Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Trying to extract Widewine key: A journey to failure

github.com

Post reply on HN
Print view View original

101–110 of 133 posts

Re: Trying to extract Widewine key: A journey to failure

#101

Post by meowface »

toxik wrote: post #28
magila wrote: post #20

Earlier quoted context omitted.

If you know where to look L1 content can be readily downloaded, including the original 4K streams. As usual the net effect of DRM is to make the paid service inferior to piracy. That's not what I would call "wining".

I don’t understand how it can ever be secure unless you let some DRM representatives basically come and do inspections. Fundamentally, you are going to show a video and play an audio stream. Fundamentally, it can be recaptured perfectly because it must be displayed and played perfectly. There is simply no way around it. DRM can only make life hard for the regular Joes.

This fundamental gap is known as "the analog hole": https://en.wikipedia.org/wiki/Analog_hole

Re: Trying to extract Widewine key: A journey to failure

#102

Post by Uehreka »

azalemeth wrote: post #11

From the repo: >It is my honest opinion that DRM is a malignant tumor growing upon various forms of media, and that people that either implement or enforce implementation are morally repugnant and do no good to society. With that in mind, I was sad to learn in May 2021 that the original extension would soon be rendered obsolete. I really can't agree more. I don't use, and never have, services that require DRM. I buy…

It’s not pointless if it works!

Seriously though, those of us who don’t like DRM need to switch messaging from “It’s bad AND it’s pointless/useless!” to “It’s bad!” The “it’s pointless” part has clearly been interpreted as a challenge, and now we’ve got incredibly invasive junk creeping in at all levels of hardware and software, and it’s not actually inconveniencing everyday consumers that much (hackers and powerusers are a different story), and it’s working better all the time.

I’m not sure exactly how to make this argument these days, but smugly saying “DRM will always be pointless in the end!” isn’t actually true, and I feel like we need to focus on the fact that the measures being taken to make it not pointless are impinging on both user privacy and the ability of open ecosystems (like Linux distros and more open hardware) to be useful for everyday media playback.

Re: Trying to extract Widewine key: A journey to failure

#103

Post by akiselev »

meowface wrote: post #100
azalemeth wrote: post #11

From the repo: >It is my honest opinion that DRM is a malignant tumor growing upon various forms of media, and that people that either implement or enforce implementation are morally repugnant and do no good to society. With that in mind, I was sad to learn in May 2021 that the original extension would soon be rendered obsolete. I really can't agree more. I don't use, and never have, services that require DRM. I buy…

How do you feel about "effective DRM"? For example, an online RPG where you pay a monthly subscription to play with others in the same world. You could play single-player, or reverse engineer it and try to create a private server and modified client to play with others who choose to use the same modified client, but unless the implementation is unusually poor, the "DRM" is pretty much unavoidable if you want to play…

That’s not really DRM, that’s actively providing a service. Some studios try to tie in single player experiences with online components as a form of DRM but those are invariably quickly cracked and are often a source of embarrassing launch day failures so they’re not that common.

Re: Trying to extract Widewine key: A journey to failure

#104

Post by jimmydorry »

rodgerd wrote: post #86
nyuszika7h wrote: post #22

Earlier quoted context omitted.

I don't know why you're being downvoted, you're right. There are plenty of TrustZone exploits that allow extraction of L1 keys.

Pay NZ$20/mo for Netflix in UHD, or fuck around on pirate sites to make sure none of the people making the series and films I'm enjoying, while hoping that no-one has dropped an entertaining payload in the site ads or the files I'm downloading is "piracy is more convenient"? The downvotes are for a shit take disconnected from the reality of people who aren't determined not to pay for something.

Step 1. Pay NZ$20/mo for Netflix in UHD.

Step 2. The content you want is not there or available on any other legal platform for your country.

Step 3. ????

Re: Trying to extract Widewine key: A journey to failure

#105

Post by meowface »

akiselev wrote: post #103
meowface wrote: post #100

Earlier quoted context omitted.

How do you feel about "effective DRM"? For example, an online RPG where you pay a monthly subscription to play with others in the same world. You could play single-player, or reverse engineer it and try to create a private server and modified client to play with others who choose to use the same modified client, but unless the implementation is unusually poor, the "DRM" is pretty much unavoidable if you want to play…

That’s not really DRM, that’s actively providing a service. Some studios try to tie in single player experiences with online components as a form of DRM but those are invariably quickly cracked and are often a source of embarrassing launch day failures so they’re not that common.

Right, hence the scarequotes around the term. I'm just wondering if the parent poster also considers that model exploitative or freedom-restricting.

Re: Trying to extract Widewine key: A journey to failure

#106

Post by bawolff »

Wowfunhappy wrote: post #97
bawolff wrote: post #74

Earlier quoted context omitted.

Depending on the solution,it might involve watermarking so that they can trace where the streams that end up on the internet come from and cut off those users. If nothing else, im sure it shows up in the analytics if someone's netflix account is 24/7 streaming every episode of every show without break. Although the real answer is probably: studios require it in their contracts and netflix has to play nice.

> If nothing else, im sure it shows up in the analytics if someone's netflix account is 24/7 streaming every episode of every show without break. That would happen with or without DRM.

But DRM would in principle require you to watch it all in real time, which would probably help with profiling the abnormal behaviour.

Re: Trying to extract Widewine key: A journey to failure

#107

Post by bawolff »

Godel_unicode wrote: post #87
bawolff wrote: post #29

From the repo > In the end, I only extracted about half of the RSA key. Not a cryptographer, but i thought half the rsa key was all you needed with coopersmith's attack.

Although I too am no cryptographer, I believe there is an additional constraint where the public exponent needs to be small. Also the paper I read says these conditions can lead to discovery of the key in "polynomial time" which doesn't necessarily mean fast.

I'm again talking out of my depth, so take this with salt, but my understanding is the small public exponent is for the sterotyped message version of that attack not the partial key recovery variant.

Looking at this page https://www.cryptologie.net/article/222/implementation-of-co... it looks like the exponent isn't even an input to the algorithm when doing key recovery

Re: Trying to extract Widewine key: A journey to failure

#108

Post by Wowfunhappy »

lmm wrote: post #99
Wowfunhappy wrote: post #95

Earlier quoted context omitted.

Are those actual decrypted copies of the original stream, though? Or did they just re-record the output? For the latter you'd only need to break HDCP, right?

If the end user can't tell then it doesn't matter.

Well but there's likely to be at least a small quality difference, and a considerable a quality per file size difference, because the video would need to be re-encoded.

Re: Trying to extract Widewine key: A journey to failure

#109

Post by Godel_unicode »

Arainach wrote: post #90
Godel_unicode wrote: post #81

Earlier quoted context omitted.

Except that's not true. There is tons of copywritten work sold online without DRM. It's just a matter of getting the business model right. https://www.amazon.com/gp/feature.html?ie=UTF8&docId=1000265... > every song from Amazon MP3 is DRM-free and encoded in high-quality 256-kbps MP3 format. This means that they will play on any MP3 player, so you don't need to worry about file format compatibility or licenses that e…

The production costs in music are orders of magnitude lower than those for video. It takes far fewer people far fewer days to record a song than a TV show or a movie. The equipment involved in recording, mixing, and special effects are all dramatically cheaper, which also makes the entire process more accessible and enables scales that do not exist for most media. A business model for one thing does not generalize.

The cost of the input is irrelevant.

Sell things for money generalized pretty well in basically every other field. It actually generalized pretty well in video too. This is just adding "remove the DRM". It'll be fine once all the old studio execs retire...

Re: Trying to extract Widewine key: A journey to failure

#110

Post by matheusmoreira »

Godel_unicode wrote: post #81
matheusmoreira wrote: post #72

Earlier quoted context omitted.

Maybe patronage schemes? Crowdfunding? I have no idea. I just know that we can't go on like this. The only way to enforce copyright in the 21st century is to destroy computing freedom. I'd rather sacrifice the entire copyright industry than have computers that only run software they approve.

Except that's not true. There is tons of copywritten work sold online without DRM. It's just a matter of getting the business model right. https://www.amazon.com/gp/feature.html?ie=UTF8&docId=1000265... > every song from Amazon MP3 is DRM-free and encoded in high-quality 256-kbps MP3 format. This means that they will play on any MP3 player, so you don't need to worry about file format compatibility or licenses that e…

Very few stores choose not to enforce copyright. Those that do have smaller selections of works for sale because copyright holders refuse to sell their stuff there. The result is still a service that's inferior to copyright infringement.
Post reply on HN