4 ms·
They’d need dedicated hardware to enforce any kind of effective DRM. Encrypted bitstream generated on the fly watchable only on L2 attested device.
by vachina 1y ago
They’d need dedicated hardware to enforce any kind of effective DRM. Encrypted bitstream generated on the fly watchable only on L2 attested device.
- fsflover 1y agoWhich is why Windows 11 requires TPM.
- lloeki 1y agoNetflix is already there for 4k streams
- KeplerBoy 1y agoAnd it's an entirely useless effort. No idea how it is done but the internet is full 4k rips.
- alex7o 1y agoThey find devices that are easy to hack (and I mean rip and tear) and extract the decryption keys from each of them, from what I have heard cheap chinese tvs and set top boxes, they extract the keys from the chips (hardware hacking, heard some even use microscopes to read the keys by hand), and then use them to decrypt streams, I heard that they catch them pretty fast to they use like 1 device per season. This is why they use mostly stollen devices.
- 13hunteo 1y agoInteresting - do you have any sources to read further?
- 47282847 1y agoSearch for widevine decrypt. You’ll find code and forums where at least some L3 (software) keys are publicly shared. For high resolution on some platforms, you need L1 keys, but as far as I understand the decryption process basically stays the same once you have a working key. Random article: https://www.ismailzai.com/blog/picking-the-widevine-locks https://www.ismailzai.com/blog/picking-the-widevine-locks Claimed to be L1 key leaks (probably all blacklisted by now): https://github.com/Mavrick102/WIDEVINE-CDM-L1-Giveaway https://github.com/Mavrick102/WIDEVINE-CDM-L1-Giveaway
- sodality2 1y agoYou won't find a ton of up-to-date info that would let you do the same - the scene groups hold their methods closely specifically because of this cat-and-mouse game.
- oblio 1y agoI guess at that point we could do it the old fashioned way by pointing a camera at the screen. Or, I guess, a more professional approach based on external recording.
- devsda 1y agoI might be recalling it wrong,but I remember reading that there was some old hardware that refused to record protected TV/Movies probably a VCR or a DVR. Camera manufacturers can easily refuse to record a stream of they detect it is protected, may be via watermarks or other sidechannel.
- jedberg 1y agoOld VCRs looked for a hidden signal that rental videos put out so you couldn't record them. But it was easy to block with a cheap device that you put in the middle.
- tshaddox 1y agoHDCP is how modern digital displays (and digital display recorders) do it. You might be thinking of Macrovision, which was integrated in a lot of DVD players and would embed pulses into the vertical blanking interval of the analogy video output. These pulses could be detected by compliant DVD recorders and used to refuse recording. The pulses would also cause playback defects in some older VCRs and TVs. I remember connecting my first DVD player to an old TV via a VCR (effectively using the VCR as an RF modulator) and being plagued with the image brightness constantly lowering and rising. At the time, I fixed this by switching to a dedicated RF modulator. I now suspect Macrovision is what caused this. https://en.wikipedia.org/wiki/Analog_Protection_System https://en.wikipedia.org/wiki/Analog_Protection_System
- oblio 11mo ago> HDCP is how modern digital displays (and digital display recorders) do it. But that's inside the system. I'm talking about recording the physical output, i.e. the screen itself. With a controlled environment, known screen characteristics, I would hope that an external recorder + post-processing can create high quality images or video.
- yard2010 1y agoCan you explain in simple terms what would prevent one from running the decryption programmatically posing as the end client?
- Thorrez 1y agoHere are a couple ideas: The decryption code could verify that it's only providing decrypted content to an attested-legitimate monitor, using DRM over HDMI (HDCP). You might try to modify the decryption code to disable the part where it reencrypts the data for the monitor, but it might be heavily obfuscated. Maybe the decryption key is only provided to a TPM that can attest its legitimacy. Then you would need a hardware vulnerability to crack it. Maybe the server could provide a datastream that's fed directly to the monitor and decrypted there, without any decryption happening on the computer. Then of course the reverse engineering would target the monitor instead of the code on the computer. The monitor would be a less easily accessible reverse engineering target, and it itself could employ obfuscation and a TPM.
- deleted 1y ago[deleted]
- robmccoll 1y agoLet's say the only devices you can get that will run YouTube are running i/pad/visionOS or Android and that those will only run on controlled hardware and that the hardware will only run signed code. Now let's say the only way to get the YouTube client is though the controlled app stores on those platforms. You can build a chain of trust tied to something like a TPM in the device at one end and signing keys held by Apple or Google at the other that makes it very difficult to get access to the client implementation and the key material and run something like the client in an environment that would allow it to provide convincing evidence that it is a trusted client. As long as you have the hardware and software in your hands, it's probably not impossible, but it can be made just a few steps shy.
- bayindirh 1y agoAttestation requiring a hardware TPM 2.0 (or higher), and not being able to extract the private key from the TPM on your system. TPM is Mathematically Secure and you can't extract what's put in. See, Fritz-Chip.
- ticulatedspline 1y agomaybe to stop the .01%. switching to app only, sign in only would get them pretty much all the way there. They own the os, with sign-in, integrity checks, and the inability to install anything on it Google doesn't want you to install they could make it pretty much impossible to view the videos on a device capable of capturing them for the vast majority of people. Combine that with a generation raised in sandboxes and their content would be safe.
- spwa4 1y ago"their" content? This is Youtube. Of course, the same can be said for FB, Tiktok, instagram, Pintrest, reddit, ... and I'm sure the list keeps going. Frankly, Youtube is pretty damn good about this, really.
- doublerabbit 1y agoNo where else to go that pays. They can pay which entices those to stay. Google owns that monopoly.
- spwa4 11mo agoWell, there used to be a lot of economic theory about how stupid it is to have marketplaces (like Youtube fundamentally is) be owned by anyone but the government. Entire books. Yet no-one seems to remember.
- gruez 1y ago>They’d need dedicated hardware to enforce any kind of effective DRM. That's already here. Even random aliexpress tablets support widevine L1 (ie. highest security level)
- bpye 1y agoHow often are their keys extracted?
- kevincox 1y agoiOS can already attest to websites that they are running in unmodified Safari. https://developer.apple.com/news/?id=huqjyh7k https://developer.apple.com/news/?id=huqjyh7k I guess that isn't quite enough to prevent screen recording but these devices also support DRM which does this.