5 ms·
The title of this article is "Security researcher cracks Google's Widevine DRM (L3 only)". That it affects only their L3 streams is an important distinction I t
by jhalstead 8y ago
The title of this article is "Security researcher cracks Google's Widevine DRM (L3 only)". That it affects only their L3 streams is an important distinction I think. The article goes on to explain that, "the hack works only against Widevine L3 streams, and not L2 and L1, which are the ones that carry high-quality audio and video data.
Any user who cracks a Widevine L3 stream would only gain access to grainy low-quality video and lo-fi audio."
- voltagex_ 8y agoSigh, so not useful for archival of purchased video at all.
- contingencies 8y agoAlso, it's a 10 year old DRM system at this point. Anything encoded for on-demand distribution across networks 10 years ago was probably done at poor qualities in general. Source: Used to work in the industry.
- wmf 8y agoWidevine isn't used in Chrome today for services such as Prime Video?
- dnautics 8y agoIt is.
- iofiiiiiiiii 8y agoNo. There are two entirely different DRM systems named Widevine. Up to version 6.0 was old legacy DRM from way back. Widevine 7.0 is the current version, published only a few years back, also called Widevine Modular. This is a modern cutting-edge DRM equivalent to Microsoft PlayReady and Apple FairPlay. Together, these 3 make up the big DRMs in the industry.
- contingencies 8y agoOh OK, stopped following DRM after that job! :) Fun tidbit: We did the first commercial deployment globally of PlayReady for Samsung's galaxy devices US launch. MS paid Samsung to use it.
- skybrian 8y agoI don't see why not? 720p is higher than DVD quality and plenty good enough for entertainment purposes. Kids these days...
- dane-pgp 8y agoRight, and it's also worth highlighting here the meaning of these "protection" levels: L1 - all content processing and cryptography operations are handled inside a CPU that supports a Trusted Execution Environment (TEE). L2 - only cryptography operations are handled inside a TEE. L3 - content processing and cryptography operations are (intentionally) handled outside of a TEE, or the device doesn't support a TEE. This suggests that the media industry only trust you to receive their content if they have some degree of control over what your device is doing. There's an obvious logic to them setting such a requirement, but it does mean rolling out a world wide system where critical security components underpinning our digital societies are resistant to inspection and transparency, by design (and, in many cases, with the full force of the law). I feel that ultimately this will create a precarious situation and introduce risks that are not justified.
- wmf 8y agoWhat do these levels mean on, say, Windows? What would the TEE be?
- saagarjha 8y agoThere isn't any, so it looks like it would be L3: https://storage.googleapis.com/wvdocs/Widevine_DRM_Architecture_Overview.pdf https://storage.googleapis.com/wvdocs/Widevine_DRM_Architect...
- ebeip90 8y ago(IIRC, unsubstantiated) Windows clients use Windows’ DRM implementation, not WideVine.
- iofiiiiiiiii 8y agoChrome and Firefox use Widevine DRM at L3 (software implementation). Edge and IE use PlayReady (which has support for hardware DRM, optinally selectable by the app/website).
- bubblethink 8y ago
- rasz 8y agoWith Spectre and Meltdown L1 might not be long for this world.
- userbinator 8y agoThat would be "insecurity that gives us freedom", indeed.
- dnautics 8y agoIIRC there are attacks on sgx that use this.
- keyme 8y agoL3 is the only thing used on desktops. L1 on desktops requires Intel SGX, however, I haven't ever seen this implemented in reality. If anyone has seen it, please share. Otherwise, L1 exists only on Android and iOS, AFAIK. The article claims that you can't record HD content from Netflix with L3 DRM. IIRC, that's false. They require L1 only for 4k content.
- Reelin 8y agoOn a Dell Inspiron 2 in 1 manufactured earlier this year, I was amused (but pleased) to see that the firmware was shipping with SGX disabled by default.
- Freak_NL 8y ago> They require L1 only for 4k content. Doesn't Netflix support 4k on personal computers exclusively on Windows with Edge? Does that use L1?
- zamadatix 8y agoNetflix on Edge uses Microsoft's own PlayReady 3.0 not Widevine. It does offer the same DRM level as Widevine L1 though.
- iofiiiiiiiii 8y agoNetflix has capped software DRM devices to 720p, although possibly they make exceptions depending on platform. Pretty sure PC is still at 720p cap, though (I don't use Netflix, cannot confirm).