4 ms·

> "For someone to use this information to unlock anything, they would have to implement it in silicon -- make a computer chip," Waldrop told Fox News, and that

by uxp 16y ago

> "For someone to use this information to unlock anything, they would have to implement it in silicon -- make a computer chip," Waldrop told Fox News, and that chip would have to live on a dedicated piece of hardware -- something Intel doesn't think is likely to happen in any substantial way. I'm sure thats just a PR statement, however, in most currently available products that require these keys, they are stored in flash so they can be revoked or changed in the future. Firmware these days is much more spongy than its predecessors. Hacking a legitimate firmware update for popular devices to embed new keys will soon be an automated process for anyone willing to do it. What would it take for a Chinese knockoff builder to create a BluRay player that generates a new key every time it boots and stores it RAM? That'd be nearly impossible to blacklist, since anytime you rebooted the player, it would appear to be a brand new device. The implications of this crack are much more far reaching than dvdcss, and potentially far more economically threatening to the model they spent so much time and money on.

tptacek 16y ago
It would also be very difficult to sell in the markets where people actually buy Blu Ray disks.
- uxp 16y ago
  Online? Ebay? Craigslist? No, you couldn't but them at Fry's, but when have you ever been able to buy similar grey-market electronics legitimately in B&M stores?
  - tptacek 16y ago
    Without having to get into a drawn-out series of hypotheticals let's just stipulate that pushing DRM cracks that far underground is a win condition for a content industry that just a few years ago was as open to piracy as redbook CDs.
- Someone 16y ago
  Would it? I know this is a different scale of breach, but AFAIK region-free DVD players are everywhere.
barrkel 16y ago
Is it economically threatening? Really? I have my doubts about that. As I understand it, the hardware manufacturers were peddling a fantasy to rightsholders that their hardware could protect their content from end to end. By getting rightsholders to buy into this fantasy, these hardware manufacturers got a whole lot more leverage, licensing revenue, new (i.e. forced) hardware sales, etc. But I'm not sure it did a whole lot for the rightsholders other than try and assuage their fears of the digital dawn, a kind of snake oil, as it were. I don't think people who actually want to view content without paying for it even noticed. The people who did notice were consumers who were inconvenienced by the incompatibilities created by coordination problems being made unnecessarily difficult etc. If anyone is the loser here, I would think it's a handful of big-brand hardware manufacturers and patent / license holders, trying to e.g. exclude cheap no-name Chinese manufacturers from competition.
- tlb 16y ago
  I think it's simpler than that. The labels would only support a standard with DRM, but secure DRM is impossible, and making copying inconvenient won't keep the content off torrents. It must have sucked to be on that standards body.
- Hoff 16y ago
  It's a compromise between what the rights-holders want for security (eg: usually more), and what the hardware vendors can reasonably implement and profit from (eg: usually less), and the degree of hassles and adverts that the end users will tolerate (some), and the trade-offs between the ease of use of any cracks with the fear of and the threat of and the costs of legal entanglements, and the cost of entry for folks outside the consortium (usually licenses and patents). Everybody involved - content, device, user - is looking to maximize their profit and minimize their costs. Hardware guys: No content, no buyers, uh-oh, no device sales. Content guys: No devices, no market, uh-oh, no media sales. Customers: No fun, uh-oh, no device and no media sales. It's one of them marketing min-max messes, in other words.
_delirium 16y ago
I don't think you'd even need a new Blu-Ray player if you had a genuine one. HDCP is aimed mainly at protecting the video stream between the disk and and display on the monitor, to keep people from grabbing the video off a DVI or HDMI cable. It's not clear to me why you'd need to manufacture hardware at all to exploit it, unless I'm missing something about what part of the system this is breaking. HDCP negotiates an encrypted connection between video sources and HDCP-enabled monitors/TVs, over standard physical links like DVI and HDMI. It's what normally keeps you from just hooking your Blu-Ray player up to a DVI or HDMI input port on a computer and recording the video stream. But with the HDCP key leaked, can't someone write a driver that makes the PC's input port authenticate itself as an HDCP-compliant "monitor"? Is there something in hardware that'd still have to be done to make that work?
- zokier 16y ago
  There isn't a lot of products capable of capturing 1080p from DVI/HDMI, even without HDCP.
  - _delirium 16y ago
    Hmm, that's a good point. That makes it somewhat amusing, though, because that means that the main reason it's hard to exploit this HDCP break (at least currently) is the same reason HDCP is actually somewhat unnecessary to begin with: because recording a raw DVI/HDMI stream with commonly available equipment is hard.
    - wmf 16y ago
      Of course, one could speculate that if HDCP never existed, cheap HDMI capture cards would have been developed years ago. (Like how criminals probably would be sniffing credit card numbers off the Internet if SSL never existed, but since SSL exists they use other methods instead.) Currently an HDMI capture card costs $200: http://www.blackmagic-design.com/products/intensity/ http://www.blackmagic-design.com/products/intensity/
  - markkanof 16y ago
kbatten 16y ago
This would be a very fun undergrad capstone project, and a project that would get someone an amazing job even if they only did a partial implementation.

by uxp 16y ago

tptacek 16y ago

It would also be very difficult to sell in the markets where people actually buy Blu Ray disks.

uxp 16y ago
Online? Ebay? Craigslist? No, you couldn't but them at Fry's, but when have you ever been able to buy similar grey-market electronics legitimately in B&M stores?
- tptacek 16y ago
  Without having to get into a drawn-out series of hypotheticals let's just stipulate that pushing DRM cracks that far underground is a win condition for a content industry that just a few years ago was as open to piracy as redbook CDs.
Someone 16y ago
Would it? I know this is a different scale of breach, but AFAIK region-free DVD players are everywhere.

barrkel 16y ago

Is it economically threatening? Really? I have my doubts about that. As I understand it, the hardware manufacturers were peddling a fantasy to rightsholders that their hardware could protect their content from end to end. By getting rightsholders to buy into this fantasy, these hardware manufacturers got a whole lot more leverage, licensing revenue, new (i.e. forced) hardware sales, etc. But I'm not sure it did a whole lot for the rightsholders other than try and assuage their fears of the digital dawn, a kind of snake oil, as it were. I don't think people who actually want to view content without paying for it even noticed. The people who did notice were consumers who were inconvenienced by the incompatibilities created by coordination problems being made unnecessarily difficult etc. If anyone is the loser here, I would think it's a handful of big-brand hardware manufacturers and patent / license holders, trying to e.g. exclude cheap no-name Chinese manufacturers from competition.

tlb 16y ago
I think it's simpler than that. The labels would only support a standard with DRM, but secure DRM is impossible, and making copying inconvenient won't keep the content off torrents. It must have sucked to be on that standards body.
Hoff 16y ago
It's a compromise between what the rights-holders want for security (eg: usually more), and what the hardware vendors can reasonably implement and profit from (eg: usually less), and the degree of hassles and adverts that the end users will tolerate (some), and the trade-offs between the ease of use of any cracks with the fear of and the threat of and the costs of legal entanglements, and the cost of entry for folks outside the consortium (usually licenses and patents). Everybody involved - content, device, user - is looking to maximize their profit and minimize their costs. Hardware guys: No content, no buyers, uh-oh, no device sales. Content guys: No devices, no market, uh-oh, no media sales. Customers: No fun, uh-oh, no device and no media sales. It's one of them marketing min-max messes, in other words.

_delirium 16y ago

I don't think you'd even need a new Blu-Ray player if you had a genuine one. HDCP is aimed mainly at protecting the video stream between the disk and and display on the monitor, to keep people from grabbing the video off a DVI or HDMI cable. It's not clear to me why you'd need to manufacture hardware at all to exploit it, unless I'm missing something about what part of the system this is breaking. HDCP negotiates an encrypted connection between video sources and HDCP-enabled monitors/TVs, over standard physical links like DVI and HDMI. It's what normally keeps you from just hooking your Blu-Ray player up to a DVI or HDMI input port on a computer and recording the video stream. But with the HDCP key leaked, can't someone write a driver that makes the PC's input port authenticate itself as an HDCP-compliant "monitor"? Is there something in hardware that'd still have to be done to make that work?

zokier 16y ago
There isn't a lot of products capable of capturing 1080p from DVI/HDMI, even without HDCP.
- _delirium 16y ago
  Hmm, that's a good point. That makes it somewhat amusing, though, because that means that the main reason it's hard to exploit this HDCP break (at least currently) is the same reason HDCP is actually somewhat unnecessary to begin with: because recording a raw DVI/HDMI stream with commonly available equipment is hard.
  - wmf 16y ago
    Of course, one could speculate that if HDCP never existed, cheap HDMI capture cards would have been developed years ago. (Like how criminals probably would be sniffing credit card numbers off the Internet if SSL never existed, but since SSL exists they use other methods instead.) Currently an HDMI capture card costs $200: http://www.blackmagic-design.com/products/intensity/ http://www.blackmagic-design.com/products/intensity/
- markkanof 16y ago

kbatten 16y ago

This would be a very fun undergrad capstone project, and a project that would get someone an amazing job even if they only did a partial implementation.