6 ms·

4K streaming content is hit or miss because most services lock that behind Widevine L1, which requires implementors to use a secure enclave and the entire signa

4K streaming content is hit or miss because most services lock that behind Widevine L1, which requires implementors to use a secure enclave and the entire signal path to use strong encryption. If an L1 implementation gets compromised it quickly has its keys revoked and is downgraded to L2/L3, so piracy groups have a limited time window to dump as much 4K content as possible. Those lower Winevines tiers are permanently broken though so everything is immediately available in at least 1080p. 4K Blurays are currently always ripped due to an unfixable compromise in Intel SGX allowing PowerDVDs keys to be extracted, they could close that hole by revoking PowerDVDs keys for new Bluray releases but they haven't done that yet. I imagine they will at some point because PowerDVD requires SGX to play UHDs, and Intel stopped supporting that on newer consumer hardware, so 4K Bluray playback on PCs is effectively being phased out.

ricktdotorg 3y ago
^^^ great comment. hard to imagine a better synposis of 4k DRM in ~2 grafs. thanks!
- gorkish 3y ago
  Not mentioned above, but should be noted that all of this DRM is still only protecting the compressed and encoded video content. Schemes to protect the uncompressed digital video data are all permanently and universally broken or bypassed. The 'analog hole' has gone fully digital. One would think that alone would be enough to seal the deal on the pointlessness of DRM, but unfortunately there are a lot of gullible execs out there that want to keep pouring money on the fire.
  - gjsman-1000 3y ago
    As long as it stops even 100,000 people from not downloading videos off of Netflix, from an executive’s perspective, it pays for itself. To them, it’s like saying Speed Limit signs are useless, because cars can go faster than the number posted by literally pressing a button. That’s not the point.
    - gorkish 3y ago
      If you take the capitalistic lust of the corporate executive to its logical extreme, given the massive costs of the DRM tech you'd think that at least one of them would realize that they could make more money if they didn't have to pay for something that doesn't work. The economics of distributing the copies are such that it doesn't actually matter if it's easy or hard for 1 or 100,000 people to break the protection.
      - gjsman-1000 3y ago
        I can get DRM, right now, for my videos, with 500,000 plays for $1665. That’s publicly available, commercial pricing. That’s a third of a cent per play. At Netflix scale, it’s probably cheaper. DRM is a drop in the bucket compared to normal costs. A Netflix subscription is, what, $10? That’s enough to pay for 3,300 encrypted plays. The same provider, if I was doing over 10,000,000 plays, will drop it to just under one tenth of a cent per play, enough for over 10,000 encrypted plays. Compare that with how much the internet bandwidth, storage, and distribution costs - and the DRM is a rounding error. You’re seriously telling me that not even one out of 10,000 plays is going to attempt a serious theft, to share it with random friends and family? Hah, it’s probably closer to 5 in 100. Believe me - I’m not a guy who defines himself by living in a Hacker News bubble where everything needs to be perfect to be effective. I’d have DRM yesterday if I ran a streaming service, just like my copyright filings and the deadbolt on my front door.
        temac 3y ago
        Sharing with friend and family is not "serious theft". It is benevolent and what people do with books and DVD, without industry people becoming insane about.
        gjsman-1000 3y ago
        I meant sending copies; where the next thing you know one purchased copy becomes thirty people holding copies.
      - 3y ago
panzi 3y ago
> so everything is immediately available in at least 1080p. Aren't the lower tiers only 720p? At least all the streaming services give Linux users only 720p. (There is a workaround for one particular service to still get 1080p - I'm paying for it so I better can watch it in 1080p! The moment this stops working I cancel my subscription.)
- SSLy 3y ago
  L3 can do FHD on Linux but it's the services config that prevents that.
  - brnt 3y ago
    Why do they do that?
    - daveoc64 3y ago
      The lower levels of Widevine protection are weaker, so the content providers like Netflix only allow playback in standard definition or 720p at those levels. They don't want the highest quality to be available on devices where the DRM can easily be broken.
      - SSLy 3y ago
        >They don't want the highest quality to be available on devices where the DRM can easily be broken. they don't want to admit you can get L3 keymaterial from androids super easily. They just are obnoxious assholes.
- jsheard 3y ago
  There's three Winevine tiers, L1, L2 and L3, which generally correspond to 4K, 1080p and 720p respectively though it depends on the service. L3 is what you get on Linux. L2 is supposed to be more secure than L3 but AFAICT it makes little difference to piracy groups, L1 is the only actual roadblock for them.
h4x0rr 3y ago
Couldn't scene groups just keep the exploits for decrypting streams for themselves? Is there any way for Netflix/Widevine/PlayReady to detect this?
- jsheard 3y ago
  I don't know the technical details but Winevine claims to have a system for watermarking content, which may allow them to trace the origin of ripped content back to the set of keys which decrypted it so they can be revoked. https://www.digimarc.com/resources/widevine-announces-digital-watermarking-technology-further-track-distribution-content https://www.digimarc.com/resources/widevine-announces-digita...
- lossolo 3y ago
  There are no exploits for Widevine. The system operates by requiring a key, which is obtained from the unsecure hardware enclaves of some of the thousands of devices whitelisted by Widevine. When you access and share publicly 4K content, the keys for that specific device are blacklisted, necessitating the purchase of a new device to extract a new key.
devrand 3y ago
It does seem like Netflix has been doing a decent cat-and-mouse game with Widevine for anything over 540p the last few months. There's been several shows that took several days to get properly copied (i.e. not just screen recorded).
486sx33 3y ago
“4K Bluray playback on PCs is effectively being phased out.” Which will only perpetuate and speed up the problem. 4K blu ray discs suck on a lot of new tvs and players for frame rate and detail so the best visual experience is going to be on high dpi PCs (or Mac? Retina?) If I can’t play a 4K blu ray I purchased on my pc… I’m going to probably download a ripped version and not feel guilty about it since I purchased the disc … My M2 Pro can decode and play 4K without breaking a sweat and with amazing battery life on VLC player
grishka 3y ago
> the entire signal path to use strong encryption But the display panel itself still receives an unencrypted LVDS signal, which should not be too hard to decode. There are (were?) also cheap HDMI splitters that conveniently strip HDCP. Your only issue is that yes, you can't get at the original compressed video stream and have to reencode, possibly losing a tiny bit of quality.
- jsheard 3y ago
  That is true, but ripping content in that way is a much bigger burden on piracy groups since it has to be done in realtime, can't be done in parallel without multiple expensive hardware rigs, and metadata like subtitles can't be extracted automatically. Rips of streaming shows often have a dozen or so subtitle tracks and nobody is going to transcribe and re-time all that by hand if they can't decrypt the stream directly.
  - grishka 3y ago
    Are subtitle tracks also encrypted? I've always had the impression that only video itself is. edit: But the subtitle tracks are also available on software-only DRM levels that are easy to break.
    - jsheard 3y ago
      Actually now I think of it that doesn't matter since you could just pull the subtitles from the weakly protected 720p version then apply them to the higher resolution versions. Ripping the 4K video through LVDS or HDMI capture would still be annoying though.
      - grishka 3y ago
        Yep I realized that and edited my parent comment but you beat me to it.
        jsheard 3y ago
m4tu4g 3y ago
To add more to this, not essentially 4K is the only thing behind L1, even HD streams can be with L1. It's entirely the services' choice to use what they want, like they can even put SD stream behind L1 and leave 4K for L3 (this happens widely in lesser known services & L2 is hardly used). Also Amazon's 4K is different from Netflix's 4K considering the key revocation TAT. So everything changes from service to service.
int_19h 3y ago
Not immediately; sometimes when they revoke the keys it can take a few months for the likes of StreamFab and AnyStream to catch up even with 1080p. E.g. StreamFab is currently stuck on 480p for Netflix, and it has been like that since January.

ricktdotorg 3y ago

^^^ great comment. hard to imagine a better synposis of 4k DRM in ~2 grafs. thanks!

gorkish 3y ago
Not mentioned above, but should be noted that all of this DRM is still only protecting the compressed and encoded video content. Schemes to protect the uncompressed digital video data are all permanently and universally broken or bypassed. The 'analog hole' has gone fully digital. One would think that alone would be enough to seal the deal on the pointlessness of DRM, but unfortunately there are a lot of gullible execs out there that want to keep pouring money on the fire.
- gjsman-1000 3y ago
  As long as it stops even 100,000 people from not downloading videos off of Netflix, from an executive’s perspective, it pays for itself. To them, it’s like saying Speed Limit signs are useless, because cars can go faster than the number posted by literally pressing a button. That’s not the point.
  - gorkish 3y ago
    If you take the capitalistic lust of the corporate executive to its logical extreme, given the massive costs of the DRM tech you'd think that at least one of them would realize that they could make more money if they didn't have to pay for something that doesn't work. The economics of distributing the copies are such that it doesn't actually matter if it's easy or hard for 1 or 100,000 people to break the protection.
    - gjsman-1000 3y ago
      I can get DRM, right now, for my videos, with 500,000 plays for $1665. That’s publicly available, commercial pricing. That’s a third of a cent per play. At Netflix scale, it’s probably cheaper. DRM is a drop in the bucket compared to normal costs. A Netflix subscription is, what, $10? That’s enough to pay for 3,300 encrypted plays. The same provider, if I was doing over 10,000,000 plays, will drop it to just under one tenth of a cent per play, enough for over 10,000 encrypted plays. Compare that with how much the internet bandwidth, storage, and distribution costs - and the DRM is a rounding error. You’re seriously telling me that not even one out of 10,000 plays is going to attempt a serious theft, to share it with random friends and family? Hah, it’s probably closer to 5 in 100. Believe me - I’m not a guy who defines himself by living in a Hacker News bubble where everything needs to be perfect to be effective. I’d have DRM yesterday if I ran a streaming service, just like my copyright filings and the deadbolt on my front door.
      - temac 3y ago
        Sharing with friend and family is not "serious theft". It is benevolent and what people do with books and DVD, without industry people becoming insane about.
        gjsman-1000 3y ago
        I meant sending copies; where the next thing you know one purchased copy becomes thirty people holding copies.
    - 3y ago

panzi 3y ago

> so everything is immediately available in at least 1080p. Aren't the lower tiers only 720p? At least all the streaming services give Linux users only 720p. (There is a workaround for one particular service to still get 1080p - I'm paying for it so I better can watch it in 1080p! The moment this stops working I cancel my subscription.)

SSLy 3y ago
L3 can do FHD on Linux but it's the services config that prevents that.
- brnt 3y ago
  Why do they do that?
  - daveoc64 3y ago
    The lower levels of Widevine protection are weaker, so the content providers like Netflix only allow playback in standard definition or 720p at those levels. They don't want the highest quality to be available on devices where the DRM can easily be broken.
    - SSLy 3y ago
      >They don't want the highest quality to be available on devices where the DRM can easily be broken. they don't want to admit you can get L3 keymaterial from androids super easily. They just are obnoxious assholes.
jsheard 3y ago
There's three Winevine tiers, L1, L2 and L3, which generally correspond to 4K, 1080p and 720p respectively though it depends on the service. L3 is what you get on Linux. L2 is supposed to be more secure than L3 but AFAICT it makes little difference to piracy groups, L1 is the only actual roadblock for them.

h4x0rr 3y ago

Couldn't scene groups just keep the exploits for decrypting streams for themselves? Is there any way for Netflix/Widevine/PlayReady to detect this?

jsheard 3y ago
I don't know the technical details but Winevine claims to have a system for watermarking content, which may allow them to trace the origin of ripped content back to the set of keys which decrypted it so they can be revoked. https://www.digimarc.com/resources/widevine-announces-digital-watermarking-technology-further-track-distribution-content https://www.digimarc.com/resources/widevine-announces-digita...
lossolo 3y ago
There are no exploits for Widevine. The system operates by requiring a key, which is obtained from the unsecure hardware enclaves of some of the thousands of devices whitelisted by Widevine. When you access and share publicly 4K content, the keys for that specific device are blacklisted, necessitating the purchase of a new device to extract a new key.

devrand 3y ago

It does seem like Netflix has been doing a decent cat-and-mouse game with Widevine for anything over 540p the last few months. There's been several shows that took several days to get properly copied (i.e. not just screen recorded).

486sx33 3y ago

“4K Bluray playback on PCs is effectively being phased out.” Which will only perpetuate and speed up the problem. 4K blu ray discs suck on a lot of new tvs and players for frame rate and detail so the best visual experience is going to be on high dpi PCs (or Mac? Retina?) If I can’t play a 4K blu ray I purchased on my pc… I’m going to probably download a ripped version and not feel guilty about it since I purchased the disc … My M2 Pro can decode and play 4K without breaking a sweat and with amazing battery life on VLC player

grishka 3y ago

> the entire signal path to use strong encryption But the display panel itself still receives an unencrypted LVDS signal, which should not be too hard to decode. There are (were?) also cheap HDMI splitters that conveniently strip HDCP. Your only issue is that yes, you can't get at the original compressed video stream and have to reencode, possibly losing a tiny bit of quality.

jsheard 3y ago
That is true, but ripping content in that way is a much bigger burden on piracy groups since it has to be done in realtime, can't be done in parallel without multiple expensive hardware rigs, and metadata like subtitles can't be extracted automatically. Rips of streaming shows often have a dozen or so subtitle tracks and nobody is going to transcribe and re-time all that by hand if they can't decrypt the stream directly.
- grishka 3y ago
  Are subtitle tracks also encrypted? I've always had the impression that only video itself is. edit: But the subtitle tracks are also available on software-only DRM levels that are easy to break.
  - jsheard 3y ago
    Actually now I think of it that doesn't matter since you could just pull the subtitles from the weakly protected 720p version then apply them to the higher resolution versions. Ripping the 4K video through LVDS or HDMI capture would still be annoying though.
    - grishka 3y ago
      Yep I realized that and edited my parent comment but you beat me to it.
      - jsheard 3y ago

m4tu4g 3y ago

To add more to this, not essentially 4K is the only thing behind L1, even HD streams can be with L1. It's entirely the services' choice to use what they want, like they can even put SD stream behind L1 and leave 4K for L3 (this happens widely in lesser known services & L2 is hardly used). Also Amazon's 4K is different from Netflix's 4K considering the key revocation TAT. So everything changes from service to service.

int_19h 3y ago

Not immediately; sometimes when they revoke the keys it can take a few months for the likes of StreamFab and AnyStream to catch up even with 1080p. E.g. StreamFab is currently stuck on 480p for Netflix, and it has been like that since January.