Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft PlayReady – Complete Client Identity Compromise

seclists.org

Post reply on HN
Print view View original

11–20 of 175 posts

Re: Microsoft PlayReady – Complete Client Identity Compromise

#11

Post by jsheard »

londons_explore wrote: post #6

Is there any video DRM scheme which successfully protects video content appearing on the pirate bay within 24 hours? I really don't see why so many millions (billions?) of dollars have been spent on technologies which so far have never kept the bad guys out.

4K streaming content is hit or miss because most services lock that behind Widevine L1, which requires implementors to use a secure enclave and the entire signal path to use strong encryption. If an L1 implementation gets compromised it quickly has its keys revoked and is downgraded to L2/L3, so piracy groups have a limited time window to dump as much 4K content as possible. Those lower Winevines tiers are permanently broken though so everything is immediately available in at least 1080p.

4K Blurays are currently always ripped due to an unfixable compromise in Intel SGX allowing PowerDVDs keys to be extracted, they could close that hole by revoking PowerDVDs keys for new Bluray releases but they haven't done that yet. I imagine they will at some point because PowerDVD requires SGX to play UHDs, and Intel stopped supporting that on newer consumer hardware, so 4K Bluray playback on PCs is effectively being phased out.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#12

Post by miki123211 »

londons_explore wrote: post #6

Is there any video DRM scheme which successfully protects video content appearing on the pirate bay within 24 hours? I really don't see why so many millions (billions?) of dollars have been spent on technologies which so far have never kept the bad guys out.

The point is pressure on equipment manufacturers, making borrowing and streaming work for digital content, maybe also deterring casual piracy, not necessarily protecting videos from appearing on tpb.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#13

Post by gwbas1c »

londons_explore wrote: post #6

Is there any video DRM scheme which successfully protects video content appearing on the pirate bay within 24 hours? I really don't see why so many millions (billions?) of dollars have been spent on technologies which so far have never kept the bad guys out.

> have never kept the bad guys out

Careful who you call the bad guys. A lot of "piracy" comes from the people who spend the most money on the content they pirate.

I personally think the best DRM approaches are those that keep "the honest people honest:" IE, metadata that identifies copyright owners, flags that identify content that has restrictions due to copyright, and casual protections. (Think of a "do not enter" sign that you can choose to ignore if you have reason to do so.)

Otherwise, DRM really only works when the people consuming the content have motivation to keep it secret. (IE, corporate and military secrets.)

Re: Microsoft PlayReady – Complete Client Identity Compromise

#14

Post by tawa9102930 »

londons_explore wrote: post #6

Is there any video DRM scheme which successfully protects video content appearing on the pirate bay within 24 hours? I really don't see why so many millions (billions?) of dollars have been spent on technologies which so far have never kept the bad guys out.

HDCP is broken so none of it really matters.

The resulting files ("webrips") aren't a lossless copy of the original, but are good enough for most.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#16

Post by ricktdotorg »

jsheard wrote: post #11
londons_explore wrote: post #6

Is there any video DRM scheme which successfully protects video content appearing on the pirate bay within 24 hours? I really don't see why so many millions (billions?) of dollars have been spent on technologies which so far have never kept the bad guys out.

4K streaming content is hit or miss because most services lock that behind Widevine L1, which requires implementors to use a secure enclave and the entire signal path to use strong encryption. If an L1 implementation gets compromised it quickly has its keys revoked and is downgraded to L2/L3, so piracy groups have a limited time window to dump as much 4K content as possible. Those lower Winevines tiers are permanentl…

^^^ great comment. hard to imagine a better synposis of 4k DRM in ~2 grafs. thanks!

Re: Microsoft PlayReady – Complete Client Identity Compromise

#17

Post by nonrandomstring »

Jerrrry wrote: post #5

Given how horribly all major companies, MS most certainly included, confuse authentication vs. authorization, this is almost certainly able to be paired with a 'vulnerable' (all) endpoint to retrieve/post/update player information. The horizontal pivot from DRM/crypto-managed Identity to a session token, an unassumingly-kosher redirect, or just omitting the "AUTHENTICATION" header itself is a trivial exercise for the…

And it paints an even bigger target on domestic Windows machines used for media content.

Who wants to "steal" their _own_ keys?

Microsoft's broken DRM scheme creates objects of value which it then tries to store on the client's machine deliberately beyond the owners control and security management. It is adversarial to the user. This is clearly a no-win situation... hence the snarky sign-off about vendors "raising the bar", basically saying; Good luck with that! It really seems quite unhinged.

So now there is collateral damage:

  - A motive to hack Windows machines to steal content keys.

  - A misuse of "identities" through a market in stolen keys

  - Pivots (as parent says) to other malware vectors
So, predictably, because of DRM, Microsoft Windows is now an even more dangerous and insecure system. Why do people persist chasing this unnecessary, pathologically involuted technological misadventure? Surely "controlling and monitoring peoples content" is not a hill worth dying on?

Re: Microsoft PlayReady – Complete Client Identity Compromise

#18

Post by repelsteeltje »

gwbas1c wrote: post #13
londons_explore wrote: post #6

Is there any video DRM scheme which successfully protects video content appearing on the pirate bay within 24 hours? I really don't see why so many millions (billions?) of dollars have been spent on technologies which so far have never kept the bad guys out.

> have never kept the bad guys out Careful who you call the bad guys. A lot of "piracy" comes from the people who spend the most money on the content they pirate. I personally think the best DRM approaches are those that keep "the honest people honest:" IE, metadata that identifies copyright owners, flags that identify content that has restrictions due to copyright, and casual protections. (Think of a "do not enter"…

Funny thing is that most streaming platforms only have DRM because content owners pressure them. It's expensive and a huge hassle to get right.

While indeed DRM barely contributes in fighting redistribution over Pirate Bay, it does prevent stream sharing. Ie.: the platform saves a lot of CDN bandwidth by forcing that onto torrents.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#19

Post by panzi »

jsheard wrote: post #11
londons_explore wrote: post #6

Is there any video DRM scheme which successfully protects video content appearing on the pirate bay within 24 hours? I really don't see why so many millions (billions?) of dollars have been spent on technologies which so far have never kept the bad guys out.

4K streaming content is hit or miss because most services lock that behind Widevine L1, which requires implementors to use a secure enclave and the entire signal path to use strong encryption. If an L1 implementation gets compromised it quickly has its keys revoked and is downgraded to L2/L3, so piracy groups have a limited time window to dump as much 4K content as possible. Those lower Winevines tiers are permanentl…

> so everything is immediately available in at least 1080p.

Aren't the lower tiers only 720p? At least all the streaming services give Linux users only 720p. (There is a workaround for one particular service to still get 1080p - I'm paying for it so I better can watch it in 1080p! The moment this stops working I cancel my subscription.)

Re: Microsoft PlayReady – Complete Client Identity Compromise

#20

Post by SSLy »

panzi wrote: post #19
jsheard wrote: post #11

Earlier quoted context omitted.

4K streaming content is hit or miss because most services lock that behind Widevine L1, which requires implementors to use a secure enclave and the entire signal path to use strong encryption. If an L1 implementation gets compromised it quickly has its keys revoked and is downgraded to L2/L3, so piracy groups have a limited time window to dump as much 4K content as possible. Those lower Winevines tiers are permanentl…

> so everything is immediately available in at least 1080p. Aren't the lower tiers only 720p? At least all the streaming services give Linux users only 720p. (There is a workaround for one particular service to still get 1080p - I'm paying for it so I better can watch it in 1080p! The moment this stops working I cancel my subscription.)

L3 can do FHD on Linux but it's the services config that prevents that.
Post reply on HN