6 ms·

Widevine has been privately cracked/bypassed. The method hasn't been made public as it would obviously get patched rather quickly (if it even can be patched).

Widevine has been privately cracked/bypassed. The method hasn't been made public as it would obviously get patched rather quickly (if it even can be patched). That's why Netflix content is available almost immediately on any decent tracker. The quality would not look nearly as good if it was grabbed using a capture card. Like others have mentioned, it's security theater for the content owners who most likely require Netflix to have DRM in place in their contracts.

Gigachad 4y ago
This is why audio and video drm is so useless. All the cracking teams have their own methods which they don’t need to publish. Unlike video game drm where the cracks have to be published with the game.
- mike_hearn 4y ago
  It's actually a bit dangerous for ripping groups to do that if they're in countries friendly to western interests, because the media companies can initiate a traitor tracing protocol to figure out where the leaks are coming from and then initiate prosecutions. Traitor tracing algorithms are well known in the literature and some are undetectable. When this game was playing out with BluRay, it wasn't possible for the media groups to directly attack the ripper makers because the primary developers were in Antigua which had a WTO ruling against the USA allowing Antiguans to ignore US intellectual property rights. I forget the political background. Later I think someone in China started doing it too. The point is though, that the tech converted (for a time) the problem from one of intractable scale to one of "if we get these two companies then the issue disappears because they're the only ones who have the knowledge". That opens up all sorts of new strategies for the media companies to pursue. They may not work, but, the situation is definitely not the same as before. BTW video game cracks don't have to be published with the game. They can just publish the patches to the game files without releasing any tools they created to make those patches.
rowanG077 4y ago
Why would a capture card look any worse? Isn't it capturing lossless video output? Just because of the re-encode?
- yosito 4y ago
  Capture is not lossless. Think about a photocopy machine, every copy loses a small bit of information. Recapturing video output is a similar situation.
  - rowanG077 4y ago
    Why? Photocopy is obviously lossy since there is a very noisy digital-analog-digital conversion going on. But a capture card is capturing a digital signal. There should be no loss except for video decoding/encoding artifacts.
    - donkers 4y ago
      The capture itself could be lossless but would be ridiculously huge, re-encoding that to a usable file size will introduce some loss.
    - vel0city 4y ago
      You're not understanding how lossy compression encoders work. Try recompressing a JPEG a few dozen times. Or take an MP3 and export it from Audacity, open the export, export as MP3 again a dozen times and see what it sounds like. All those artifacts keep getting amplified every time you re-encode until it's practically just the artifacts. Every time you render and recompress you're losing information, it's lossy compression after all. https://youtu.be/icruGcSsPp0 https://youtu.be/icruGcSsPp0
      - steve1977 4y ago
        But the loss happens during re-encoding, not during capture.
MBCook 4y ago
Just because piracy is possible doesn’t mean they should make it as easy as it can be for users. There’s value in even minor hurdles. They clear think it’s worth it.
- AnthonyMouse 4y ago
  > Just because piracy is possible doesn’t mean they should make it as easy as it can be for users. > There’s value in even minor hurdles. The hurdles only exist for the people who are paying them. It makes piracy more attractive relative to paying, by making the experience you get when you pay worse. > They clear think it’s worth it. They're corporations. Management is under pressure to be seen doing something about piracy and the DRM vendors saw an opportunity to sell them some snake oil.
  - acomjean 4y ago
    Making the experience worse fir customers than pirates is inexcusable. Can’t watch on all my devices, that’s not an issue with pirated stuff. Streamers work hard to make their interfaces good and recommendations valuable because that is their value add. I suspect DRM might be added because circumventing is a different violation as opposed to just copyright infringement.
- diffeomorphism 4y ago
  > they clearly think it is worth it. That is like arguing that "clearly people think fax is secure, otherwise they wouldn't use it". No, it is obviously theater but other people insist you use it and while useless the effort to change it is "not worth it".
  - jwandborg 4y ago
    Cell pagers are also deemed secure in some places, despite being broadcast over a wide area. Both of the technologies can be seen as "secured" by laws outlawing listening to the information sent in cleartext. I wouldn't call it "security theatre", i would call it "security through legislation" or something along those lines. I thought "security theatre" was a routine that promised, but did not provide, additional security, and while there is no technical security, there technically is some security, in the form of legislation.
Strom 4y ago
Not just privately either, there have been tools circulating even on GitHub. For a L3 example there's one repo [1] that's kind of still up but not really. Still enough to show that it happened. L1 bypass has also been on GitHub briefly. However these things get deleted rather fast for obvious reasons. -- [1] https://github.com/tomer8007/widevine-l3-decryptor https://github.com/tomer8007/widevine-l3-decryptor
_a9 4y ago
It's not even private anymore. Anyone can easily find tools on GitHub or other sites[0] that can download widevine'd content. It's easy to find L3 keys on GitHub too. There are public sites[1] that get the decryption keys but using their own keys on the backend if you cant find keys or don't know how to dump the keys. There is an all-in-one tool[2] that lets anyone with 0 knowledge of DRM to dump content from practically any site that uses widevine, costs a leg but it's meant for people who don't want to waste time finding tools and learning how to do it manually. [0]: https://cdm-project.com/CDM-Tools/ https://cdm-project.com/CDM-Tools/ [1]: https://cdrm-project.com/ https://cdrm-project.com/ & http://getwvkeys.cc/ http://getwvkeys.cc/ [2]: https://streamfab.com/ https://streamfab.com/
- lern_too_spel 4y ago
  The all-in-one tool only decrypts Widevine L3, which is the lowest security Widevine protocol according to TFA. 4k content is only available with Widevine L1. The others don't say which level they support, but I assume it's the same.
  - RuggedPineapple 4y ago
    That tool says it does for 4k for HBO Max. All the other platforms (Netflix, Hulu, Amazon, Disney+) are 720 or 1080 though. Wonder whats going on there.
    - porbelm 4y ago
      Perhaps HBO Max only uses L3 for all content then?
      - _a9 4y ago
        HBO Max is L1 for 1080p+ but revoked L1 keys usually work on there
Mindwipe 4y ago
> Widevine has been privately cracked/bypassed. Sort of. Widevine has various levels, and there are exploits for the lower ones. But the upper ones really only have a vulnerability if a hardware key gets extracted, and Netflix shows in higher resolutions are increasingly not available anywhere because of that. Stranger things Season 4 was only available at 720p for more than a month.
- dtx1 4y ago
  Just checked up on this, currently there are torrents available for Stranger Things Season 4. > Stranger Things S02E09 2160p NF WEB-DL DTS-HD MA 5 1 HDR DV HEVC-FRiENDS So either the DRM Level was reduced after the release (why would they ever do that?) or it was cracked but takes some time to do so.
  - Mindwipe 4y ago
    It was cracked but they had to burn a hardware exploit to do so and the key was (I assume) subsequently revoked. So they are only doing it sometimes when there is a sufficient buildup of content.

Gigachad 4y ago

This is why audio and video drm is so useless. All the cracking teams have their own methods which they don’t need to publish. Unlike video game drm where the cracks have to be published with the game.

mike_hearn 4y ago
It's actually a bit dangerous for ripping groups to do that if they're in countries friendly to western interests, because the media companies can initiate a traitor tracing protocol to figure out where the leaks are coming from and then initiate prosecutions. Traitor tracing algorithms are well known in the literature and some are undetectable. When this game was playing out with BluRay, it wasn't possible for the media groups to directly attack the ripper makers because the primary developers were in Antigua which had a WTO ruling against the USA allowing Antiguans to ignore US intellectual property rights. I forget the political background. Later I think someone in China started doing it too. The point is though, that the tech converted (for a time) the problem from one of intractable scale to one of "if we get these two companies then the issue disappears because they're the only ones who have the knowledge". That opens up all sorts of new strategies for the media companies to pursue. They may not work, but, the situation is definitely not the same as before. BTW video game cracks don't have to be published with the game. They can just publish the patches to the game files without releasing any tools they created to make those patches.

rowanG077 4y ago

Why would a capture card look any worse? Isn't it capturing lossless video output? Just because of the re-encode?

yosito 4y ago
Capture is not lossless. Think about a photocopy machine, every copy loses a small bit of information. Recapturing video output is a similar situation.
- rowanG077 4y ago
  Why? Photocopy is obviously lossy since there is a very noisy digital-analog-digital conversion going on. But a capture card is capturing a digital signal. There should be no loss except for video decoding/encoding artifacts.
  - donkers 4y ago
    The capture itself could be lossless but would be ridiculously huge, re-encoding that to a usable file size will introduce some loss.
  - vel0city 4y ago
    You're not understanding how lossy compression encoders work. Try recompressing a JPEG a few dozen times. Or take an MP3 and export it from Audacity, open the export, export as MP3 again a dozen times and see what it sounds like. All those artifacts keep getting amplified every time you re-encode until it's practically just the artifacts. Every time you render and recompress you're losing information, it's lossy compression after all. https://youtu.be/icruGcSsPp0 https://youtu.be/icruGcSsPp0
    - steve1977 4y ago
      But the loss happens during re-encoding, not during capture.

MBCook 4y ago

Just because piracy is possible doesn’t mean they should make it as easy as it can be for users. There’s value in even minor hurdles. They clear think it’s worth it.

AnthonyMouse 4y ago
> Just because piracy is possible doesn’t mean they should make it as easy as it can be for users. > There’s value in even minor hurdles. The hurdles only exist for the people who are paying them. It makes piracy more attractive relative to paying, by making the experience you get when you pay worse. > They clear think it’s worth it. They're corporations. Management is under pressure to be seen doing something about piracy and the DRM vendors saw an opportunity to sell them some snake oil.
- acomjean 4y ago
  Making the experience worse fir customers than pirates is inexcusable. Can’t watch on all my devices, that’s not an issue with pirated stuff. Streamers work hard to make their interfaces good and recommendations valuable because that is their value add. I suspect DRM might be added because circumventing is a different violation as opposed to just copyright infringement.
diffeomorphism 4y ago
> they clearly think it is worth it. That is like arguing that "clearly people think fax is secure, otherwise they wouldn't use it". No, it is obviously theater but other people insist you use it and while useless the effort to change it is "not worth it".
- jwandborg 4y ago
  Cell pagers are also deemed secure in some places, despite being broadcast over a wide area. Both of the technologies can be seen as "secured" by laws outlawing listening to the information sent in cleartext. I wouldn't call it "security theatre", i would call it "security through legislation" or something along those lines. I thought "security theatre" was a routine that promised, but did not provide, additional security, and while there is no technical security, there technically is some security, in the form of legislation.

Strom 4y ago

Not just privately either, there have been tools circulating even on GitHub. For a L3 example there's one repo [1] that's kind of still up but not really. Still enough to show that it happened. L1 bypass has also been on GitHub briefly. However these things get deleted rather fast for obvious reasons. -- [1] https://github.com/tomer8007/widevine-l3-decryptor https://github.com/tomer8007/widevine-l3-decryptor

_a9 4y ago

It's not even private anymore. Anyone can easily find tools on GitHub or other sites[0] that can download widevine'd content. It's easy to find L3 keys on GitHub too. There are public sites[1] that get the decryption keys but using their own keys on the backend if you cant find keys or don't know how to dump the keys. There is an all-in-one tool[2] that lets anyone with 0 knowledge of DRM to dump content from practically any site that uses widevine, costs a leg but it's meant for people who don't want to waste time finding tools and learning how to do it manually. [0]: https://cdm-project.com/CDM-Tools/ https://cdm-project.com/CDM-Tools/ [1]: https://cdrm-project.com/ https://cdrm-project.com/ & http://getwvkeys.cc/ http://getwvkeys.cc/ [2]: https://streamfab.com/ https://streamfab.com/

lern_too_spel 4y ago
The all-in-one tool only decrypts Widevine L3, which is the lowest security Widevine protocol according to TFA. 4k content is only available with Widevine L1. The others don't say which level they support, but I assume it's the same.
- RuggedPineapple 4y ago
  That tool says it does for 4k for HBO Max. All the other platforms (Netflix, Hulu, Amazon, Disney+) are 720 or 1080 though. Wonder whats going on there.
  - porbelm 4y ago
    Perhaps HBO Max only uses L3 for all content then?
    - _a9 4y ago
      HBO Max is L1 for 1080p+ but revoked L1 keys usually work on there

Mindwipe 4y ago

> Widevine has been privately cracked/bypassed. Sort of. Widevine has various levels, and there are exploits for the lower ones. But the upper ones really only have a vulnerability if a hardware key gets extracted, and Netflix shows in higher resolutions are increasingly not available anywhere because of that. Stranger things Season 4 was only available at 720p for more than a month.

dtx1 4y ago
Just checked up on this, currently there are torrents available for Stranger Things Season 4. > Stranger Things S02E09 2160p NF WEB-DL DTS-HD MA 5 1 HDR DV HEVC-FRiENDS So either the DRM Level was reduced after the release (why would they ever do that?) or it was cracked but takes some time to do so.
- Mindwipe 4y ago
  It was cracked but they had to burn a hardware exploit to do so and the key was (I assume) subsequently revoked. So they are only doing it sometimes when there is a sufficient buildup of content.