8 ms·

Privacy implications of browsers’ (mis)implementations of Widevine EME (2023)

119 points by exceptione 1y ago

exceptione 1y ago
(I had to editorialize to get the title within the limits)
JCattheATM 1y ago
I flat out have DRM disabled in my browser. If I really really need it, then that's what VMs and VPNs are for.
- neilv 1y ago
  Same here. For one interim pragmatic purpose, I do have a dedicated setup that has DRM, which I use only for that purpose. I hope to get rid of the nasty DRM altogether in the future. (For the browser part of the DRM setup, I use Chrome/Chromium, the violate-me-all-the-ways browser. For all other browser purposes, I use both Firefox, the violate-me-fewer-ways browser, and Tor Browser, the draw-fire-of-state-actors-but-thwart-techbro-actors browser.)
  - account42 1y ago
    What's preventing you from getting rid of it now?
- kiney 1y ago
  I'm curious what are those use-cases where you really need it? I have DRM disabled since forever and never experience any problems that I can relate to that.
  - Aerroon 1y ago
    Which really makes you wonder why so many people fought hard to get it into the browser.
    - deleted 1y ago
      [deleted]
    - phantomathkg 1y ago
      So they can monetize the consumption of video/audio.
  - bevr1337 1y ago
    Streaming television
    - account42 1y ago
      Which should never have been a website in the first place.
    - M95D 1y ago
      tvheadend would work, if browsers would support mpeg2.
  - msgodel 1y ago
    I think spotify doesn't work without it but I switched back to keeping all my music local long ago.
    - kiney 1y ago
      ok, never used that...
  - Groxx 1y ago
    Music and TV/movie streaming, and that's about it afaict. I've got it disabled too, and I essentially never see issues unless I go to Netflix.
    - Tijdreiziger 1y ago
      News videos don’t always work without it either.
      - gruez 1y ago
        Maybe I don't visit enough news sites, but I never saw a news website have DRM on their videos.
        Groxx 1y ago
        I think I've seen it on news sites like once? And thanked my settings for stopping something that was surely going to annoy me. But broadly yeah, same
      - account42 1y ago
        That's more of a bonus and not an issue.
      - JCattheATM 1y ago
        Ohh yeah, that's the only time I've had a problem, but the video has never been that important and if it is it's on Youtube.
- account42 1y ago
  > that's what VMs and VPNs are for To get the content from a different source in a more user-friendly format, right?
shmerl 1y ago
Not surprising at all.
- mattl 1y ago
  Yeah this feels very much the point of DRM in browsers. I will never understand why Firefox caved. This is 100% the kind of thing they should fight.
  - wizardforhire 1y ago
    In this day and age I dont understand why there isnt a more successful fork of firefox or a new opensource browser thats more succesful with privacy as a concern. My only speculation is collective lazyness and lack of sex appeal as new technologies have emerged. I’m probably biased as I lived through the browser wars. I guess I’m probably projecting combined with curiosity. I know most of the old greybeards have moved on and those of us left are stuck carrying the torch, but man it sure seems the culture has been eroded significantly. Case in point back in my day it seemed like there was a new browser every few months or so. I’m done ranting, I’ve got kids to yell at to get off my lawn.
    - mattl 1y ago
      WebKit seems to be doing at least some of that, rejecting some of the more invasive new web APIs. Why does my browser ever need to know my battery status?
    - charcircuit 1y ago
      I don't understand why anyone would bother forking Firefox when forking Chromium is available which is more advanced and more modular. >or a new opensource browser Brave browser fulfills that role. https://brave.com/compare/firefox-vs-brave/ https://brave.com/compare/firefox-vs-brave/
      - throwaway60397 1y ago
        > I don't understand why anyone would bother forking Firefox when forking Chromium is available which is more advanced and more modular. No uBlock is a deal breaker. Chromium is stuck with the neutered uBlock Lite thanks to Manifest V3. > Brave browser fulfills that role Sure, and it's also funded by VC money. How long until the vultures start swooping in to get a return on their investiment?
jwrallie 1y ago
Interestingly, DRM is also being used by Signal for privacy concerns over Windows Recall, as discussed on HN [0] previously. [0] https://news.ycombinator.com/item?id=44053364 https://news.ycombinator.com/item?id=44053364
- sodality2 1y ago
  "Used" is a strong term, they're not really utilizing the DRM codepaths, AFAIK it simply tells the OS that the window is software that does use DRM and thus should be excluded from any screenshots. The existence of DRM and desire of Windows to abide by its rules are what Signal relies on.
- AnthonyMouse 1y ago
  That's more of a double-edged sword hack than "using DRM". The theory of DRM is for the system to restrict the content from the user, i.e. the system is adversarial to the user and vice versa. What Signal is doing is trying to get the system to restrict the content from the rest of the system. Which might work as a transient hack but doesn't actually work to protect the user when the system is adversarial, because Microsoft (the adversary) has the DRM private keys. Even some hypothetical DRM system which is effective in oppressing the user wouldn't prevent Microsoft from purloining the user's data whenever they want because they're the ones who make the DRM.
  - bitpush 1y ago
    Microsoft cant and will not break that trust, because then Netflix and others will stop serving content to Microsoft products. This is similar to HTTPS certificate chain of trust. The root signing authority needs to be trusted, but once you break that trust there's no going back. It is a self-regulating system.
    - AnthonyMouse 1y ago
      Why does Netflix care if Microsoft is hoovering up all the user's data? Why would they even care if Microsoft was giving itself access to the Netflix streams? Unlike with Signal there are no real secrets in there. Plus, what is Netflix even going to do? Stop supporting streaming on Microsoft platforms and then lose a bunch of subscribers for no benefit to themselves?
baybal2 1y ago
[dead]
tgsovlerkhgsel 1y ago
I've set DRM to require explicit approval in the browser, and I've seen random web sites that have no obvious reason to do so randomly request the permission. I don't know what exactly causes this, since it's intermittent (the same web site doesn't always do it) and happens even with various ad and tracking blockers in place.
- 486sx33 1y ago
  [dead]
- mjevans 1y ago
  I detest auto-play videos and in fact am usually happy when some random news site I'm reading an article on gets blocked by not having DRM.
  - tgsovlerkhgsel 1y ago
    That's the thing though - I don't think it blocked videos on the site, if there even were any.
    - __MatrixMan__ 1y ago
      That has been my experience too. Brave asks me if I want to install widevine, I say no, and then nothing appears broken.
      - tcoff91 1y ago
        Sounds like fingerprinting
- NooneAtAll3 1y ago
  I wish it was possible to auto-reject it instead of constant pop-ups
  - tgsovlerkhgsel 1y ago
1vuio0pswjnm7 1y ago
Popular web browsers way too complex, far too difficult to control. Simpler software could satisfy web users. Could reduce potential for surveillance and annoying distractions. Easier to audit and control.
- conception 1y ago
  We should have stopped with gopher. I’m not even sure I’m joking.
  - SunlitCat 1y ago
    Although being too young to be really have seen gopher, i can still remember the (comparatively) simple "Internet" from mid to late 90s. IRC for chatting, ICQ for instant messaging (which didn't work because my ISP at that time used a strange firewall / proxy setup and IRQ wasn't able to get through), newsgroups as a kind of discussion board, picture viewers for all kind of image formats (like wise video players), real player (Buffering...:D) for streaming....and most importantly web browser(s) when you want to grab information from all around the world (but dang having only a 33.6kbit modem, was really a test of patience sometimes). Oh! I forgot! WinAmp which can whip the llama's...yeah you surely know what it does whip! ;)
- kbrosnan 1y ago
  No, simpler software is not accepted by the general public. For a few years Firefox rejected EME/Widevine. When Netflix does not work then they will just use a browser that works.
- 1vuio0pswjnm7 1y ago
  NB. I am a member of the "general public". I use simpler software. For example, I do not use a so-called "modern" web browser with DRM supoort in order to read, submit and reply on HN. Nor do I use a more complex program to download video files. I may use a more complex program to edit, convert and play video files, such as ffmpeg/ffplay, although unlike a so-called "modern" web browser ffmpeg is not controlled and "automatically updated" by an surveillance advertising company or financially depedant on one, sending it data about users in return for money.

119 points by exceptione 1y ago

exceptione 1y ago

(I had to editorialize to get the title within the limits)

JCattheATM 1y ago

I flat out have DRM disabled in my browser. If I really really need it, then that's what VMs and VPNs are for.

neilv 1y ago
Same here. For one interim pragmatic purpose, I do have a dedicated setup that has DRM, which I use only for that purpose. I hope to get rid of the nasty DRM altogether in the future. (For the browser part of the DRM setup, I use Chrome/Chromium, the violate-me-all-the-ways browser. For all other browser purposes, I use both Firefox, the violate-me-fewer-ways browser, and Tor Browser, the draw-fire-of-state-actors-but-thwart-techbro-actors browser.)
- account42 1y ago
  What's preventing you from getting rid of it now?
kiney 1y ago
I'm curious what are those use-cases where you really need it? I have DRM disabled since forever and never experience any problems that I can relate to that.
- Aerroon 1y ago
  Which really makes you wonder why so many people fought hard to get it into the browser.
  - deleted 1y ago
    [deleted]
  - phantomathkg 1y ago
    So they can monetize the consumption of video/audio.
- bevr1337 1y ago
  Streaming television
  - account42 1y ago
    Which should never have been a website in the first place.
  - M95D 1y ago
    tvheadend would work, if browsers would support mpeg2.
- msgodel 1y ago
  I think spotify doesn't work without it but I switched back to keeping all my music local long ago.
  - kiney 1y ago
    ok, never used that...
- Groxx 1y ago
  Music and TV/movie streaming, and that's about it afaict. I've got it disabled too, and I essentially never see issues unless I go to Netflix.
  - Tijdreiziger 1y ago
    News videos don’t always work without it either.
    - gruez 1y ago
      Maybe I don't visit enough news sites, but I never saw a news website have DRM on their videos.
      - Groxx 1y ago
        I think I've seen it on news sites like once? And thanked my settings for stopping something that was surely going to annoy me. But broadly yeah, same
    - account42 1y ago
      That's more of a bonus and not an issue.
    - JCattheATM 1y ago
      Ohh yeah, that's the only time I've had a problem, but the video has never been that important and if it is it's on Youtube.
account42 1y ago
> that's what VMs and VPNs are for To get the content from a different source in a more user-friendly format, right?

shmerl 1y ago

Not surprising at all.

mattl 1y ago
Yeah this feels very much the point of DRM in browsers. I will never understand why Firefox caved. This is 100% the kind of thing they should fight.
- wizardforhire 1y ago
  In this day and age I dont understand why there isnt a more successful fork of firefox or a new opensource browser thats more succesful with privacy as a concern. My only speculation is collective lazyness and lack of sex appeal as new technologies have emerged. I’m probably biased as I lived through the browser wars. I guess I’m probably projecting combined with curiosity. I know most of the old greybeards have moved on and those of us left are stuck carrying the torch, but man it sure seems the culture has been eroded significantly. Case in point back in my day it seemed like there was a new browser every few months or so. I’m done ranting, I’ve got kids to yell at to get off my lawn.
  - mattl 1y ago
    WebKit seems to be doing at least some of that, rejecting some of the more invasive new web APIs. Why does my browser ever need to know my battery status?
  - charcircuit 1y ago
    I don't understand why anyone would bother forking Firefox when forking Chromium is available which is more advanced and more modular. >or a new opensource browser Brave browser fulfills that role. https://brave.com/compare/firefox-vs-brave/ https://brave.com/compare/firefox-vs-brave/
    - throwaway60397 1y ago
      > I don't understand why anyone would bother forking Firefox when forking Chromium is available which is more advanced and more modular. No uBlock is a deal breaker. Chromium is stuck with the neutered uBlock Lite thanks to Manifest V3. > Brave browser fulfills that role Sure, and it's also funded by VC money. How long until the vultures start swooping in to get a return on their investiment?

jwrallie 1y ago

Interestingly, DRM is also being used by Signal for privacy concerns over Windows Recall, as discussed on HN [0] previously. [0] https://news.ycombinator.com/item?id=44053364 https://news.ycombinator.com/item?id=44053364

sodality2 1y ago
"Used" is a strong term, they're not really utilizing the DRM codepaths, AFAIK it simply tells the OS that the window is software that does use DRM and thus should be excluded from any screenshots. The existence of DRM and desire of Windows to abide by its rules are what Signal relies on.
AnthonyMouse 1y ago
That's more of a double-edged sword hack than "using DRM". The theory of DRM is for the system to restrict the content from the user, i.e. the system is adversarial to the user and vice versa. What Signal is doing is trying to get the system to restrict the content from the rest of the system. Which might work as a transient hack but doesn't actually work to protect the user when the system is adversarial, because Microsoft (the adversary) has the DRM private keys. Even some hypothetical DRM system which is effective in oppressing the user wouldn't prevent Microsoft from purloining the user's data whenever they want because they're the ones who make the DRM.
- bitpush 1y ago
  Microsoft cant and will not break that trust, because then Netflix and others will stop serving content to Microsoft products. This is similar to HTTPS certificate chain of trust. The root signing authority needs to be trusted, but once you break that trust there's no going back. It is a self-regulating system.
  - AnthonyMouse 1y ago
    Why does Netflix care if Microsoft is hoovering up all the user's data? Why would they even care if Microsoft was giving itself access to the Netflix streams? Unlike with Signal there are no real secrets in there. Plus, what is Netflix even going to do? Stop supporting streaming on Microsoft platforms and then lose a bunch of subscribers for no benefit to themselves?

baybal2 1y ago

[dead]

tgsovlerkhgsel 1y ago

I've set DRM to require explicit approval in the browser, and I've seen random web sites that have no obvious reason to do so randomly request the permission. I don't know what exactly causes this, since it's intermittent (the same web site doesn't always do it) and happens even with various ad and tracking blockers in place.

486sx33 1y ago
[dead]
mjevans 1y ago
I detest auto-play videos and in fact am usually happy when some random news site I'm reading an article on gets blocked by not having DRM.
- tgsovlerkhgsel 1y ago
  That's the thing though - I don't think it blocked videos on the site, if there even were any.
  - __MatrixMan__ 1y ago
    That has been my experience too. Brave asks me if I want to install widevine, I say no, and then nothing appears broken.
    - tcoff91 1y ago
      Sounds like fingerprinting
NooneAtAll3 1y ago
I wish it was possible to auto-reject it instead of constant pop-ups
- tgsovlerkhgsel 1y ago

1vuio0pswjnm7 1y ago

Popular web browsers way too complex, far too difficult to control. Simpler software could satisfy web users. Could reduce potential for surveillance and annoying distractions. Easier to audit and control.

conception 1y ago
We should have stopped with gopher. I’m not even sure I’m joking.
- SunlitCat 1y ago
  Although being too young to be really have seen gopher, i can still remember the (comparatively) simple "Internet" from mid to late 90s. IRC for chatting, ICQ for instant messaging (which didn't work because my ISP at that time used a strange firewall / proxy setup and IRQ wasn't able to get through), newsgroups as a kind of discussion board, picture viewers for all kind of image formats (like wise video players), real player (Buffering...:D) for streaming....and most importantly web browser(s) when you want to grab information from all around the world (but dang having only a 33.6kbit modem, was really a test of patience sometimes). Oh! I forgot! WinAmp which can whip the llama's...yeah you surely know what it does whip! ;)
kbrosnan 1y ago
No, simpler software is not accepted by the general public. For a few years Firefox rejected EME/Widevine. When Netflix does not work then they will just use a browser that works.
1vuio0pswjnm7 1y ago
NB. I am a member of the "general public". I use simpler software. For example, I do not use a so-called "modern" web browser with DRM supoort in order to read, submit and reply on HN. Nor do I use a more complex program to download video files. I may use a more complex program to edit, convert and play video files, such as ffmpeg/ffplay, although unlike a so-called "modern" web browser ffmpeg is not controlled and "automatically updated" by an surveillance advertising company or financially depedant on one, sending it data about users in return for money.