The author did include this caveat: > WARNING: This method of DRM will keep honest people honest. But determined people will figure out how to break it. This i

The author did include this caveat: > WARNING: This method of DRM will keep honest people honest. But determined people will figure out how to break it. This is the case with any kind of DRM. It seems to me that this is more about essentially preventing the link being shared. Having not played around with HLS I don't see why this couldn't be done by simply doing an authentication check and refusing to serve content if the auth check fails. Preventing decryption of the video is obviously impossible as it's being decrypted on the box itself. The key rotation seems odd to me. If you're worried about users sharing their session key or something then that can be dealt with on the back end (it surprises me that, for example, YT seemingly don't care about the same IP downloading a ton of videos in parallel with ytdl, say; I suppose NAT makes it slightly more difficult to detect, but not much more so...).