Comment by vachina
10 hours ago
They’d need dedicated hardware to enforce any kind of effective DRM. Encrypted bitstream generated on the fly watchable only on L2 attested device.
10 hours ago
They’d need dedicated hardware to enforce any kind of effective DRM. Encrypted bitstream generated on the fly watchable only on L2 attested device.
>They’d need dedicated hardware to enforce any kind of effective DRM.
That's already here. Even random aliexpress tablets support widevine L1 (ie. highest security level)
maybe to stop the .01%. switching to app only, sign in only would get them pretty much all the way there.
They own the os, with sign-in, integrity checks, and the inability to install anything on it Google doesn't want you to install they could make it pretty much impossible to view the videos on a device capable of capturing them for the vast majority of people. Combine that with a generation raised in sandboxes and their content would be safe.
"their" content? This is Youtube.
Of course, the same can be said for FB, Tiktok, instagram, Pintrest, reddit, ... and I'm sure the list keeps going. Frankly, Youtube is pretty damn good about this, really.
No where else to go that pays. They can pay which entices those to stay.
Google owns that monopoly.
Netflix is already there for 4k streams
And it's an entirely useless effort. No idea how it is done but the internet is full 4k rips.
They find devices that are easy to hack (and I mean rip and tear) and extract the decryption keys from each of them, from what I have heard cheap chinese tvs and set top boxes, they extract the keys from the chips (hardware hacking, heard some even use microscopes to read the keys by hand), and then use them to decrypt streams, I heard that they catch them pretty fast to they use like 1 device per season. This is why they use mostly stollen devices.
10 replies →
Breaking HDCP is a lot easier than breaking the other things. You don't have to attack the torment nexus directly. This is not the most ideal option but it is information theoretically correct assuming your capture rig is set up properly.
1 reply →
I knew of this chrome bug which could allow netflix to be ripped. I had heard it in comments of some section of youtube and I might need to look further into it but its definitely possible.
It's not as easy as downloading a YouTube video though
Can you explain in simple terms what would prevent one from running the decryption programmatically posing as the end client?
Yes, it's called: Web Environment Integrity + hardware attestation of some kind
> "the technical means through which WEI will accomplish its ends is relatively simple. Before serving a web page, a server can ask a third-party "verification" service to make sure that the user's browsing environment has not been "tampered" with. A translation of the policy's terminology will help us here: this Google-owned server will be asked to make sure that the browser does not deviate in any way from Google's accepted browser configuration" [1]
https://www.fsf.org/blogs/community/web-environment-integrit...
Let's say the only devices you can get that will run YouTube are running i/pad/visionOS or Android and that those will only run on controlled hardware and that the hardware will only run signed code. Now let's say the only way to get the YouTube client is though the controlled app stores on those platforms. You can build a chain of trust tied to something like a TPM in the device at one end and signing keys held by Apple or Google at the other that makes it very difficult to get access to the client implementation and the key material and run something like the client in an environment that would allow it to provide convincing evidence that it is a trusted client. As long as you have the hardware and software in your hands, it's probably not impossible, but it can be made just a few steps shy.
Here are a couple ideas:
The decryption code could verify that it's only providing decrypted content to an attested-legitimate monitor, using DRM over HDMI (HDCP).
You might try to modify the decryption code to disable the part where it reencrypts the data for the monitor, but it might be heavily obfuscated.
Maybe the decryption key is only provided to a TPM that can attest its legitimacy. Then you would need a hardware vulnerability to crack it.
Maybe the server could provide a datastream that's fed directly to the monitor and decrypted there, without any decryption happening on the computer. Then of course the reverse engineering would target the monitor instead of the code on the computer. The monitor would be a less easily accessible reverse engineering target, and it itself could employ obfuscation and a TPM.
Attestation requiring a hardware TPM 2.0 (or higher), and not being able to extract the private key from the TPM on your system.
TPM is Mathematically Secure and you can't extract what's put in. See, Fritz-Chip.
You don't get access to the decryption code nor the keys - both are hardwired in silicon.
We'll eventually be able to reverse-engineer that and run it programmatically, but it will take a long time.
And when they catch you doing so, they'll ban your (personalized) encryption key so you'll just have to buy another graphics card to get another key.
This is how it already works, not some future thing. But the licensing fees make it so it only gets used for Hollywood-level movies.
iOS can already attest to websites that they are running in unmodified Safari. https://developer.apple.com/news/?id=huqjyh7k
I guess that isn't quite enough to prevent screen recording but these devices also support DRM which does this.
I guess at that point we could do it the old fashioned way by pointing a camera at the screen. Or, I guess, a more professional approach based on external recording.
Wonder if you could train a neural net to take camera recordings and basically reconstitute the original. For a given setup, the distortions should be pretty consistent.
I might be recalling it wrong,but I remember reading that there was some old hardware that refused to record protected TV/Movies probably a VCR or a DVR.
Camera manufacturers can easily refuse to record a stream of they detect it is protected, may be via watermarks or other sidechannel.
Old VCRs looked for a hidden signal that rental videos put out so you couldn't record them. But it was easy to block with a cheap device that you put in the middle.
Which is why Windows 11 requires TPM.
TPM isn't the only misfeature that makes Windows 11 an abomination. People who don't switch to a respectful platform is in for a lot of pain.
DRM protection schemes usually don't rely on TPM, the real magic happens inside your GPU and the monitor.
They can use all available tools at the same time.
1 reply →