Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft PlayReady – Complete Client Identity Compromise

seclists.org

Post reply on HN
Print view View original

81–90 of 175 posts

Re: Microsoft PlayReady – Complete Client Identity Compromise

#81

Post by lossolo »

crtasm wrote: post #74
ParetoOptimal wrote: post #32

Earlier quoted context omitted.

> Denuvo mostly works. Not for users: https://gamerant.com/denuvo-outage-servers-down-persona-5-ro... > Allegedly they have a custom approach to each new game, so cracks can take months to appear, with some unpopular games never having been cracked at all From what I hear, it's cracked in a matter of days or weeks. I haven't checked whether this is true or not, so I can't say you are wrong about some (most?) cracks t…

Looking at the previous two years of uncracked Denuvo and only selecting games that seem notable: Dragon's Dogma 2 (2024) Like a Dragon: Infinite Wealth (2024) Suicide Squad: Kill the Justice League (2024) Street Fighter 6 (2023) Hi-Fi Rush (2023) Dead Space (2023) Star Wars Jedi: Survivor (2023) Persona 5 Tactica (2023) EA Sports FC 24 (2023) NBA 2K24 (2023) Assassin's Creed Mirage (2023) Atomic Heart (2023) Lost Ju…

Some of the games you mention were already cracked but not by the scene.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#82

Post by bobdvb »

gorkish wrote: post #46
gjsman-1000 wrote: post #31

Earlier quoted context omitted.

As long as it stops even 100,000 people from not downloading videos off of Netflix, from an executive’s perspective, it pays for itself. To them, it’s like saying Speed Limit signs are useless, because cars can go faster than the number posted by literally pressing a button. That’s not the point.

If you take the capitalistic lust of the corporate executive to its logical extreme, given the massive costs of the DRM tech you'd think that at least one of them would realize that they could make more money if they didn't have to pay for something that doesn't work. The economics of distributing the copies are such that it doesn't actually matter if it's easy or hard for 1 or 100,000 people to break the protection.

I work for a large streaming service and a significant part of my work is content protection.

Honestly, tech folks misunderstanding of DRM and content protection is significant. There's some assumption that people are inherently honest and that we're just money grabbing. In the years that I've been doing this I've seen a lot of things and nothing has convinced me that if we turned off DRM we'd: 1) save money 2) not have issues with piracy proliferation

The cost of DRM license issuing for our company is relatively insignificant, a year's worth of DRM for millions of users is less than the cost of a single show we might make. We pay cents per thousands of plays.

I recall we launched in a new market, we did a show which would have been an expensive PPV previously, but it was included in our standard subscription. We also offered a first month free trial, which you could cancel. So, you could enjoy it at zero cost, from the original provider in high quality, with no commitment. That night our anti-piracy team took down 20,000+ illegal streams, serving a large audience.

I also acutely know that DRM isn't as secure as we'd like, I know that all security measures are ultimately not anywhere near perfect. But you know what? I also lock my front door, even though I know how to pick locks. I put my car keys in a RFID box, despite knowing there are probably CAN attacks against my car. I still need to protect my assets, because enough people don't want to pay for something if they can get it for free.

We had some research into the attitudes of pirates that basically distils down to: 1) 1/3rd would pay if they couldn't get the content any other way 2) 1/3rd don't care enough and are casual pirates, watching because they can. 3) 1/3rd are "pay never", militant, yet still happy to take my work without concern for the sustainability of that.

Ultimately, if you like content then you should pay for it, but it's always a waste of time arguing about this on the internet because so many people are in the third category, think I'm an asshole for doing my job and apparently they know my job better than I do.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#83

Post by bee_rider »

somenameforme wrote: post #37
londons_explore wrote: post #6

Is there any video DRM scheme which successfully protects video content appearing on the pirate bay within 24 hours? I really don't see why so many millions (billions?) of dollars have been spent on technologies which so far have never kept the bad guys out.

If you approach it at the most fundamental level, it seems like a clearly impossible goal to achieve. You are having users playing back content on their private devices, and then want to try to prevent them from copying that. That's basically impossible to achieve on somebody's own machine, and literally impossible to do once two enter into the picture. In the absolute worst case a high resolution/hertz cam on one's…

> In the absolute worst case a high resolution/hertz cam on one's own screen with a quick ML software polish job, would look near to completely indistinguishable from the original content.

I’m not even interested in piracy (no ethical dilemma I just can’t be bothered), but I think this would be an absolutely fantastic tech demo, and also very funny. Ultimately the video has to be displayed on a screen, so this must be the final defeat for DRM, right?

Re: Microsoft PlayReady – Complete Client Identity Compromise

#84

Post by jorams »

bombcar wrote: post #25
londons_explore wrote: post #6

Is there any video DRM scheme which successfully protects video content appearing on the pirate bay within 24 hours? I really don't see why so many millions (billions?) of dollars have been spent on technologies which so far have never kept the bad guys out.

The point of the DRM schemes is basically to keep video "hard enough to copy that normies don't do it". And not even "normies can't find it on the Pirate Bay" but "you can right click and download from Netflix." If they mostly succeed at that, they consider it good enough.

If that were true it would be possible to watch in 4k resolution on Netflix on Linux. But it's not.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#85

Post by watermelon0 »

squigz wrote: post #53

At some point this silly game of cat-and-mouse is going to escalate, and streaming players won't work unless your entire computer is locked down and "verified" by Microsoft or Apple.

I think this is already the case today; streaming players don't work unless the whole chain from the player to the display is verified.

The only reason it's possible to copy such content is because keys were leaked in the past, and they are not blacklisted.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#86

Post by bee_rider »

Mindwipe wrote: post #75
brnt wrote: post #54

Earlier quoted context omitted.

Why are Linux users limited to L3?

L1/L2 requires a third party who could be liable to sign that the drivers are unmodified to the hardware. On a general purpose Linux installation who would do that? (And who in the Linux using community wouldn't take any efforts by someone to try as an afront, bluntly).

Also there aren’t really enough of us watching videos on Linux for it to be a worthwhile market for them to address, I think.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#87

Post by ThunderSizzle »

DarkUranium wrote: post #66
amargulies wrote: post #61

Earlier quoted context omitted.

Simple example: My wife wants to consume certain Austrian/German content in Canada which are not available on any streaming service here. The streaming services there (Germany/Austria) do not support Canada. She was gifted DVDs of them, but that means she can't watch them on her phone or tablet (or laptop without a usb dvd drive that's region coded to Europe). Options are to: - rip the DVDs (pain in the butt unless y…

Note that ripping DVDs is still piracy if said DVDs contain DRM[1], at least in the US. I don't know about CA, but I'd imagine it's similar, considering the state of copyright ... [1] Region locking is a form of DRM, and most DVDs at least used to be region-locked. I don't know if that's still common practice nowadays.

In the US, it's only a legal violation if you try selling it. For personal use, you can rip DVDs.

Granted, the media companies use civil lawsuits to also make it feel illegal.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#88

Post by burningChrome »

hannob wrote: post #33
londons_explore wrote: post #6

Is there any video DRM scheme which successfully protects video content appearing on the pirate bay within 24 hours? I really don't see why so many millions (billions?) of dollars have been spent on technologies which so far have never kept the bad guys out.

DRM schemes never worked, and it has been speculated that the people building them always knew it, but had other goals. Backn in the days it was: Of course you can break DVD copyprotection schemes. But you cannot build a legal opensource DVD player software. Today it's: Of course every Netflix series can be found on the pirate bay. But you're not legally allowed to build an alternative netflix player frontend.

Just as an aside and probably a dumb question - is Pirate Bay still a thing? I know they have archival stuff you can access, but I thought Pirate Bay died out a long time ago and even pier to pier networks have all but disappeared with streaming.

I feel like this is kind of a naïve question, but I haven't needed to use pier to pier stuff since streaming did become the standard and remember a lot of articles on Pirate Bay shutting down around 2014. Some of the 1070's movies I've found on YouTube that aren't on any streaming platform like the 1982 movie Dreams Don't Die about a graffiti artist played by Ike Eisenmann.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#89

Post by sureIy »

xyzzy123 wrote: post #47
gjsman-1000 wrote: post #31

Earlier quoted context omitted.

As long as it stops even 100,000 people from not downloading videos off of Netflix, from an executive’s perspective, it pays for itself. To them, it’s like saying Speed Limit signs are useless, because cars can go faster than the number posted by literally pressing a button. That’s not the point.

Yes if a particular group gets to externalise / socialise the costs of maintaining a protection then obviously from the perspective of the protected group then it's worth it. The question is, is it good for society overall. Who or what is being protected and what impact does that have on everyone else? Speed limit / stop signs represent a decent point of discussion I think.

> The question is, is it good for society overall.

That’s not what execs ask at all. I don’t know where you’re living. The existence of DRM is not in any way related to society.

Their analysts say it’s a net positive on their balance sheets, so DRM is here. Everything else is baseless speculation.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#90

Post by grishka »

jsheard wrote: post #11
londons_explore wrote: post #6

Is there any video DRM scheme which successfully protects video content appearing on the pirate bay within 24 hours? I really don't see why so many millions (billions?) of dollars have been spent on technologies which so far have never kept the bad guys out.

4K streaming content is hit or miss because most services lock that behind Widevine L1, which requires implementors to use a secure enclave and the entire signal path to use strong encryption. If an L1 implementation gets compromised it quickly has its keys revoked and is downgraded to L2/L3, so piracy groups have a limited time window to dump as much 4K content as possible. Those lower Winevines tiers are permanentl…

> the entire signal path to use strong encryption

But the display panel itself still receives an unencrypted LVDS signal, which should not be too hard to decode. There are (were?) also cheap HDMI splitters that conveniently strip HDCP.

Your only issue is that yes, you can't get at the original compressed video stream and have to reencode, possibly losing a tiny bit of quality.

Post reply on HN