Trying to extract Widewine key: A journey to failure • Hacker News Board

Re: Trying to extract Widewine key: A journey to failure

#11

Post by azalemeth » Sun, Aug 01, 2021, 4:32 PM UTC

From the repo:

>It is my honest opinion that DRM is a malignant tumor growing upon various forms of media, and that people that either implement or enforce implementation are morally repugnant and do no good to society. With that in mind, I was sad to learn in May 2021 that the original extension would soon be rendered obsolete.

I really can't agree more. I don't use, and never have, services that require DRM. I buy my games from gog.com and itch.io and the like, get media from free-to-air television and state broadcasters, and buy music either from the artist or from good and reputable music labels like hyperion.co.uk. I buy books in a dead-tree form, or as DRM-free PDFs. I will simply not buy, use, or support DRM and I occasionally tell firms that I am not giving them business because of their inane corporate decisions.

This might seem like a hard rant, but all of these binary blobs can be broken with varying degree of difficulty -- as this person's work shows -- because DRM is fundamentally pointless. It's such a waste of human endeavor! Think how many CPU cycles are burnt doing this! Estimate what the total cost of HDCP + Widevine + DRM etc is on the planet! It is pointless, insulting, and frustrating!

.

Re: Trying to extract Widewine key: A journey to failure

#12

Post by classified » Sun, Aug 01, 2021, 4:49 PM UTC

zinekeller wrote: post #10

classified wrote: post #8

Earlier quoted context omitted.

The bad font on GitHub makes "FaIlUrE" look like "FallUrE". I thought it must have been a typo.

Bad Windows font, probably. It's just using the default system fonts, which in case of Segoe UI doesn't employ caps for I. Ironically, Segoe (just Segoe, the reference font) do have caps on I.

I stand corrected (I didn't look up the CSS, can't do that in Safari on iPad). That leaves room for improvement in my browser's default font then.

Re: Trying to extract Widewine key: A journey to failure

#13

Post by 10000truths » Sun, Aug 01, 2021, 4:56 PM UTC

azalemeth wrote: post #11

From the repo: >It is my honest opinion that DRM is a malignant tumor growing upon various forms of media, and that people that either implement or enforce implementation are morally repugnant and do no good to society. With that in mind, I was sad to learn in May 2021 that the original extension would soon be rendered obsolete. I really can't agree more. I don't use, and never have, services that require DRM. I buy…

> This might seem like a hard rant, but all of these binary blobs can be broken with varying degree of difficulty -- as this person's work shows -- because DRM is fundamentally pointless.

I think that this ease of circumventing DRM is actually an indirect, but major, reason why movie theaters will never really go away. Online streaming new movie releases is great for direct-to-consumer business, but it comes with the risk of losing control of your distribution due to ease of piracy. Why would a frugal person pay $30 for "premier access" to a new movie on Disney+ when they can just go to Pirate Bay and torrent a perfect-quality rip for free? It's much easier to keep AMC Theatres in line than a global network of average Joes.

Re: Trying to extract Widewine key: A journey to failure

#14

Post by step21 » Sun, Aug 01, 2021, 4:57 PM UTC

baybal2 wrote: post #5

marcodiego wrote: post #2

Hmmm... Would love if this allows me watch netflix using a fully FLOSSed arm sbc.

The point of semi-unusable DRMed crap when L1 released keep getting WEB-DLed? Very likely it's not the Shield now which leaks L1, but an actual key recovery because they get the stream even before it gets watermarked in the secure domain. My guess, it's Qualcomm's debugging TZ applets. They cannot really revoke keys because they will take down a giant amount of Snapdragon based handsets for which manufacturers don't…

What's L1? web-dls I have seen are always relatively low resolution, so at least it protects fullhd or 4k.

Re: Trying to extract Widewine key: A journey to failure

#15

Post by baybal2 » Sun, Aug 01, 2021, 4:59 PM UTC

step21 wrote: post #14

baybal2 wrote: post #5

Earlier quoted context omitted.

The point of semi-unusable DRMed crap when L1 released keep getting WEB-DLed? Very likely it's not the Shield now which leaks L1, but an actual key recovery because they get the stream even before it gets watermarked in the secure domain. My guess, it's Qualcomm's debugging TZ applets. They cannot really revoke keys because they will take down a giant amount of Snapdragon based handsets for which manufacturers don't…

What's L1? web-dls I have seen are always relatively low resolution, so at least it protects fullhd or 4k.

Widevine L1 - the hardware DRM in ARM trustzone with individual keys for each chip.

Re: Trying to extract Widewine key: A journey to failure

#16

Post by wincy » Sun, Aug 01, 2021, 5:05 PM UTC

10000truths wrote: post #13

azalemeth wrote: post #11

From the repo: >It is my honest opinion that DRM is a malignant tumor growing upon various forms of media, and that people that either implement or enforce implementation are morally repugnant and do no good to society. With that in mind, I was sad to learn in May 2021 that the original extension would soon be rendered obsolete. I really can't agree more. I don't use, and never have, services that require DRM. I buy…

> This might seem like a hard rant, but all of these binary blobs can be broken with varying degree of difficulty -- as this person's work shows -- because DRM is fundamentally pointless . I think that this ease of circumventing DRM is actually an indirect, but major, reason why movie theaters will never really go away. Online streaming new movie releases is great for direct-to-consumer business, but it comes with th…

I used to go to the movie theatres all the time and spend $30+ to see a movie in the Dolby Digital Experience and the like, but it’s easier for me to pirate than it is for me to sign up for whatever streaming service and watch a movie there. They’re always available immediately after release in the highest quality.

Re: Trying to extract Widewine key: A journey to failure

#17

Post by zinekeller » Sun, Aug 01, 2021, 5:37 PM UTC

classified wrote: post #12

zinekeller wrote: post #10

Earlier quoted context omitted.

Bad Windows font, probably. It's just using the default system fonts, which in case of Segoe UI doesn't employ caps for I. Ironically, Segoe (just Segoe, the reference font) do have caps on I.

I stand corrected (I didn't look up the CSS, can't do that in Safari on iPad). That leaves room for improvement in my browser's default font then.

Note that system fonts usually can't be overridden in browsers, you need to inject custom CSS with the override.

Re: Trying to extract Widewine key: A journey to failure

#18

Post by ramshanker » Sun, Aug 01, 2021, 5:38 PM UTC

So in the end, Widevine complexity won. For now. I have always thought that obfuscation is easier to undo. It is the underlying MATH which is difficult. The best anti-cheat are Math heavy than the instruction trickery. Though both are present simultaneously.

Re: Trying to extract Widewine key: A journey to failure

#19

Post by siliconc0w » Sun, Aug 01, 2021, 5:41 PM UTC

azalemeth wrote: post #11

From the repo: >It is my honest opinion that DRM is a malignant tumor growing upon various forms of media, and that people that either implement or enforce implementation are morally repugnant and do no good to society. With that in mind, I was sad to learn in May 2021 that the original extension would soon be rendered obsolete. I really can't agree more. I don't use, and never have, services that require DRM. I buy…

"because DRM is fundamentally pointless"

I dunno, it gave this person a lot of trouble and the result is maybe a very narrow victory that doesn't practically matter? And this is the lowest level of widevine security - L3 which is basically assumed to be owned. Good luck with L1 which uses trusted compute primitives. DRM has won.

And I'm saying this as someone who agrees DRM is a threat to society as we're taking things that the world could otherwise have for free and denying it them so we can instead charge a small % for it. So we're intelligent enough to build this kind of technical sophistication but we are unable/unwilling to figure out a different model for financing it.

Re: Trying to extract Widewine key: A journey to failure

#20

Post by magila » Sun, Aug 01, 2021, 5:53 PM UTC

siliconc0w wrote: post #19

azalemeth wrote: post #11

From the repo: >It is my honest opinion that DRM is a malignant tumor growing upon various forms of media, and that people that either implement or enforce implementation are morally repugnant and do no good to society. With that in mind, I was sad to learn in May 2021 that the original extension would soon be rendered obsolete. I really can't agree more. I don't use, and never have, services that require DRM. I buy…

"because DRM is fundamentally pointless" I dunno, it gave this person a lot of trouble and the result is maybe a very narrow victory that doesn't practically matter? And this is the lowest level of widevine security - L3 which is basically assumed to be owned. Good luck with L1 which uses trusted compute primitives. DRM has won. And I'm saying this as someone who agrees DRM is a threat to society as we're taking thin…

If you know where to look L1 content can be readily downloaded, including the original 4K streams. As usual the net effect of DRM is to make the paid service inferior to piracy. That's not what I would call "wining".