3 ms·

So a form of DRM on the APIs themselves? It wouldn't be easy. How would you determine if the request is originating from an official YT developed app (iOS, Andr

by xyst 5y ago

So a form of DRM on the APIs themselves? It wouldn't be easy. How would you determine if the request is originating from an official YT developed app (iOS, Android, ...) or client (YouTube.com); or a non-approved client? I suppose you can have a system which works like TOTP except for machine-to-machine. Although it would probably be broken since anything on the client side can be disassembled. The UX would likely suffer as a result as well.

freedomben 5y ago
I think the best you could do is attempt detection/fingerprinting, but I don't think it's possible to stop it since you never have full control of the client. I once saw a certificate-based implementation once where the server issued a temporary x509 cert to the client and then used mTLS[1]. It did reduce "unauthorized" clients by raising the bar, but it ended up making life way harder for their devs and the people they really wanted to stop just implemented the cert strategy and moved on. [1]: https://freedomben.medium.com/what-is-mtls-and-how-does-it-work-9dcdbf6c1e41?sk=45af139ec181252e711590b6ca73dc2f https://freedomben.medium.com/what-is-mtls-and-how-does-it-w...