Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft PlayReady – Complete Client Identity Compromise

seclists.org

Post reply on HN
Print view View original

61–70 of 175 posts

Re: Microsoft PlayReady – Complete Client Identity Compromise

#61

Post by amargulies »

andsoitis wrote: post #22
gwbas1c wrote: post #13

Earlier quoted context omitted.

> have never kept the bad guys out Careful who you call the bad guys. A lot of "piracy" comes from the people who spend the most money on the content they pirate. I personally think the best DRM approaches are those that keep "the honest people honest:" IE, metadata that identifies copyright owners, flags that identify content that has restrictions due to copyright, and casual protections. (Think of a "do not enter"…

> A lot of "piracy" comes from the people who spend the most money on the content they pirate. That doesn’t strike me as a valid statistic. Where are you getting that data from?

Simple example: My wife wants to consume certain Austrian/German content in Canada which are not available on any streaming service here. The streaming services there (Germany/Austria) do not support Canada. She was gifted DVDs of them, but that means she can't watch them on her phone or tablet (or laptop without a usb dvd drive that's region coded to Europe). Options are to:

- rip the DVDs (pain in the butt unless you have a specific setup for doing it en-masse. Some shows end up with episodes out of order, etc)

- download the shows

And this is when she's lucky enough the show/movie had a DVD release.

Similar problems exist for local content that doesn't exist on streaming sites altogether (bunch of things I grew up watching that I'd like to revisit).

Re: Microsoft PlayReady – Complete Client Identity Compromise

#62

Post by 015a »

squigz wrote: post #53

At some point this silly game of cat-and-mouse is going to escalate, and streaming players won't work unless your entire computer is locked down and "verified" by Microsoft or Apple.

At some point it escalates to where the media providers make watching their media so expensive, time consuming, and difficult that piracy ramps back up.

It sounds dumb, like "why would companies shoot themselves in the foot like this" but trust that they will. They always do. Corpobrain is a form of autopilot, there's no one with intelligence in charge not because the people who work at media companies are dumb (though, they are), but because there's just literally no one in charge. Its autopilot. Each iterative decision in isolation makes sense, but when zoomed out and interpreted holistically they're killing their own business.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#63

Post by amargulies »

repelsteeltje wrote: post #41
andsoitis wrote: post #22

Earlier quoted context omitted.

> A lot of "piracy" comes from the people who spend the most money on the content they pirate. That doesn’t strike me as a valid statistic. Where are you getting that data from?

I think he alludes to "lore" more than statistic. In the CD/DVD age anti-piracy measure like region locks, DRM, but also annoying banners you could not skip would often make consuming the media with a regular CD or DVD player so cumbersome, that you were almost forced into ripping the media onto a hard disk first and consuming the media with VLC or similar. The inability to just consume media using official device to…

There are in fact studies that show people that pirate tend to spend the most on legal content. See every study listed here for example: https://www.vice.com/en/article/evkmz7/study-again-shows-pir...

Re: Microsoft PlayReady – Complete Client Identity Compromise

#64

Post by squigz »

dawnerd wrote: post #59
squigz wrote: post #53

At some point this silly game of cat-and-mouse is going to escalate, and streaming players won't work unless your entire computer is locked down and "verified" by Microsoft or Apple.

And yet content will still be torrented within hours. It’s always the honest consumers that lose.

This assuredness that piracy will always win will be our demise.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#65

Post by amaccuish »

Jerrrry wrote: post #5

Given how horribly all major companies, MS most certainly included, confuse authentication vs. authorization, this is almost certainly able to be paired with a 'vulnerable' (all) endpoint to retrieve/post/update player information. The horizontal pivot from DRM/crypto-managed Identity to a session token, an unassumingly-kosher redirect, or just omitting the "AUTHENTICATION" header itself is a trivial exercise for the…

I don't understand a word you've said.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#66

Post by DarkUranium »

amargulies wrote: post #61
andsoitis wrote: post #22

Earlier quoted context omitted.

> A lot of "piracy" comes from the people who spend the most money on the content they pirate. That doesn’t strike me as a valid statistic. Where are you getting that data from?

Simple example: My wife wants to consume certain Austrian/German content in Canada which are not available on any streaming service here. The streaming services there (Germany/Austria) do not support Canada. She was gifted DVDs of them, but that means she can't watch them on her phone or tablet (or laptop without a usb dvd drive that's region coded to Europe). Options are to: - rip the DVDs (pain in the butt unless y…

Note that ripping DVDs is still piracy if said DVDs contain DRM[1], at least in the US. I don't know about CA, but I'd imagine it's similar, considering the state of copyright ...

[1] Region locking is a form of DRM, and most DVDs at least used to be region-locked. I don't know if that's still common practice nowadays.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#67

Post by DarkUranium »

gjsman-1000 wrote: post #43
gwbas1c wrote: post #13

Earlier quoted context omitted.

> have never kept the bad guys out Careful who you call the bad guys. A lot of "piracy" comes from the people who spend the most money on the content they pirate. I personally think the best DRM approaches are those that keep "the honest people honest:" IE, metadata that identifies copyright owners, flags that identify content that has restrictions due to copyright, and casual protections. (Think of a "do not enter"…

“Careful who you call the bad guys. A lot of "piracy" comes from the people who spend the most money on the content they pirate.” This is laughably, obviously false. Don’t let the Reddit bubble of all 300 people who do this, or the 1.2% of Yuzu users who actually dumped their own keys, distort your understanding of reality.

https://www.vice.com/en/article/evkmz7/study-again-shows-pir...

Re: Microsoft PlayReady – Complete Client Identity Compromise

#68

Post by dawnerd »

squigz wrote: post #64
dawnerd wrote: post #59

Earlier quoted context omitted.

And yet content will still be torrented within hours. It’s always the honest consumers that lose.

This assuredness that piracy will always win will be our demise.

The only way to reduce piracy is to make access easier and cheaper - something the music industry figured out. Sure music still gets pirated but its a lot less.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#69

Post by 486sx33 »

jsheard wrote: post #11
londons_explore wrote: post #6

Is there any video DRM scheme which successfully protects video content appearing on the pirate bay within 24 hours? I really don't see why so many millions (billions?) of dollars have been spent on technologies which so far have never kept the bad guys out.

4K streaming content is hit or miss because most services lock that behind Widevine L1, which requires implementors to use a secure enclave and the entire signal path to use strong encryption. If an L1 implementation gets compromised it quickly has its keys revoked and is downgraded to L2/L3, so piracy groups have a limited time window to dump as much 4K content as possible. Those lower Winevines tiers are permanentl…

“4K Bluray playback on PCs is effectively being phased out.”

Which will only perpetuate and speed up the problem. 4K blu ray discs suck on a lot of new tvs and players for frame rate and detail so the best visual experience is going to be on high dpi PCs (or Mac? Retina?)

If I can’t play a 4K blu ray I purchased on my pc… I’m going to probably download a ripped version and not feel guilty about it since I purchased the disc …

My M2 Pro can decode and play 4K without breaking a sweat and with amazing battery life on VLC player

Re: Microsoft PlayReady – Complete Client Identity Compromise

#70

Post by squigz »

dawnerd wrote: post #68
squigz wrote: post #64

Earlier quoted context omitted.

This assuredness that piracy will always win will be our demise.

The only way to reduce piracy is to make access easier and cheaper - something the music industry figured out. Sure music still gets pirated but its a lot less.

Well, no, that isn't the only way to reduce piracy. Another way would be widespread collaboration between the largest tech corporations to lock down the pipeline from manufacturing to sale and onward

If users continue to accept this path, which... they seem to, that is where we'll inevitably end up.

Post reply on HN