Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Trying to extract Widewine key: A journey to failure

github.com

Post reply on HN
Print view View original

61–70 of 133 posts

Re: Trying to extract Widewine key: A journey to failure

#61

Post by drudu »

step21 wrote: post #14
baybal2 wrote: post #5

Earlier quoted context omitted.

The point of semi-unusable DRMed crap when L1 released keep getting WEB-DLed? Very likely it's not the Shield now which leaks L1, but an actual key recovery because they get the stream even before it gets watermarked in the secure domain. My guess, it's Qualcomm's debugging TZ applets. They cannot really revoke keys because they will take down a giant amount of Snapdragon based handsets for which manufacturers don't…

What's L1? web-dls I have seen are always relatively low resolution, so at least it protects fullhd or 4k.

I cannot find a single popular movie that's available to stream which isn't also available as a 4k WEB-DL on a popular, well known, private tracker.

Re: Trying to extract Widewine key: A journey to failure

#62

Post by baybal2 »

wmf wrote: post #48
grishka wrote: post #45

Earlier quoted context omitted.

Are these keys unique per-device?

Yes.

The content key at most Netflix like website is one for the entire library, only per-device key needed to get that key, and watermark ID is unique.

Re: Trying to extract Widewine key: A journey to failure

#63

Post by baybal2 »

azalemeth wrote: post #57
throwaway525142 wrote: post #53

Earlier quoted context omitted.

> you could as well rip multiple copies on behalf of multiple accounts and average out the pixel colors. Can you show that this can reliable get rid of the fingerprinting? This particular method could be countered by only including the fingerprint info in a few random frames, then you'd be able to retrieve the account info of all the accounts that participated in ripping. I don't think finding a method to counter any…

It's my understanding that most schemes actually use very low frequency encoding with a large amount of error robustness built in (probably involving Haar wavelets) in order to maximize the probability that it survives re-encoding. Still, these schemes are not faultless: if you have two devices, and are knowledgeable enough to break the DRM twice for the same content, you're probably smart enough to take the md5 and…

If they can get the content key out of TZ, they don't even need the per-device key, and TZ based decoder anymore.

They just straight decrypt any files, which were at some point laying in the open on CDNs.

I believe, sooner or later it will come to the point when the only way left for DRMed content to work will be to have each stream individually encrypted, and watermarked at the backend at an enormous computational expense.

Re: Trying to extract Widewine key: A journey to failure

#64

Post by SilverRed »

elcritch wrote: post #46
magila wrote: post #20

Earlier quoted context omitted.

If you know where to look L1 content can be readily downloaded, including the original 4K streams. As usual the net effect of DRM is to make the paid service inferior to piracy. That's not what I would call "wining".

In theory DRM could be mathematically perfect. However DRM relies on actual implementations both in software and hardware and shares a lot with broader security. Software implementations can have bugs but it’s relatively easy to ship fixes. The hardware level however is where it becomes very difficult to ensure a valid implementation of “secure compute” or “trusted zones” which are key to DRM and general security, pa…

How can DRM ever be perfect? It relies on your computer to be able to decrypt the data so it an never be "mathematically perfect" like regular encryption can be.

Current DRM is all about shoving the decryption part as deep in to a chip as possible and betting on the fact that it is physically too hard to extract that info. So it will always be exploitable with some amount of effort.

Re: Trying to extract Widewine key: A journey to failure

#65

Post by SilverRed »

realusername wrote: post #34
R0b0t1 wrote: post #27

Earlier quoted context omitted.

For now, at least. It is possible they fix all issues.

Except that people who exploit L1 just never reveal how they do it, good luck with that. That's the beauty of the asymmetry against DRM, only a single decoded file (which will always happen) is enough for seeding to everybody.

This seems to be confirmed by the fact that most torrent sites have 4K copies of brand new streaming only content while no publicly known exploits exist.

Since you are running the exploit locally without affecting other peoples machines, I imagine it would be close to impossible to work out what exploit they are using.

Re: Trying to extract Widewine key: A journey to failure

#66

Post by SilverRed »

conradev wrote: post #51
wmf wrote: post #47

Earlier quoted context omitted.

The last bastion of DRM is forensic watermarking (so they can trace the leaked video back to your device) and key revocation (so your device won't play any new content). These techniques are so complex that they aren't used much.

Isn't it also incompatible with the distribution model? Because personalizing video for every customer is hard to scale for companies that rely on reducing cloud costs

It's mostly done for review copies of content where only a handful of reviewers have the content.

Re: Trying to extract Widewine key: A journey to failure

#68

Post by codetrotter »

toxik wrote: post #28
magila wrote: post #20

Earlier quoted context omitted.

If you know where to look L1 content can be readily downloaded, including the original 4K streams. As usual the net effect of DRM is to make the paid service inferior to piracy. That's not what I would call "wining".

I don’t understand how it can ever be secure unless you let some DRM representatives basically come and do inspections. Fundamentally, you are going to show a video and play an audio stream. Fundamentally, it can be recaptured perfectly because it must be displayed and played perfectly. There is simply no way around it. DRM can only make life hard for the regular Joes.

> I don’t understand how it can ever be secure unless you let some DRM representatives basically come and do inspections.

Oh god, that’s a level of hell I haven’t even imagined. I wonder if the future could ever become as dystopian as that for real. What it would take for that to happen, and how.

Re: Trying to extract Widewine key: A journey to failure

#69

Post by matheusmoreira »

azalemeth wrote: post #11

From the repo: >It is my honest opinion that DRM is a malignant tumor growing upon various forms of media, and that people that either implement or enforce implementation are morally repugnant and do no good to society. With that in mind, I was sad to learn in May 2021 that the original extension would soon be rendered obsolete. I really can't agree more. I don't use, and never have, services that require DRM. I buy…

DRM is merely a symptom of the copyright disease. People actually want to believe data is scarce when it's not. When proven wrong, they make technology to force scarcity. It makes products and services worse for everyone and even then it barely works.

The only way to stop this is to abolish copyright.

Re: Trying to extract Widewine key: A journey to failure

#70

Post by Macha »

jeroenhd wrote: post #49
vladvasiliu wrote: post #43

Earlier quoted context omitted.

So then Netflix et al.'s requirement of Windows or macOS in order to play high definition video is purely artificial on x86? Last time I checked (a few months ago) they didn't even support Chrome (either Windows or Mac) for UHD, they required Safari, Edge or their own Windows app.

The UHD restriction is not a technical one. Content producers and the rest of the media industry has strict requirements about streaming. UHD content uses proprietary DRM systems from Microsoft and Apple that are considered more secure than WideVine, which is why those browsers are permitted to watch 4k. You can't watch UHD content on Edge for Linux, for example, because the necessary DRM isn't implemented.

Although, you used to be able to watch it in Windows Edge in Wine.
Post reply on HN