13 ms·

"because DRM is fundamentally pointless" I dunno, it gave this person a lot of trouble and the result is maybe a very narrow victory that doesn't practically m

"because DRM is fundamentally pointless" I dunno, it gave this person a lot of trouble and the result is maybe a very narrow victory that doesn't practically matter? And this is the lowest level of widevine security - L3 which is basically assumed to be owned. Good luck with L1 which uses trusted compute primitives. DRM has won. And I'm saying this as someone who agrees DRM is a threat to society as we're taking things that the world could otherwise have for free and denying it them so we can instead charge a small % for it. So we're intelligent enough to build this kind of technical sophistication but we are unable/unwilling to figure out a different model for financing it.

magila 5y ago
If you know where to look L1 content can be readily downloaded, including the original 4K streams. As usual the net effect of DRM is to make the paid service inferior to piracy. That's not what I would call "wining".
- nyuszika7h 5y ago
  I don't know why you're being downvoted, you're right. There are plenty of TrustZone exploits that allow extraction of L1 keys.
  - R0b0t1 5y ago
    For now, at least. It is possible they fix all issues.
    - kristofferR 5y ago
      Not really, since that would entail breaking playback on current devices/firmwares. They can only try again next time (for 8K?).
      - anonuser123456 5y ago
        Broken TZ does not mean the algorithms are broken, only that exploits exist to bypass TZ. Fixing the exploits doesn't break anything about the algorithms for decode / decrypt.
        kristofferR 5y ago
        I'm not sure what in my comment you were disagreeing to. Fixing the exploits would entail requiring a software update/breaking unupdatable devices.
        wmf 5y ago
        Yep. I remember when Blu-ray "required" Windows Vista because it had better DRM APIs then a few months later the studios gave in and allowed playback on XP... which was immediately cracked. Ultimately you have to meet customers where they are which is old devices.
      - R0b0t1 5y ago
        Until current broken devices fall out of use. Eventually, all devices might be secure.
    - realusername 5y ago
      Except that people who exploit L1 just never reveal how they do it, good luck with that. That's the beauty of the asymmetry against DRM, only a single decoded file (which will always happen) is enough for seeding to everybody.
      - SilverRed 5y ago
        This seems to be confirmed by the fact that most torrent sites have 4K copies of brand new streaming only content while no publicly known exploits exist. Since you are running the exploit locally without affecting other peoples machines, I imagine it would be close to impossible to work out what exploit they are using.
        Wowfunhappy 5y ago
        Are those actual decrypted copies of the original stream, though? Or did they just re-record the output? For the latter you'd only need to break HDCP, right?
        lmm 5y ago
        If the end user can't tell then it doesn't matter.
        Wowfunhappy 5y ago
        Well but there's likely to be at least a small quality difference, and a considerable a quality per file size difference, because the video would need to be re-encoded.
        kristofferR 5y ago
        Yeah. They're WEB-DLs, not WebRips.
    - deleted 5y ago
      [deleted]
  - rodgerd 5y ago
    Pay NZ$20/mo for Netflix in UHD, or fuck around on pirate sites to make sure none of the people making the series and films I'm enjoying, while hoping that no-one has dropped an entertaining payload in the site ads or the files I'm downloading is "piracy is more convenient"? The downvotes are for a shit take disconnected from the reality of people who aren't determined not to pay for something.
    - m-p-3 5y ago
      > piracy is more convenient It sure is when I can load an entire show on a Plex instance and can sync it on my mobile device without any arbitrary limitation (like how many episodes I can sync, or synced copies that expires after a while which I experienced abroad on Netflix).
    - jimmydorry 5y ago
      Step 1. Pay NZ$20/mo for Netflix in UHD. Step 2. The content you want is not there or available on any other legal platform for your country. Step 3. ????
    - Arch-TK 5y ago
      This has nothing with a determination not to pay or to have studios go out of business. This has everything to do with artificially restricting me from being able to watch the content I pay for in a manner which is convenient to me. I have no interest in buying into a proprietary ecosystem of shitty software just to watch a TV series. Whenever a service provides content in a way which I can access DRM free, I make sure to reward them for it by voting with my wallet. I sometimes also tell them to make sure they understand that one of the factors in my decision to give them money was the fact that they offered the content DRM free. But not because I wanted to re-upload it for free via bittorrent or show it in a cinema to all my friends, but precisely because I wanted to watch it on my computer without having to install crazy whitebox crypto nonsense. I don't think normalising having to run someone else's crazy whitebox crypto nonsense on your computer is a good idea. Even if most people don't know or care.
- toxik 5y ago
  I don’t understand how it can ever be secure unless you let some DRM representatives basically come and do inspections. Fundamentally, you are going to show a video and play an audio stream. Fundamentally, it can be recaptured perfectly because it must be displayed and played perfectly. There is simply no way around it. DRM can only make life hard for the regular Joes.
  - codetrotter 5y ago
    > I don’t understand how it can ever be secure unless you let some DRM representatives basically come and do inspections. Oh god, that’s a level of hell I haven’t even imagined. I wonder if the future could ever become as dystopian as that for real. What it would take for that to happen, and how.
    - Godel_unicode 5y ago
      I see you've never worked with Oracle...
    - Wowfunhappy 5y ago
      I don't know, but assume, that the movie studios do this for movie theaters. Seems to work pretty well, since too my knowledge those are only ever leaked by audience members pointing a hidden camera at the screen (with all the quality issues that entails).
  - meowface 5y ago
    This fundamental gap is known as "the analog hole": https://en.wikipedia.org/wiki/Analog_hole https://en.wikipedia.org/wiki/Analog_hole
- elcritch 5y ago
  In theory DRM could be mathematically perfect. However DRM relies on actual implementations both in software and hardware and shares a lot with broader security. Software implementations can have bugs but it’s relatively easy to ship fixes. The hardware level however is where it becomes very difficult to ensure a valid implementation of “secure compute” or “trusted zones” which are key to DRM and general security, particularly from an agent with physical access. It costs money to ship new fixed hardware, if it’s even possible. Then even if a given hardware implementation is correct there are ways to physically glitch the hardware to skip the checks. ESP32 chips had an issue like that where the hardware encryption was correct but simply “glitching” the voltage at the correct time could cause the processor to skip the encryption check entirely [1]. It’s very difficult and costly to make hardware immune to all such attacks. Small seemingly unrelated physical details can become novel ways to break the encryption system (like specter). Ultimately I’ve come to believe that DRM and it’s cousin of system security is an economic game. So DRM useless in that it will probably be cracked after some time, but that time can translate to revenues or control until that point. It depends on how much money you have to throw at either hardening and cracking systems. It’ll likely become harder (i.e. more expensive) in the future to crack hardware DRM in the future as the technology becomes more sophisticated and classes of vulnerability are discovered and mitigated. But then the cracks become more valuable both for anti-DRM or anti-security. 1: https://raelize.com/blog/espressif-systems-esp32-bypassing-sb-using-emfi/ https://raelize.com/blog/espressif-systems-esp32-bypassing-s...
  - SilverRed 5y ago
    How can DRM ever be perfect? It relies on your computer to be able to decrypt the data so it an never be "mathematically perfect" like regular encryption can be. Current DRM is all about shoving the decryption part as deep in to a chip as possible and betting on the fact that it is physically too hard to extract that info. So it will always be exploitable with some amount of effort.
    - CamperBob2 5y ago
      It can depend on online keys that can be changed by the rightsholder at will. "The Internet is the ultimate dongle" - John Carmack
grishka 5y ago
DRM is always pointless because the content has to be converted to analog form at some point. So, it gets decrypted in the DistrustZone, decompressed, then encrypted again before it goes over HDCP to your display, which then decrypts it to show it on the screen. Couldn't you capture the LVDS signal that the display panel receives? And even if you don't do that, isn't every version of HDCP cracked already so you could use a capture card instead?
- wmf 5y ago
  The last bastion of DRM is forensic watermarking (so they can trace the leaked video back to your device) and key revocation (so your device won't play any new content). These techniques are so complex that they aren't used much.
  - grishka 5y ago
    So they trace the ripped video file to a particular throwaway account that was registered with a prepaid card, then what? And if you're determined enough, you could as well rip multiple copies on behalf of multiple accounts and average out the pixel colors.
    - wmf 5y ago
      The idea is to revoke the device, not the account.
    - throwaway525142 5y ago
      > you could as well rip multiple copies on behalf of multiple accounts and average out the pixel colors. Can you show that this can reliable get rid of the fingerprinting? This particular method could be countered by only including the fingerprint info in a few random frames, then you'd be able to retrieve the account info of all the accounts that participated in ripping. I don't think finding a method to counter any sort of fingerprinting is as easy as "just averaging the pixels".
      - 5y ago
bottled_poe 5y ago
> DRM is a threat to society as we're taking things that the world could otherwise have for free But someone needs to pay to create those things in the first place. Payment for work after the fact is the basic incentive.
- Arch-TK 5y ago
  I think if DRM didn't exist piracy would be just as rampant (i.e. not very, since for the average joe it seems more convenient to just go on netflix or amazon prime or whatever) and people would still get paid. People are against DRM not because they don't want to pay for content, but because they want to be able to play the content they pay for. And not in breach of the license they have been sold. I have every interest in participating in the content market and paying people to make content. I have no interest in having to buy special proprietary hardware or run special proprietary code on my computer just to do it.
Arainach 5y ago
>we're taking things that the world could otherwise have for free and denying it them so we can instead charge a small % for it Are we? Where are the studios making feature-length movie-quality content and putting it on YouTube to be supported by ad money? There isn't even an equivalent to TV in that form factor. All of the new content that requires any sort of production budget (actor salaries, non-trivial special effects) is on platforms with subscription fees and DRM to require those subscription fees because we can't have these things for free.

magila 5y ago

If you know where to look L1 content can be readily downloaded, including the original 4K streams. As usual the net effect of DRM is to make the paid service inferior to piracy. That's not what I would call "wining".

nyuszika7h 5y ago
I don't know why you're being downvoted, you're right. There are plenty of TrustZone exploits that allow extraction of L1 keys.
- R0b0t1 5y ago
  For now, at least. It is possible they fix all issues.
  - kristofferR 5y ago
    Not really, since that would entail breaking playback on current devices/firmwares. They can only try again next time (for 8K?).
    - anonuser123456 5y ago
      Broken TZ does not mean the algorithms are broken, only that exploits exist to bypass TZ. Fixing the exploits doesn't break anything about the algorithms for decode / decrypt.
      - kristofferR 5y ago
        I'm not sure what in my comment you were disagreeing to. Fixing the exploits would entail requiring a software update/breaking unupdatable devices.
        wmf 5y ago
        Yep. I remember when Blu-ray "required" Windows Vista because it had better DRM APIs then a few months later the studios gave in and allowed playback on XP... which was immediately cracked. Ultimately you have to meet customers where they are which is old devices.
    - R0b0t1 5y ago
      Until current broken devices fall out of use. Eventually, all devices might be secure.
  - realusername 5y ago
    Except that people who exploit L1 just never reveal how they do it, good luck with that. That's the beauty of the asymmetry against DRM, only a single decoded file (which will always happen) is enough for seeding to everybody.
    - SilverRed 5y ago
      This seems to be confirmed by the fact that most torrent sites have 4K copies of brand new streaming only content while no publicly known exploits exist. Since you are running the exploit locally without affecting other peoples machines, I imagine it would be close to impossible to work out what exploit they are using.
      - Wowfunhappy 5y ago
        Are those actual decrypted copies of the original stream, though? Or did they just re-record the output? For the latter you'd only need to break HDCP, right?
        lmm 5y ago
        If the end user can't tell then it doesn't matter.
        Wowfunhappy 5y ago
        Well but there's likely to be at least a small quality difference, and a considerable a quality per file size difference, because the video would need to be re-encoded.
        kristofferR 5y ago
        Yeah. They're WEB-DLs, not WebRips.
  - deleted 5y ago
    [deleted]
- rodgerd 5y ago
  Pay NZ$20/mo for Netflix in UHD, or fuck around on pirate sites to make sure none of the people making the series and films I'm enjoying, while hoping that no-one has dropped an entertaining payload in the site ads or the files I'm downloading is "piracy is more convenient"? The downvotes are for a shit take disconnected from the reality of people who aren't determined not to pay for something.
  - m-p-3 5y ago
    > piracy is more convenient It sure is when I can load an entire show on a Plex instance and can sync it on my mobile device without any arbitrary limitation (like how many episodes I can sync, or synced copies that expires after a while which I experienced abroad on Netflix).
  - jimmydorry 5y ago
    Step 1. Pay NZ$20/mo for Netflix in UHD. Step 2. The content you want is not there or available on any other legal platform for your country. Step 3. ????
  - Arch-TK 5y ago
    This has nothing with a determination not to pay or to have studios go out of business. This has everything to do with artificially restricting me from being able to watch the content I pay for in a manner which is convenient to me. I have no interest in buying into a proprietary ecosystem of shitty software just to watch a TV series. Whenever a service provides content in a way which I can access DRM free, I make sure to reward them for it by voting with my wallet. I sometimes also tell them to make sure they understand that one of the factors in my decision to give them money was the fact that they offered the content DRM free. But not because I wanted to re-upload it for free via bittorrent or show it in a cinema to all my friends, but precisely because I wanted to watch it on my computer without having to install crazy whitebox crypto nonsense. I don't think normalising having to run someone else's crazy whitebox crypto nonsense on your computer is a good idea. Even if most people don't know or care.
toxik 5y ago
I don’t understand how it can ever be secure unless you let some DRM representatives basically come and do inspections. Fundamentally, you are going to show a video and play an audio stream. Fundamentally, it can be recaptured perfectly because it must be displayed and played perfectly. There is simply no way around it. DRM can only make life hard for the regular Joes.
- codetrotter 5y ago
  > I don’t understand how it can ever be secure unless you let some DRM representatives basically come and do inspections. Oh god, that’s a level of hell I haven’t even imagined. I wonder if the future could ever become as dystopian as that for real. What it would take for that to happen, and how.
  - Godel_unicode 5y ago
    I see you've never worked with Oracle...
  - Wowfunhappy 5y ago
    I don't know, but assume, that the movie studios do this for movie theaters. Seems to work pretty well, since too my knowledge those are only ever leaked by audience members pointing a hidden camera at the screen (with all the quality issues that entails).
- meowface 5y ago
  This fundamental gap is known as "the analog hole": https://en.wikipedia.org/wiki/Analog_hole https://en.wikipedia.org/wiki/Analog_hole
elcritch 5y ago
In theory DRM could be mathematically perfect. However DRM relies on actual implementations both in software and hardware and shares a lot with broader security. Software implementations can have bugs but it’s relatively easy to ship fixes. The hardware level however is where it becomes very difficult to ensure a valid implementation of “secure compute” or “trusted zones” which are key to DRM and general security, particularly from an agent with physical access. It costs money to ship new fixed hardware, if it’s even possible. Then even if a given hardware implementation is correct there are ways to physically glitch the hardware to skip the checks. ESP32 chips had an issue like that where the hardware encryption was correct but simply “glitching” the voltage at the correct time could cause the processor to skip the encryption check entirely [1]. It’s very difficult and costly to make hardware immune to all such attacks. Small seemingly unrelated physical details can become novel ways to break the encryption system (like specter). Ultimately I’ve come to believe that DRM and it’s cousin of system security is an economic game. So DRM useless in that it will probably be cracked after some time, but that time can translate to revenues or control until that point. It depends on how much money you have to throw at either hardening and cracking systems. It’ll likely become harder (i.e. more expensive) in the future to crack hardware DRM in the future as the technology becomes more sophisticated and classes of vulnerability are discovered and mitigated. But then the cracks become more valuable both for anti-DRM or anti-security. 1: https://raelize.com/blog/espressif-systems-esp32-bypassing-sb-using-emfi/ https://raelize.com/blog/espressif-systems-esp32-bypassing-s...
- SilverRed 5y ago
  How can DRM ever be perfect? It relies on your computer to be able to decrypt the data so it an never be "mathematically perfect" like regular encryption can be. Current DRM is all about shoving the decryption part as deep in to a chip as possible and betting on the fact that it is physically too hard to extract that info. So it will always be exploitable with some amount of effort.
  - CamperBob2 5y ago
    It can depend on online keys that can be changed by the rightsholder at will. "The Internet is the ultimate dongle" - John Carmack

grishka 5y ago

DRM is always pointless because the content has to be converted to analog form at some point. So, it gets decrypted in the DistrustZone, decompressed, then encrypted again before it goes over HDCP to your display, which then decrypts it to show it on the screen. Couldn't you capture the LVDS signal that the display panel receives? And even if you don't do that, isn't every version of HDCP cracked already so you could use a capture card instead?

wmf 5y ago
The last bastion of DRM is forensic watermarking (so they can trace the leaked video back to your device) and key revocation (so your device won't play any new content). These techniques are so complex that they aren't used much.
- grishka 5y ago
  So they trace the ripped video file to a particular throwaway account that was registered with a prepaid card, then what? And if you're determined enough, you could as well rip multiple copies on behalf of multiple accounts and average out the pixel colors.
  - wmf 5y ago
    The idea is to revoke the device, not the account.
  - throwaway525142 5y ago
    > you could as well rip multiple copies on behalf of multiple accounts and average out the pixel colors. Can you show that this can reliable get rid of the fingerprinting? This particular method could be countered by only including the fingerprint info in a few random frames, then you'd be able to retrieve the account info of all the accounts that participated in ripping. I don't think finding a method to counter any sort of fingerprinting is as easy as "just averaging the pixels".
    - 5y ago

bottled_poe 5y ago

> DRM is a threat to society as we're taking things that the world could otherwise have for free But someone needs to pay to create those things in the first place. Payment for work after the fact is the basic incentive.

Arch-TK 5y ago
I think if DRM didn't exist piracy would be just as rampant (i.e. not very, since for the average joe it seems more convenient to just go on netflix or amazon prime or whatever) and people would still get paid. People are against DRM not because they don't want to pay for content, but because they want to be able to play the content they pay for. And not in breach of the license they have been sold. I have every interest in participating in the content market and paying people to make content. I have no interest in having to buy special proprietary hardware or run special proprietary code on my computer just to do it.

Arainach 5y ago

>we're taking things that the world could otherwise have for free and denying it them so we can instead charge a small % for it Are we? Where are the studios making feature-length movie-quality content and putting it on YouTube to be supported by ad money? There isn't even an equivalent to TV in that form factor. All of the new content that requires any sort of production budget (actor salaries, non-trivial special effects) is on platforms with subscription fees and DRM to require those subscription fees because we can't have these things for free.