Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft PlayReady – Complete Client Identity Compromise

seclists.org

Post reply on HN
Print view View original

151–160 of 175 posts

Re: Microsoft PlayReady – Complete Client Identity Compromise

#151

Post by int_19h »

eklavya wrote: post #129
HeatrayEnjoyer wrote: post #107

Earlier quoted context omitted.

That's all beside the point. Hardware belongs to the user and should be under the user's control. Treacherous computing should be highly taboo and illegal. The "sustainability" of Disney's profits are not important. To suggest otherwise on a site literally named Hacker News is comical.

Why would bringing up sustainability of any business be comical at Hacker news? How do you make money? Why should it not be for free? Your sustainability is important? We agree on hardware belonging to the user by the way.

Hacker ethos is about freedom to control what you own and put it to the purposes that you, its owner, want. DRM takes away that freedom, so it is obviously incompatible.

If that freedom makes e.g. Disney business model unsustainable, then that business model is itself incompatible with the ethos.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#152

Post by int_19h »

utensil4778 wrote: post #109
squigz wrote: post #70

Earlier quoted context omitted.

Well, no, that isn't the only way to reduce piracy. Another way would be widespread collaboration between the largest tech corporations to lock down the pipeline from manufacturing to sale and onward If users continue to accept this path, which... they seem to, that is where we'll inevitably end up.

No, that's where we are now. Not in the future, right now. It isn't working. You fundamentally can't prevent someone copying your file. It isn't possible, full stop. You can only make it maximally inconvenient. You can't encrypt a user's eyeballs, so the media has to be transmitted in the clear at some level. Be it intercepting the LVDS signal to your TV panel or just pointing a camcorder at the screen. The current t…

> This does not consider the asymmetry in effort required. All legitimate users must deal with shitty DRM systems and broken apps

Oh, they do consider it. But, upon consideration, they decide that they don't care.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#153

Post by int_19h »

squigz wrote: post #99
sspiff wrote: post #72

Earlier quoted context omitted.

What about the analog loophole? At some point, the data needs to be manifested in the real world.

It's not as though there's no effort to close this loophole (see HDCP and probably others) - I don't expect them to give up any time soon Granted, pointing a camera at a screen and recording will always be possible - but I say if we ever reach the point where that is the only option, we've lost.

It is not a given that this will always be possible. I could imagine some kind of steganographic watermark in videos - diffused over the entire signal so that it cannot be easily cropped out - combined with a check for the same in all recording equipment that blocks the recording or blacks out the area if detected. Could be done "voluntarily" by all large manufacturers for starters, then eventually mandated by law for all equipment sold or imported into the country.

And there's already precedent for this kind of thing: the way copiers block money bills as source.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#154

Post by Unfrozen0688 »

burningChrome wrote: post #88
hannob wrote: post #33

Earlier quoted context omitted.

DRM schemes never worked, and it has been speculated that the people building them always knew it, but had other goals. Backn in the days it was: Of course you can break DVD copyprotection schemes. But you cannot build a legal opensource DVD player software. Today it's: Of course every Netflix series can be found on the pirate bay. But you're not legally allowed to build an alternative netflix player frontend.

Just as an aside and probably a dumb question - is Pirate Bay still a thing? I know they have archival stuff you can access, but I thought Pirate Bay died out a long time ago and even pier to pier networks have all but disappeared with streaming. I feel like this is kind of a naïve question, but I haven't needed to use pier to pier stuff since streaming did become the standard and remember a lot of articles on Pirate…

[dead]

Re: Microsoft PlayReady – Complete Client Identity Compromise

#155

Post by SSLy »

daveoc64 wrote: post #73
brnt wrote: post #55

Earlier quoted context omitted.

Why do they do that?

The lower levels of Widevine protection are weaker, so the content providers like Netflix only allow playback in standard definition or 720p at those levels. They don't want the highest quality to be available on devices where the DRM can easily be broken.

>They don't want the highest quality to be available on devices where the DRM can easily be broken.

they don't want to admit you can get L3 keymaterial from androids super easily. They just are obnoxious assholes.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#156

Post by jasomill »

yencabulator wrote: post #94
daveoc64 wrote: post #77

Earlier quoted context omitted.

The DRM clearly does work in preventing "casual piracy" - where average users do things like downloading a file and keeping it forever (even after cancelling a subscription) or copying the file to a friend.

Video streaming hasn't been "a file" in a long time. HLS et al download little snippets at a time, adjusting to current bandwidth circumstances, typically with video and audio separate, etc. Even without DRM, the average user couldn't "download a file" from Netflix.

Depends on what tools you give the average user.

A simple GUI wrapper around something like yt-dlp or ffmpeg would suffice for downloading DRM-free HLS videos.

As a concrete example, try

  yt-dlp --format english_192-English+bestvideo https://devstreaming-cdn.apple.com/videos/wwdc/2020/10655/3/45C0E27F-A3BA-416D-B037-9BEE7466C11F/master.m3u8
Note that --format is only required (to get the best available version) because yt-dlp appears to rely only on metadata present in the supplied .m3u8 file to determine which stream is "best", and no such metadata appears for the audio streams in this example.

For details on what yt-dlp knows about each candidate stream when attempting to choose the best, see

  yt-dlp --list-formats https://devstreaming-cdn.apple.com/videos/wwdc/2020/10655/3/45C0E27F-A3BA-416D-B037-9BEE7466C11F/master.m3u8
This would presumably not be a problem for our hypothetical "Netflix DLP.app", which could rely on whatever convention Netflix uses to indicate stream quality to its own clients when choosing streams, rather than falling back to sensible defaults for arbitrary HLS input.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#157

Post by remram »

Jerrrry wrote: post #125
amaccuish wrote: post #65

Earlier quoted context omitted.

I don't understand a word you've said.

Find an endpoint that checks the validity of the DRM token they have broken. See if that endpoint just hinges on that DRM token, since its crypto-secure, why check any other fields? Spoof other fields. 10k+ 0-day exploit.

Still no go.

Can you make a sentence like "Microsoft will ..." or "a problem is that ..." or something?

Re: Microsoft PlayReady – Complete Client Identity Compromise

#158

Post by burningChrome »

sureIy wrote: post #92
burningChrome wrote: post #88

Earlier quoted context omitted.

Just as an aside and probably a dumb question - is Pirate Bay still a thing? I know they have archival stuff you can access, but I thought Pirate Bay died out a long time ago and even pier to pier networks have all but disappeared with streaming. I feel like this is kind of a naïve question, but I haven't needed to use pier to pier stuff since streaming did become the standard and remember a lot of articles on Pirate…

> pier to pier I can’t believe that we don’t use this terminology. Of course pirates go from pier to pier. Missed opportunity

Ah yes, the mobile typing got me again.

Thank you for the good chuckle and have an upvote for that.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#159

Post by russelg »

Salgat wrote: post #23
tawa9102930 wrote: post #14

Earlier quoted context omitted.

HDCP is broken so none of it really matters. The resulting files ("webrips") aren't a lossless copy of the original, but are good enough for most.

Yeah web-dls might be hit or miss but webrips are such good quality that it's irrelevant for most folks anyways, since it's nearly the same quality you'd see on your TV.

I think you have terminology wrong here. by definition, WEB-DL is the exact encrypted video/audio content that is served, but unencrypted of course. You literally cannot get higher quality than a proper WEB-DL.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#160

Post by dialup_sounds »

int_19h wrote: post #144
dialup_sounds wrote: post #138

Earlier quoted context omitted.

There is no "particular group" or "everyone else". Everyone has rights over their own creative work, even if that's mildly inconvenient to others. It's part of the social contract of modern society.

The people who profit from all this are mostly not those who can claim that it is their own creative work.

Finish the thought. How do they profit from someone else's creative work? Is it a) by just taking it because they can? or b) by mutual agreement with the original creator?
Post reply on HN