Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft PlayReady – Complete Client Identity Compromise

seclists.org

Post reply on HN
Print view View original

41–50 of 175 posts

Re: Microsoft PlayReady – Complete Client Identity Compromise

#41

Post by repelsteeltje »

andsoitis wrote: post #22
gwbas1c wrote: post #13

Earlier quoted context omitted.

> have never kept the bad guys out Careful who you call the bad guys. A lot of "piracy" comes from the people who spend the most money on the content they pirate. I personally think the best DRM approaches are those that keep "the honest people honest:" IE, metadata that identifies copyright owners, flags that identify content that has restrictions due to copyright, and casual protections. (Think of a "do not enter"…

> A lot of "piracy" comes from the people who spend the most money on the content they pirate. That doesn’t strike me as a valid statistic. Where are you getting that data from?

I think he alludes to "lore" more than statistic. In the CD/DVD age anti-piracy measure like region locks, DRM, but also annoying banners you could not skip would often make consuming the media with a regular CD or DVD player so cumbersome, that you were almost forced into ripping the media onto a hard disk first and consuming the media with VLC or similar.

The inability to just consume media using official device to on rented or purchased disks encouraged ripping, sharing and downloading.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#42

Post by jsheard »

h4x0rr wrote: post #39
jsheard wrote: post #11

Earlier quoted context omitted.

4K streaming content is hit or miss because most services lock that behind Widevine L1, which requires implementors to use a secure enclave and the entire signal path to use strong encryption. If an L1 implementation gets compromised it quickly has its keys revoked and is downgraded to L2/L3, so piracy groups have a limited time window to dump as much 4K content as possible. Those lower Winevines tiers are permanentl…

Couldn't scene groups just keep the exploits for decrypting streams for themselves? Is there any way for Netflix/Widevine/PlayReady to detect this?

I don't know the technical details but Winevine claims to have a system for watermarking content, which may allow them to trace the origin of ripped content back to the set of keys which decrypted it so they can be revoked.

https://www.digimarc.com/resources/widevine-announces-digita...

Re: Microsoft PlayReady – Complete Client Identity Compromise

#43

Post by gjsman-1000 »

gwbas1c wrote: post #13
londons_explore wrote: post #6

Is there any video DRM scheme which successfully protects video content appearing on the pirate bay within 24 hours? I really don't see why so many millions (billions?) of dollars have been spent on technologies which so far have never kept the bad guys out.

> have never kept the bad guys out Careful who you call the bad guys. A lot of "piracy" comes from the people who spend the most money on the content they pirate. I personally think the best DRM approaches are those that keep "the honest people honest:" IE, metadata that identifies copyright owners, flags that identify content that has restrictions due to copyright, and casual protections. (Think of a "do not enter"…

“Careful who you call the bad guys. A lot of "piracy" comes from the people who spend the most money on the content they pirate.”

This is laughably, obviously false. Don’t let the Reddit bubble of all 300 people who do this, or the 1.2% of Yuzu users who actually dumped their own keys, distort your understanding of reality.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#44

Post by eddd-ddde »

somenameforme wrote: post #37
londons_explore wrote: post #6

Is there any video DRM scheme which successfully protects video content appearing on the pirate bay within 24 hours? I really don't see why so many millions (billions?) of dollars have been spent on technologies which so far have never kept the bad guys out.

If you approach it at the most fundamental level, it seems like a clearly impossible goal to achieve. You are having users playing back content on their private devices, and then want to try to prevent them from copying that. That's basically impossible to achieve on somebody's own machine, and literally impossible to do once two enter into the picture. In the absolute worst case a high resolution/hertz cam on one's…

I imagine in the future DRM is directly embedded in the viewers brain and if it detects pirate content it just fries you.

I genuinely can't imagine any other form of DRM being successful.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#45

Post by jvanderbot »

londons_explore wrote: post #6

Is there any video DRM scheme which successfully protects video content appearing on the pirate bay within 24 hours? I really don't see why so many millions (billions?) of dollars have been spent on technologies which so far have never kept the bad guys out.

It doesn't need to work, it needs to be a clearly demarcated legal boundary. If it's hard enough that it takes effort to cross, you can prosecute.

Someone who wanders in the woods might not be blamed for trespassing. But someone who hops a fence with a sign on it doesn't have much defense.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#46

Post by gorkish »

gjsman-1000 wrote: post #31
gorkish wrote: post #27

Earlier quoted context omitted.

Not mentioned above, but should be noted that all of this DRM is still only protecting the compressed and encoded video content. Schemes to protect the uncompressed digital video data are all permanently and universally broken or bypassed. The 'analog hole' has gone fully digital. One would think that alone would be enough to seal the deal on the pointlessness of DRM, but unfortunately there are a lot of gullible exe…

As long as it stops even 100,000 people from not downloading videos off of Netflix, from an executive’s perspective, it pays for itself. To them, it’s like saying Speed Limit signs are useless, because cars can go faster than the number posted by literally pressing a button. That’s not the point.

If you take the capitalistic lust of the corporate executive to its logical extreme, given the massive costs of the DRM tech you'd think that at least one of them would realize that they could make more money if they didn't have to pay for something that doesn't work. The economics of distributing the copies are such that it doesn't actually matter if it's easy or hard for 1 or 100,000 people to break the protection.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#47

Post by xyzzy123 »

gjsman-1000 wrote: post #31
gorkish wrote: post #27

Earlier quoted context omitted.

Not mentioned above, but should be noted that all of this DRM is still only protecting the compressed and encoded video content. Schemes to protect the uncompressed digital video data are all permanently and universally broken or bypassed. The 'analog hole' has gone fully digital. One would think that alone would be enough to seal the deal on the pointlessness of DRM, but unfortunately there are a lot of gullible exe…

As long as it stops even 100,000 people from not downloading videos off of Netflix, from an executive’s perspective, it pays for itself. To them, it’s like saying Speed Limit signs are useless, because cars can go faster than the number posted by literally pressing a button. That’s not the point.

Yes if a particular group gets to externalise / socialise the costs of maintaining a protection then obviously from the perspective of the protected group then it's worth it.

The question is, is it good for society overall. Who or what is being protected and what impact does that have on everyone else?

Speed limit / stop signs represent a decent point of discussion I think.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#48

Post by gjsman-1000 »

gorkish wrote: post #46
gjsman-1000 wrote: post #31

Earlier quoted context omitted.

As long as it stops even 100,000 people from not downloading videos off of Netflix, from an executive’s perspective, it pays for itself. To them, it’s like saying Speed Limit signs are useless, because cars can go faster than the number posted by literally pressing a button. That’s not the point.

If you take the capitalistic lust of the corporate executive to its logical extreme, given the massive costs of the DRM tech you'd think that at least one of them would realize that they could make more money if they didn't have to pay for something that doesn't work. The economics of distributing the copies are such that it doesn't actually matter if it's easy or hard for 1 or 100,000 people to break the protection.

I can get DRM, right now, for my videos, with 500,000 plays for $1665. That’s publicly available, commercial pricing. That’s a third of a cent per play. At Netflix scale, it’s probably cheaper.

DRM is a drop in the bucket compared to normal costs. A Netflix subscription is, what, $10? That’s enough to pay for 3,300 encrypted plays. The same provider, if I was doing over 10,000,000 plays, will drop it to just under one tenth of a cent per play, enough for over 10,000 encrypted plays. Compare that with how much the internet bandwidth, storage, and distribution costs - and the DRM is a rounding error.

You’re seriously telling me that not even one out of 10,000 plays is going to attempt a serious theft, to share it with random friends and family? Hah, it’s probably closer to 5 in 100.

Believe me - I’m not a guy who defines himself by living in a Hacker News bubble where everything needs to be perfect to be effective. I’d have DRM yesterday if I ran a streaming service, just like my copyright filings and the deadbolt on my front door.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#49

Post by repelsteeltje »

zeta0134 wrote: post #3

> In that context, this is vendor’s responsibility to constantly increase the bar and with the use of all available technological means. Or the vendor could just let me consume the content I paid for in whatever player I like. Which is what happens anyway, as this sort of DRM is always breakable. If the media consumer can view the content at all, they can simply record that output and re-encode in a more convenient s…

Yes, there is always the analogue loophole. And opening cryptography toolbox to control how users consume content is a lost cause. Crypto can only protect contents from adversaries that don't have the key. But here the paying user is the adversary and the only way the DRM can paint the video on screen is through that key.

So DRM boils down to security through obscurity. Turns out obscurity is hard, expensive and never works very well.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#50

Post by devrand »

jsheard wrote: post #11
londons_explore wrote: post #6

Is there any video DRM scheme which successfully protects video content appearing on the pirate bay within 24 hours? I really don't see why so many millions (billions?) of dollars have been spent on technologies which so far have never kept the bad guys out.

4K streaming content is hit or miss because most services lock that behind Widevine L1, which requires implementors to use a secure enclave and the entire signal path to use strong encryption. If an L1 implementation gets compromised it quickly has its keys revoked and is downgraded to L2/L3, so piracy groups have a limited time window to dump as much 4K content as possible. Those lower Winevines tiers are permanentl…

It does seem like Netflix has been doing a decent cat-and-mouse game with Widevine for anything over 540p the last few months. There's been several shows that took several days to get properly copied (i.e. not just screen recorded).
Post reply on HN