into online services. DRM commonly required some form of interaction with an online service to validate a key or whatever else. As a result, some DRM is in fact built into the foundation of the software and this is the most successful. Think of World of Warcraft or Everquest. To essentially crack that DRM, you have to recreate the server backend which is a serious undertaking. This has been done, but it took a long time, only applies to older versions and doesn't connect you to the legitimate service. Steam is an online service and games which use SteamWorks are coupling at least some of their features with the online service, but this is not as complicated as something like World of Warcraft so it is easily cracked. Denuvo attempts to fill that gap by more strongly coupling the software with Steam. As a result, Steam is technically the DRM while Denuvo is helping to enforce it and thus is not labeled as "3rd party DRM" on the Steam Store pages. There is a balance between the popularity of your software and the difficulty of breaking the DRM. If your software isn't extremely popular, then a crack is not in high demand. If the software is easy to crack, then even if it isn't in high demand it may get drive-by cracked. If it's difficult enough, many people will decide that their time is better spent elsewhere even if it is possible to crack. As we enter the age of encrypted processing where both the code and data are encrypted during execution on the processor, cracking will be time consuming enough and have enough prerequisites that it simply won't be able to keep up with even the most popular software. It will be a while before this can become mainstream, because unless governments start requiring it, there will always be devices without encrypted processing that companies can't ignore in order to maximize profit. It won't surprise me if we see both governments that require encrypted processing and governments that ban encrypted processing. Obviously for static media like audio or video this is harder to deal with, but there have been a number of novel solutions to this that just haven't been widely adopted. There are also still a lot of consumers with older hardware that publishers want to target, because not targeting them is worse than the concern of piracy. These are more about mitigation rather than outright making it impossible for a time period.
  - Tepix 9y ago
    DRM is broken because sooner or later it will always prevent legitimate access to content.
throwaway613834 9y ago
My guess is they claim it can't work because they don't want it to work, and figure with enough agreement someone somewhere will be convinced. (Saying this independently of my own views on the matter.)
teeray 9y ago
The argument is essentially that in order for you to enjoy the content, the content must be present unencrypted at some point before it hits your eyes and ears. Because of this, it should always be theoretically possible to extract the unencrypted content at that point.
deleted 9y ago
[deleted]
idle_zealot 9y ago
By its very nature DRM of media content makes no sense. How can audio and video be delivered to the user without also allowing the user to save and distribute that content later? At some point, the content must be available in unencrypted form, even if that point is when the content is sent to the display, it can just be captured there.
- throwaway613834 9y ago
  It could be easy to view but hard to save and distribute. Why can't it? Or do you really think these people have no idea what they're taking about?
  - prophesi 9y ago
    > Why can't it? They've been trying to accomplish this for many years now, to no avail. This is a nontrivial problem.
    - throwaway613834 9y ago
      >> It could be easy to view but hard to save and distribute. Why can't it? > They've been trying to accomplish this for many years now, to no avail. Any evidence that they haven't had any success whatsoever in making it harder to save/distribute?
      - prophesi 9y ago
        Sure. Search for a recent videogame on pirate bay, download a youtube-to-mp3 browser extension, get the calibre DeDRM plugin. Or, if you really want to understand my point, download and learn how to use a disassembler. For the casual law-abiding user, it succeeds in making it harder to save/distribute. For everyone else, it's only a matter of time before the DRM is broken.
        throwaway613834 9y ago
        First and foremost that depends on the content being popular. For example there's a ~30-minute video I paid for on Amazon Videos that I would love to have a copy of so that I don't need an Amazon account and internet access just to play the video, but I can't. Why? Because of their DRM and the fact that I can't find it anywhere else. (Admittedly I haven't directly searched on piracy sites since I'm not into that sort of thing, but Googling didn't pop anything up even on piracy sites, and I would be surprised if it's actually out there somewhere.) Sad reality is it's not even because I wouldn't pay for it; I already paid for it once and I'd even pay for it again if someone sold a copy. But the DRM is "working" in terms of making it too hard to get a copy. But even if some content is popular, DRM certainly prevents people like me from saving a copy, since I'm not one to go on piracy sites and the only reason I want a copy is so I don't have to get authorization from someone every time I want to play something I already paid for. It might be a dumb business decision since I'd already pay for it before getting a copy anyway, but maybe they think that still makes business sense even if I'd pay for it. Regardless of that it still seems to be working as intended.
gizmo686 9y ago
Cryptogtaphically speaking, what is DRM. We want to give an untrusted user access to content, so that they can see it, without giving them access to the content, so they cannot copy it. This is simply impossible in theory. In practice, we can make copying it difficult, possibly resorting to hardware support (so decryption happens in the monitor) and rely on the DMCA to make any attempts to break DRM illegal. Of course non of these solutions actually work in theory; and the farther down the arms race we go, the more annoying it gets to legitimate users.
- throwaway613834 9y ago
  > Cryptogtaphically speaking, Honestly, this might be why people aren't on the same wavelength. They're not cryptographically speaking.
  - deleted 9y ago
    [deleted]
  - snarfy 9y ago
    Cryptography allows Alice to share a secret with Bob without Carol listening in. In DRM, Alice and Carol are the same person.
    - throwaway613834 9y ago
      I'm not sure if that's correct or not, but either way, that's in complete agreement with what I just said: they are not speaking in terms of cryptography.
- mo2k 9y ago
  I know content creators. There is a large group that hate their content being copied. That's not going to change.
  - rocqua 9y ago
    Is it content creators or content distributers? I thought most pushback against easier access to content was from publishers / curators / distributers. They are being made obsolete by digital distribution and are using 'but the poor artists' as an smoke-screen to delay their obsolescence.
squeaky-clean 9y ago
Mainly that. There's no way to show me a video in my own home wherein I can't simply videotape the screen. So even if it's perfectly locked down digitally, it has to be converted to analog at some point for human consumption, and you can always capture that. But I also disagree that DRM should be baked into "the web" as a standard, especially when most users seem to disagree, the EFF disagrees, and almost half of the committee disagrees.
ocdtrekkie 9y ago
It's inherently ineffective because for content to be viewable, information about the DRM is widely spread. Consider Blu-ray. HDCP is a huge hassle for anyone trying to do anything with their video content, and it offers next to no security: Every Blu-ray player, TV, and disc producer has to hold the decryption keys, which means it's trivial for the keys to leak out to the public. And consider the number of hands a piece of media goes through during the various stages of content production. Movies get stolen from anywhere from postproduction studios to the factories that produce the discs. Adding a layer of DRM on top of the consumer-facing product does almost nothing to prevent the content from reaching pirate sites. And once they're there, the rest of the distribution problem is easy.
LeifCarrotson 9y ago
DRM can't work because the math doesn't distinguish between receiving and decrypting content for a legal purpose like viewing it, and doing the same for an illegal purpose like copying and distributing it. If nothing else, there's the analog hole of recording the screen (which could be done in software). If it did work, that would be a legitimate reason to include these potentially dangerous, un-inspectable DRM features. But it fundamentally can't, so foisting this security risk on everyone seems misguided.
- rocqua 9y ago
  A chain of hardware, all with private keys in a 'secure enclave' / 'TPM' can deliver DRM that is as unbreakable as the private keys are hidden and tampering detection is functioning. Really, the only hole that can't be patched is analogue recording. Realistically, tampering with the screen or cable is probably the easiest target. Though, compromising the TPM would have more widespread effects.
JPLeRouzic 9y ago
I think the most simple reasons to tell that DRM can't ever work, are that: First DRM proponents have gone very far to protect their content. It costs them a lot of money and from a economical point of view it is difficult to see how DRM help them making more money. Second: The guys who use pirated stuff would anyway not pay if DRM was working, so why the media industry would bother to struggle with them?
marcosdumay 9y ago
> why people here are so determined DRM can't ever work It is just that you can not have a video for watching it, and not having the video for distributing it. Computers don't work that way, you either have the video or don't. That said, things are more insidious than what is on the above paragraph. It's computers that don't work that way, so the solution that many people thought about was making computers illegal, and replacing them with closed controlled machines that resemble them in many ways but aren't as powerful.
tptacek 9y ago
In practical terms, DRM obviously can be made to work. People ideologically opposed to DRM tend to have two blind spots about the DRM service model. First, they assume that DRM users demand that DRM prevent any copies being made. But that's not true: obviously, any video you show a user in the privacy of their home can be cam-copied. It has even been the case (though it will be less and less the case moving forward) that you could obtain a high-fidelity digital copy. DRM users have always understood that to be the case; what's important is not that copies be impossible, but that they be difficult for ordinary users and, ideally, incur a quality hit. If copies are inconvenient and/or of lower-quality, most of the market will pay for legitimate copies. Second, and more importantly, DRM opponents assume that the restriction DRM users are seeking is indefinite. But for the most part, content owners are much less concerned about long-term restrictions than they are about the new-release window when their content is most in demand. A DRM scheme only has to survive for a couple weeks to generate immense value for content owners. From a security and cryptography perspective, a scheme that can be resilient against expert adversaries for a few weeks, or even a framework for minting such schemes on demand, is a commercially reasonable proposition.
- gizmo686 9y ago
  >or even a framework for minting such schemes on demand This is what video DRM will need. For games, where each game has a somewhat customized version of DRM, taking a few weeks to break is good enough. For video, this will give you a few episodes; but once it is broken it is broken for everything until you roll out a new scheme. Overtime, I would expect the breakers to get more efficient and automated at breaking schemes, while the DRM makers get increasingly lazy and complacent.
  - tptacek 9y ago
    This is how Bluray's BD+ scheme work(ed).
    - thephyber 9y ago
      Is this why my BluRay player needed to be updated to be able to play newer discs?
whipoodle 9y ago
To me the more interesting question is why this particular issue is so important that W3C felt compelled to break consensus. I think the answer to that question is a lot more revealing than another "DRM is evil vs you're an unrealistic hippie" fight. Even if we take it for granted that DRM is good... why?
- rocqua 9y ago
  Given that apparently, google (Chrome), Microsoft (IE and edge) and Apple (Safari) supported the proposal, one could defend the decision as necessary to prevent obsolescence. That is, if they did not pass this, they'd just be ignored by 3 out of the 4 most popular browser producers.
pdkl95 9y ago
DRM works! It's very effective at giving control of the playback environment to the copyright cartels. Unfortunately, a lot of people mistakenly believe the purpose of DRM is to prevent copying. That is the justification, not the goal, which has always been about maintaining control over playback device.
yellowapple 9y ago
If you're capable of actually consuming it (by seeing it with your eyes and/or hearing it with your ears), then it is possible to pirate it. Exactly zero DRM technologies today actually prevent piracy, and exactly zero DRM technologies ever will. Meanwhile, user-hostile DRM can and will (and already does) push users to simply pirate the media in question instead of putting up with the DRM. Users lose, publishers lose, browser vendors lose, and pirates are entirely unaffected.
- Furmark 9y ago
  Publishers win control over playback hardware market which probably outweighs the loss, or they would have stopped doing it.

Fej 9y ago

DRM doesn't work. Every form of DRM has historically been broken in one way or another. There are a couple of current systems that haven't been broken yet but it doesn't matter; content will be available from unauthorized sources the day they are released for streaming and no technical means is going to stop that. Even Denuvo, the darling of the major games publishers, is broken on a regular basis. The company acknowledges that their software doesn't last forever (they tout '300 days' on their website as the longest any of their DRM schemes has held up, it usually is broken in a couple of weeks) and that the value is protecting the profits during that period.

CMay 9y ago
DRM does work. Whether Denuvo is successful depends on how it is implemented. Implementations of Denuvo have survived a year+ without being cracked. As you said, DRM often isn't intended to be secure forever, just for long enough that the major sales buzz is over anyway. You can also think of DRM as branching into online services. DRM commonly required some form of interaction with an online service to validate a key or whatever else. As a result, some DRM is in fact built into the foundation of the software and this is the most successful. Think of World of Warcraft or Everquest. To essentially crack that DRM, you have to recreate the server backend which is a serious undertaking. This has been done, but it took a long time, only applies to older versions and doesn't connect you to the legitimate service. Steam is an online service and games which use SteamWorks are coupling at least some of their features with the online service, but this is not as complicated as something like World of Warcraft so it is easily cracked. Denuvo attempts to fill that gap by more strongly coupling the software with Steam. As a result, Steam is technically the DRM while Denuvo is helping to enforce it and thus is not labeled as "3rd party DRM" on the Steam Store pages. There is a balance between the popularity of your software and the difficulty of breaking the DRM. If your software isn't extremely popular, then a crack is not in high demand. If the software is easy to crack, then even if it isn't in high demand it may get drive-by cracked. If it's difficult enough, many people will decide that their time is better spent elsewhere even if it is possible to crack. As we enter the age of encrypted processing where both the code and data are encrypted during execution on the processor, cracking will be time consuming enough and have enough prerequisites that it simply won't be able to keep up with even the most popular software. It will be a while before this can become mainstream, because unless governments start requiring it, there will always be devices without encrypted processing that companies can't ignore in order to maximize profit. It won't surprise me if we see both governments that require encrypted processing and governments that ban encrypted processing. Obviously for static media like audio or video this is harder to deal with, but there have been a number of novel solutions to this that just haven't been widely adopted. There are also still a lot of consumers with older hardware that publishers want to target, because not targeting them is worse than the concern of piracy. These are more about mitigation rather than outright making it impossible for a time period.
- Tepix 9y ago
  DRM is broken because sooner or later it will always prevent legitimate access to content.

throwaway613834 9y ago

My guess is they claim it can't work because they don't want it to work, and figure with enough agreement someone somewhere will be convinced. (Saying this independently of my own views on the matter.)

teeray 9y ago

The argument is essentially that in order for you to enjoy the content, the content must be present unencrypted at some point before it hits your eyes and ears. Because of this, it should always be theoretically possible to extract the unencrypted content at that point.

deleted 9y ago

[deleted]

idle_zealot 9y ago

By its very nature DRM of media content makes no sense. How can audio and video be delivered to the user without also allowing the user to save and distribute that content later? At some point, the content must be available in unencrypted form, even if that point is when the content is sent to the display, it can just be captured there.

throwaway613834 9y ago
It could be easy to view but hard to save and distribute. Why can't it? Or do you really think these people have no idea what they're taking about?
- prophesi 9y ago
  > Why can't it? They've been trying to accomplish this for many years now, to no avail. This is a nontrivial problem.
  - throwaway613834 9y ago
    >> It could be easy to view but hard to save and distribute. Why can't it? > They've been trying to accomplish this for many years now, to no avail. Any evidence that they haven't had any success whatsoever in making it harder to save/distribute?
    - prophesi 9y ago
      Sure. Search for a recent videogame on pirate bay, download a youtube-to-mp3 browser extension, get the calibre DeDRM plugin. Or, if you really want to understand my point, download and learn how to use a disassembler. For the casual law-abiding user, it succeeds in making it harder to save/distribute. For everyone else, it's only a matter of time before the DRM is broken.
      - throwaway613834 9y ago
        First and foremost that depends on the content being popular. For example there's a ~30-minute video I paid for on Amazon Videos that I would love to have a copy of so that I don't need an Amazon account and internet access just to play the video, but I can't. Why? Because of their DRM and the fact that I can't find it anywhere else. (Admittedly I haven't directly searched on piracy sites since I'm not into that sort of thing, but Googling didn't pop anything up even on piracy sites, and I would be surprised if it's actually out there somewhere.) Sad reality is it's not even because I wouldn't pay for it; I already paid for it once and I'd even pay for it again if someone sold a copy. But the DRM is "working" in terms of making it too hard to get a copy. But even if some content is popular, DRM certainly prevents people like me from saving a copy, since I'm not one to go on piracy sites and the only reason I want a copy is so I don't have to get authorization from someone every time I want to play something I already paid for. It might be a dumb business decision since I'd already pay for it before getting a copy anyway, but maybe they think that still makes business sense even if I'd pay for it. Regardless of that it still seems to be working as intended.

gizmo686 9y ago

Cryptogtaphically speaking, what is DRM. We want to give an untrusted user access to content, so that they can see it, without giving them access to the content, so they cannot copy it. This is simply impossible in theory. In practice, we can make copying it difficult, possibly resorting to hardware support (so decryption happens in the monitor) and rely on the DMCA to make any attempts to break DRM illegal. Of course non of these solutions actually work in theory; and the farther down the arms race we go, the more annoying it gets to legitimate users.

throwaway613834 9y ago
> Cryptogtaphically speaking, Honestly, this might be why people aren't on the same wavelength. They're not cryptographically speaking.
- deleted 9y ago
  [deleted]
- snarfy 9y ago
  Cryptography allows Alice to share a secret with Bob without Carol listening in. In DRM, Alice and Carol are the same person.
  - throwaway613834 9y ago
    I'm not sure if that's correct or not, but either way, that's in complete agreement with what I just said: they are not speaking in terms of cryptography.
mo2k 9y ago
I know content creators. There is a large group that hate their content being copied. That's not going to change.
- rocqua 9y ago
  Is it content creators or content distributers? I thought most pushback against easier access to content was from publishers / curators / distributers. They are being made obsolete by digital distribution and are using 'but the poor artists' as an smoke-screen to delay their obsolescence.

squeaky-clean 9y ago

Mainly that. There's no way to show me a video in my own home wherein I can't simply videotape the screen. So even if it's perfectly locked down digitally, it has to be converted to analog at some point for human consumption, and you can always capture that. But I also disagree that DRM should be baked into "the web" as a standard, especially when most users seem to disagree, the EFF disagrees, and almost half of the committee disagrees.

ocdtrekkie 9y ago

It's inherently ineffective because for content to be viewable, information about the DRM is widely spread. Consider Blu-ray. HDCP is a huge hassle for anyone trying to do anything with their video content, and it offers next to no security: Every Blu-ray player, TV, and disc producer has to hold the decryption keys, which means it's trivial for the keys to leak out to the public. And consider the number of hands a piece of media goes through during the various stages of content production. Movies get stolen from anywhere from postproduction studios to the factories that produce the discs. Adding a layer of DRM on top of the consumer-facing product does almost nothing to prevent the content from reaching pirate sites. And once they're there, the rest of the distribution problem is easy.

LeifCarrotson 9y ago

DRM can't work because the math doesn't distinguish between receiving and decrypting content for a legal purpose like viewing it, and doing the same for an illegal purpose like copying and distributing it. If nothing else, there's the analog hole of recording the screen (which could be done in software). If it did work, that would be a legitimate reason to include these potentially dangerous, un-inspectable DRM features. But it fundamentally can't, so foisting this security risk on everyone seems misguided.

rocqua 9y ago
A chain of hardware, all with private keys in a 'secure enclave' / 'TPM' can deliver DRM that is as unbreakable as the private keys are hidden and tampering detection is functioning. Really, the only hole that can't be patched is analogue recording. Realistically, tampering with the screen or cable is probably the easiest target. Though, compromising the TPM would have more widespread effects.

JPLeRouzic 9y ago

I think the most simple reasons to tell that DRM can't ever work, are that: First DRM proponents have gone very far to protect their content. It costs them a lot of money and from a economical point of view it is difficult to see how DRM help them making more money. Second: The guys who use pirated stuff would anyway not pay if DRM was working, so why the media industry would bother to struggle with them?

marcosdumay 9y ago

> why people here are so determined DRM can't ever work It is just that you can not have a video for watching it, and not having the video for distributing it. Computers don't work that way, you either have the video or don't. That said, things are more insidious than what is on the above paragraph. It's computers that don't work that way, so the solution that many people thought about was making computers illegal, and replacing them with closed controlled machines that resemble them in many ways but aren't as powerful.

tptacek 9y ago

In practical terms, DRM obviously can be made to work. People ideologically opposed to DRM tend to have two blind spots about the DRM service model. First, they assume that DRM users demand that DRM prevent any copies being made. But that's not true: obviously, any video you show a user in the privacy of their home can be cam-copied. It has even been the case (though it will be less and less the case moving forward) that you could obtain a high-fidelity digital copy. DRM users have always understood that to be the case; what's important is not that copies be impossible, but that they be difficult for ordinary users and, ideally, incur a quality hit. If copies are inconvenient and/or of lower-quality, most of the market will pay for legitimate copies. Second, and more importantly, DRM opponents assume that the restriction DRM users are seeking is indefinite. But for the most part, content owners are much less concerned about long-term restrictions than they are about the new-release window when their content is most in demand. A DRM scheme only has to survive for a couple weeks to generate immense value for content owners. From a security and cryptography perspective, a scheme that can be resilient against expert adversaries for a few weeks, or even a framework for minting such schemes on demand, is a commercially reasonable proposition.

gizmo686 9y ago
>or even a framework for minting such schemes on demand This is what video DRM will need. For games, where each game has a somewhat customized version of DRM, taking a few weeks to break is good enough. For video, this will give you a few episodes; but once it is broken it is broken for everything until you roll out a new scheme. Overtime, I would expect the breakers to get more efficient and automated at breaking schemes, while the DRM makers get increasingly lazy and complacent.
- tptacek 9y ago
  This is how Bluray's BD+ scheme work(ed).
  - thephyber 9y ago
    Is this why my BluRay player needed to be updated to be able to play newer discs?

whipoodle 9y ago

To me the more interesting question is why this particular issue is so important that W3C felt compelled to break consensus. I think the answer to that question is a lot more revealing than another "DRM is evil vs you're an unrealistic hippie" fight. Even if we take it for granted that DRM is good... why?

rocqua 9y ago
Given that apparently, google (Chrome), Microsoft (IE and edge) and Apple (Safari) supported the proposal, one could defend the decision as necessary to prevent obsolescence. That is, if they did not pass this, they'd just be ignored by 3 out of the 4 most popular browser producers.

pdkl95 9y ago

DRM works! It's very effective at giving control of the playback environment to the copyright cartels. Unfortunately, a lot of people mistakenly believe the purpose of DRM is to prevent copying. That is the justification, not the goal, which has always been about maintaining control over playback device.

yellowapple 9y ago

If you're capable of actually consuming it (by seeing it with your eyes and/or hearing it with your ears), then it is possible to pirate it. Exactly zero DRM technologies today actually prevent piracy, and exactly zero DRM technologies ever will. Meanwhile, user-hostile DRM can and will (and already does) push users to simply pirate the media in question instead of putting up with the DRM. Users lose, publishers lose, browser vendors lose, and pirates are entirely unaffected.

Furmark 9y ago
Publishers win control over playback hardware market which probably outweighs the loss, or they would have stopped doing it.