4 ms·

Hmmm... Would love if this allows me watch netflix using a fully FLOSSed arm sbc.

baybal2 5y ago
The point of semi-unusable DRMed crap when L1 released keep getting WEB-DLed? Very likely it's not the Shield now which leaks L1, but an actual key recovery because they get the stream even before it gets watermarked in the secure domain. My guess, it's Qualcomm's debugging TZ applets. They cannot really revoke keys because they will take down a giant amount of Snapdragon based handsets for which manufacturers don't bother to put a single OTA. This is also likely why Netflix uses such a silly restrictions as refusing to run on old Android version numbers on some Snapdragon handsets, which are easily root bypassable.
- step21 5y ago
  What's L1? web-dls I have seen are always relatively low resolution, so at least it protects fullhd or 4k.
  - baybal2 5y ago
    Widevine L1 - the hardware DRM in ARM trustzone with individual keys for each chip.
  - nyuszika7h 5y ago
    1080p WEB-DLs are very common if you're in the right places, but even public trackers should have plenty. 4K is slightly less common but does also happen, with frequency depending on the streaming service.
  - gruez 5y ago
    >so at least it protects fullhd or 4k. Not really. Popular streaming-exclusive shows often get 1080p versions released within a few hours, and the 2160p versions released within a few days.
  - drudu 5y ago
    I cannot find a single popular movie that's available to stream which isn't also available as a 4k WEB-DL on a popular, well known, private tracker.
  - denkmoon 5y ago
    The Grand Tour S04E03 4k web-dl is readily available on private torrent trackers hours after public release on Amazon Prime. No idea what encryption Amazon use, but suffice to say it is thoroughly broken by someone out there. Given the expense of acquiring those presenters and the production costs of their shows, and how they bring people to the Prime video platform, I suspect Amazon is reasonably interested in keeping that content protected.
- nyuszika7h 5y ago
  Lately Google has mostly stopped revoking whole devices. Instead, when someone extracts a key from a device and it leaks publicly, they just revoke that one specific device's key. That improves the experience for legitimate users, but also means the person who extracted the key can just go buy another device of the same model and use the same exploit to extract a new working key.
  - grishka 5y ago
    Are these keys unique per-device?
    - wmf 5y ago
      Yes.
      - baybal2 5y ago
        The content key at most Netflix like website is one for the entire library, only per-device key needed to get that key, and watermark ID is unique.
vladvasiliu 5y ago
I've never really looked long into these things, but now that most GPUs do the actual video decoding, how come it's still not possible to use Linux or any random OS? Isn't the GPU supposed to somehow guarantee that it only sends the decrypted stream to a compliant screen? Isn't this the point of HDCP? When this was done in software, I understand that open source decoders could have been modified to pipe the clear stream to disk, but now the software basically just hands the encrypted blob to a "trusted" hardware decoder. Or am I missing something?
- MaXtreeM 5y ago
  Linux is not the issue here but ARM processor as OP said. First DRM library for ARM came only earlier this year so finally I am able to play DRM content on Raspberry Pi 4 in Chromium but I am not going to because chromium is painfully slow and plugin maintainers have figured out how to play Netflix in Kodi. edit: DRM library still doesn't get to "fully FLOSSed"
  - vladvasiliu 5y ago
    So then Netflix et al.'s requirement of Windows or macOS in order to play high definition video is purely artificial on x86? Last time I checked (a few months ago) they didn't even support Chrome (either Windows or Mac) for UHD, they required Safari, Edge or their own Windows app.
    - jeroenhd 5y ago
      The UHD restriction is not a technical one. Content producers and the rest of the media industry has strict requirements about streaming. UHD content uses proprietary DRM systems from Microsoft and Apple that are considered more secure than WideVine, which is why those browsers are permitted to watch 4k. You can't watch UHD content on Edge for Linux, for example, because the necessary DRM isn't implemented.
      - Macha 5y ago
        Although, you used to be able to watch it in Windows Edge in Wine.

The point of semi-unusable DRMed crap when L1 released keep getting WEB-DLed? Very likely it's not the Shield now which leaks L1, but an actual key recovery because they get the stream even before it gets watermarked in the secure domain. My guess, it's Qualcomm's debugging TZ applets. They cannot really revoke keys because they will take down a giant amount of Snapdragon based handsets for which manufacturers don't bother to put a single OTA. This is also likely why Netflix uses such a silly restrictions as refusing to run on old Android version numbers on some Snapdragon handsets, which are easily root bypassable.

step21 5y ago
What's L1? web-dls I have seen are always relatively low resolution, so at least it protects fullhd or 4k.
- baybal2 5y ago
  Widevine L1 - the hardware DRM in ARM trustzone with individual keys for each chip.
- nyuszika7h 5y ago
  1080p WEB-DLs are very common if you're in the right places, but even public trackers should have plenty. 4K is slightly less common but does also happen, with frequency depending on the streaming service.
- gruez 5y ago
  >so at least it protects fullhd or 4k. Not really. Popular streaming-exclusive shows often get 1080p versions released within a few hours, and the 2160p versions released within a few days.
- drudu 5y ago
  I cannot find a single popular movie that's available to stream which isn't also available as a 4k WEB-DL on a popular, well known, private tracker.
- denkmoon 5y ago
  The Grand Tour S04E03 4k web-dl is readily available on private torrent trackers hours after public release on Amazon Prime. No idea what encryption Amazon use, but suffice to say it is thoroughly broken by someone out there. Given the expense of acquiring those presenters and the production costs of their shows, and how they bring people to the Prime video platform, I suspect Amazon is reasonably interested in keeping that content protected.
nyuszika7h 5y ago
Lately Google has mostly stopped revoking whole devices. Instead, when someone extracts a key from a device and it leaks publicly, they just revoke that one specific device's key. That improves the experience for legitimate users, but also means the person who extracted the key can just go buy another device of the same model and use the same exploit to extract a new working key.
- grishka 5y ago
  Are these keys unique per-device?
  - wmf 5y ago
    Yes.
    - baybal2 5y ago
      The content key at most Netflix like website is one for the entire library, only per-device key needed to get that key, and watermark ID is unique.

vladvasiliu 5y ago

I've never really looked long into these things, but now that most GPUs do the actual video decoding, how come it's still not possible to use Linux or any random OS? Isn't the GPU supposed to somehow guarantee that it only sends the decrypted stream to a compliant screen? Isn't this the point of HDCP? When this was done in software, I understand that open source decoders could have been modified to pipe the clear stream to disk, but now the software basically just hands the encrypted blob to a "trusted" hardware decoder. Or am I missing something?

MaXtreeM 5y ago
Linux is not the issue here but ARM processor as OP said. First DRM library for ARM came only earlier this year so finally I am able to play DRM content on Raspberry Pi 4 in Chromium but I am not going to because chromium is painfully slow and plugin maintainers have figured out how to play Netflix in Kodi. edit: DRM library still doesn't get to "fully FLOSSed"
- vladvasiliu 5y ago
  So then Netflix et al.'s requirement of Windows or macOS in order to play high definition video is purely artificial on x86? Last time I checked (a few months ago) they didn't even support Chrome (either Windows or Mac) for UHD, they required Safari, Edge or their own Windows app.
  - jeroenhd 5y ago
    The UHD restriction is not a technical one. Content producers and the rest of the media industry has strict requirements about streaming. UHD content uses proprietary DRM systems from Microsoft and Apple that are considered more secure than WideVine, which is why those browsers are permitted to watch 4k. You can't watch UHD content on Edge for Linux, for example, because the necessary DRM isn't implemented.
    - Macha 5y ago
      Although, you used to be able to watch it in Windows Edge in Wine.