4 ms·

HBO Max cranks up the Widevine DRM, leaves Linux users in the cold

29 points by evo_9 4y ago

LinuxBender 4y ago
Out of curiosity, has anyone started working on tools to sandbox applications and make them think they are on a "supported device"? Would this require a fake TPM module and would that module require a specific signed certificate? I ask because this reminds me of the old DeCSS [1] events. If a certificate is required, might there be a generalized way to intercept the call and trick the application? [1] - https://en.wikipedia.org/wiki/DeCSS#Jon_Lech_Johansen's_involvement https://en.wikipedia.org/wiki/DeCSS#Jon_Lech_Johansen's_invo...
- mindslight 4y ago
  I don't know much about Widevine specifically. But with true remote attestation, no, there is no way to shim, proxy, or otherwise man in the middle the challenges. Such a thing would be considered a bug in the remote attestation scheme. Currently there are plenty of bugs in remote attestation schemes (eg Google "Safety" Net), but we shouldn't expect that continue indefinitely. The only way to defeat such garbage is in the marketplace - reject interacting with companies that attempt to dictate how our own computers should work, and insist on only interacting through well-defined open protocols. As for the original topic, I'd just like to remind everyone that whatever content "HBO MAX" may have is also easily available through torrents. Download it once, watch it whenever and however you'd like, and pass it on. Friends don't let friends support Hollywood's war on personal computing.
  - GauntletWizard 4y ago
    Remote attestation still requires on working hardware keys, and on working hardware PKI chain, and control of that by "trustworthy" authorities; If a key leaks, it needs to be blacklisted fast. And as you've pointed out - "Would be considered a bug". Bugs happen. Bugs happen a lot in crypto, and bugs happen even more in crypto that no-one with a functioning brain could view positively. Decapping and recovering hardware keys is hard and expensive, but not impossible. But more importantly: Remote Attestation should be illegal. My hardware, my keys, my use case. Remote Attestation to control information is deeply unethical and deeply bad for democracy, because the same technology is even more useful for governments to control and censor.
- xt00 4y ago
  People do that to allow them to run the software video decoding decryption modes of widevine and similar -- but typically that is limited to lower resolution videos. To use the higher resolution like 4k streams, the browser will load the widevine lib (which is closed source) and then will try to determine if there is something like a trusted execution module that will allow decrypting the video frames with the hardware video decoder in a trusted buffer that can be sent out to the display without being accessible to the kernel or userspace. So unfortunately it is not trivial to work around with software -- but of course working around it via hardware is pretty much always possible one way or another even with HDCP.
- kotaKat 4y ago
  I know in the past one of the common things used by pirates is grabbing Widevine keyboxes from Android devices that haven't been blacklisted for HD/UHD content yet and using them to pull WebDLs down. Does that get impacted with this VMP stuff?
hadrien01 4y ago
(2020)
fxtentacle 4y ago
(2020) A move which in retrospect annoyed a lot of paying customers, yet hat no effect on the 0-day availability of 4K HDR rips on RARBG.
musicale 4y ago
Restored 3 months later: https://arstechnica.com/gadgets/2020/11/hbo-max-quietly-restored-service-to-linux-users/ https://arstechnica.com/gadgets/2020/11/hbo-max-quietly-rest... My pet peeve is that the switch to HBO Max included abandoning Apple TV 3rd gen, which previously had a functional app. Guess I should put Linux on it.
dusted 4y ago
That's an article from 2020, and also, it works just fine on my linux computer, in firefox even..

29 points by evo_9 4y ago

Out of curiosity, has anyone started working on tools to sandbox applications and make them think they are on a "supported device"? Would this require a fake TPM module and would that module require a specific signed certificate? I ask because this reminds me of the old DeCSS [1] events. If a certificate is required, might there be a generalized way to intercept the call and trick the application? [1] - https://en.wikipedia.org/wiki/DeCSS#Jon_Lech_Johansen's_involvement https://en.wikipedia.org/wiki/DeCSS#Jon_Lech_Johansen's_invo...

mindslight 4y ago
I don't know much about Widevine specifically. But with true remote attestation, no, there is no way to shim, proxy, or otherwise man in the middle the challenges. Such a thing would be considered a bug in the remote attestation scheme. Currently there are plenty of bugs in remote attestation schemes (eg Google "Safety" Net), but we shouldn't expect that continue indefinitely. The only way to defeat such garbage is in the marketplace - reject interacting with companies that attempt to dictate how our own computers should work, and insist on only interacting through well-defined open protocols. As for the original topic, I'd just like to remind everyone that whatever content "HBO MAX" may have is also easily available through torrents. Download it once, watch it whenever and however you'd like, and pass it on. Friends don't let friends support Hollywood's war on personal computing.
- GauntletWizard 4y ago
  Remote attestation still requires on working hardware keys, and on working hardware PKI chain, and control of that by "trustworthy" authorities; If a key leaks, it needs to be blacklisted fast. And as you've pointed out - "Would be considered a bug". Bugs happen. Bugs happen a lot in crypto, and bugs happen even more in crypto that no-one with a functioning brain could view positively. Decapping and recovering hardware keys is hard and expensive, but not impossible. But more importantly: Remote Attestation should be illegal. My hardware, my keys, my use case. Remote Attestation to control information is deeply unethical and deeply bad for democracy, because the same technology is even more useful for governments to control and censor.
xt00 4y ago
People do that to allow them to run the software video decoding decryption modes of widevine and similar -- but typically that is limited to lower resolution videos. To use the higher resolution like 4k streams, the browser will load the widevine lib (which is closed source) and then will try to determine if there is something like a trusted execution module that will allow decrypting the video frames with the hardware video decoder in a trusted buffer that can be sent out to the display without being accessible to the kernel or userspace. So unfortunately it is not trivial to work around with software -- but of course working around it via hardware is pretty much always possible one way or another even with HDCP.
kotaKat 4y ago
I know in the past one of the common things used by pirates is grabbing Widevine keyboxes from Android devices that haven't been blacklisted for HD/UHD content yet and using them to pull WebDLs down. Does that get impacted with this VMP stuff?

hadrien01 4y ago

(2020)

fxtentacle 4y ago

(2020) A move which in retrospect annoyed a lot of paying customers, yet hat no effect on the 0-day availability of 4K HDR rips on RARBG.

musicale 4y ago

Restored 3 months later: https://arstechnica.com/gadgets/2020/11/hbo-max-quietly-restored-service-to-linux-users/ https://arstechnica.com/gadgets/2020/11/hbo-max-quietly-rest... My pet peeve is that the switch to HBO Max included abandoning Apple TV 3rd gen, which previously had a functional app. Guess I should put Linux on it.

dusted 4y ago

That's an article from 2020, and also, it works just fine on my linux computer, in firefox even..