Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft PlayReady – Complete Client Identity Compromise

seclists.org

Post reply on HN
Print view View original

21–30 of 175 posts

Re: Microsoft PlayReady – Complete Client Identity Compromise

#21

Post by jsheard »

panzi wrote: post #19
jsheard wrote: post #11

Earlier quoted context omitted.

4K streaming content is hit or miss because most services lock that behind Widevine L1, which requires implementors to use a secure enclave and the entire signal path to use strong encryption. If an L1 implementation gets compromised it quickly has its keys revoked and is downgraded to L2/L3, so piracy groups have a limited time window to dump as much 4K content as possible. Those lower Winevines tiers are permanentl…

> so everything is immediately available in at least 1080p. Aren't the lower tiers only 720p? At least all the streaming services give Linux users only 720p. (There is a workaround for one particular service to still get 1080p - I'm paying for it so I better can watch it in 1080p! The moment this stops working I cancel my subscription.)

There's three Winevine tiers, L1, L2 and L3, which generally correspond to 4K, 1080p and 720p respectively though it depends on the service. L3 is what you get on Linux. L2 is supposed to be more secure than L3 but AFAICT it makes little difference to piracy groups, L1 is the only actual roadblock for them.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#22

Post by andsoitis »

gwbas1c wrote: post #13
londons_explore wrote: post #6

Is there any video DRM scheme which successfully protects video content appearing on the pirate bay within 24 hours? I really don't see why so many millions (billions?) of dollars have been spent on technologies which so far have never kept the bad guys out.

> have never kept the bad guys out Careful who you call the bad guys. A lot of "piracy" comes from the people who spend the most money on the content they pirate. I personally think the best DRM approaches are those that keep "the honest people honest:" IE, metadata that identifies copyright owners, flags that identify content that has restrictions due to copyright, and casual protections. (Think of a "do not enter"…

> A lot of "piracy" comes from the people who spend the most money on the content they pirate.

That doesn’t strike me as a valid statistic. Where are you getting that data from?

Re: Microsoft PlayReady – Complete Client Identity Compromise

#23

Post by Salgat »

tawa9102930 wrote: post #14
londons_explore wrote: post #6

Is there any video DRM scheme which successfully protects video content appearing on the pirate bay within 24 hours? I really don't see why so many millions (billions?) of dollars have been spent on technologies which so far have never kept the bad guys out.

HDCP is broken so none of it really matters. The resulting files ("webrips") aren't a lossless copy of the original, but are good enough for most.

Yeah web-dls might be hit or miss but webrips are such good quality that it's irrelevant for most folks anyways, since it's nearly the same quality you'd see on your TV.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#24

Post by nonrandomstring »

xurukefi wrote: post #8
earth-adventure wrote: post #2

So this is pretty much about breaking the client side DRM, with a bad side effect of abusing someone else's Identity (as used within the DRM context) for nefarious purposes. Did I understand this correctly?

The "client" whose "identity" is abused here is not an end user. A "client" in this context is a program or library that talks to the license servers and receives the content decryption keys. On my Windows machine I see a "Windows.Media.Protection.PlayReady.dll", which I guess is the client that they cracked. Maybe there are also other clients that are widely accepted by license servers. The attack essentially means…

> The "client" whose "identity" is abused here is not an end user. A "client" in this context is a program or library that talks to the license servers and receives

Thanks for the clarification.

Otherwise people would be worried about being targeted and having "personal" keys tied to a financial account or online identity getting sold and used by others to access arbitary content.

This seems kinda good news for concerned users, but even worse news for Microsoft.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#25

Post by bombcar »

londons_explore wrote: post #6

Is there any video DRM scheme which successfully protects video content appearing on the pirate bay within 24 hours? I really don't see why so many millions (billions?) of dollars have been spent on technologies which so far have never kept the bad guys out.

The point of the DRM schemes is basically to keep video "hard enough to copy that normies don't do it". And not even "normies can't find it on the Pirate Bay" but "you can right click and download from Netflix."

If they mostly succeed at that, they consider it good enough.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#27

Post by gorkish »

ricktdotorg wrote: post #16
jsheard wrote: post #11

Earlier quoted context omitted.

4K streaming content is hit or miss because most services lock that behind Widevine L1, which requires implementors to use a secure enclave and the entire signal path to use strong encryption. If an L1 implementation gets compromised it quickly has its keys revoked and is downgraded to L2/L3, so piracy groups have a limited time window to dump as much 4K content as possible. Those lower Winevines tiers are permanentl…

^^^ great comment. hard to imagine a better synposis of 4k DRM in ~2 grafs. thanks!

Not mentioned above, but should be noted that all of this DRM is still only protecting the compressed and encoded video content. Schemes to protect the uncompressed digital video data are all permanently and universally broken or bypassed. The 'analog hole' has gone fully digital. One would think that alone would be enough to seal the deal on the pointlessness of DRM, but unfortunately there are a lot of gullible execs out there that want to keep pouring money on the fire.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#30

Post by ParetoOptimal »

londons_explore wrote: post #6

Is there any video DRM scheme which successfully protects video content appearing on the pirate bay within 24 hours? I really don't see why so many millions (billions?) of dollars have been spent on technologies which so far have never kept the bad guys out.

> I really don't see why so many millions (billions?) of dollars have been spent on technologies which so far have never kept the bad guys out.

A PR campaign to make people think getting that content for free is harder than it is?

Post reply on HN