Live data from Hacker News

Microsoft PlayReady – Complete Client Identity Compromise

seclists.org

111–120 of 175 posts

Re: Microsoft PlayReady – Complete Client Identity Compromise

#111
post #84

Earlier quoted context omitted.

If that were true it would be possible to watch in 4k resolution on Netflix on Linux. But it's not.

Because if "4k on Linux" was doable than "download a 4k rip directly" would shortly follow.

Well, it sure seems to make a market for people who would/does pay for legitimate 4k video in their browser to pirate. I am happy to pay for streaming, but as the quality goes down so does any desire to shell out honest money.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#112

Earlier quoted context omitted.

If you approach it at the most fundamental level, it seems like a clearly impossible goal to achieve. You are having users playing back content on their private devices, and then want to try to prevent them from copying that. That's basically impossible to achieve on somebody's own machine, and literally impossible to do once two enter into the picture. In the absolute worst case a high resolution/hertz cam on one's…

I imagine in the future DRM is directly embedded in the viewers brain and if it detects pirate content it just fries you. I genuinely can't imagine any other form of DRM being successful.

Drink a verification can to continue.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#113

Earlier quoted context omitted.

Because if "4k on Linux" was doable than "download a 4k rip directly" would shortly follow.

Well, it sure seems to make a market for people who would/does pay for legitimate 4k video in their browser to pirate. I am happy to pay for streaming, but as the quality goes down so does any desire to shell out honest money.

The thing that's breaking me is that I can't even figure out which combination of what I need to get what I want.

I just want to pay the $5 and watch the damn movie/show!

So instead I just ... check out the Roku from the library that has all the services and binge ;)

Re: Microsoft PlayReady – Complete Client Identity Compromise

#114
post #13

Earlier quoted context omitted.

> have never kept the bad guys out Careful who you call the bad guys. A lot of "piracy" comes from the people who spend the most money on the content they pirate. I personally think the best DRM approaches are those that keep "the honest people honest:" IE, metadata that identifies copyright owners, flags that identify content that has restrictions due to copyright, and casual protections. (Think of a "do not enter"…

“Careful who you call the bad guys. A lot of "piracy" comes from the people who spend the most money on the content they pirate.” This is laughably, obviously false. Don’t let the Reddit bubble of all 300 people who do this, or the 1.2% of Yuzu users who actually dumped their own keys, distort your understanding of reality.

> or the 1.2% of Yuzu users who actually dumped their own keys

As a Nintendo Switch owner, if my console died or I wanted to play Zelda at 4K I would probably not go through the hassle of dumping my own keys and rip the game myself if I can download them on the internet in a more convenient/quick way.

So there is probably a much larger fraction of users that own their games legally but still use emulators.

Also as said somewhere else, the fact some people play pirated games they would probably not even play if they were not available that way is orthogonal to the fact they may still be the highest spenders in games. Same applies to movies/music/shows. People usually have a non infinitely stretchable budget. A lot of piracy is opportunistic but would not transfer in sales if prevented. When I was a teenager/young adult I pirated a lot of stuff to try out. My gaming/movie/CD budget was fixed anyway and I still spent money on them but for the most part I would not have bought more if those things weren't accessibles illegally. Some were either out of reach for my budget (softwares like photoshop or Music DAWs), other were not deemed good enough to pay for them over better records/movies/games.

And it transfers to today: while I have a totally unlimited access to 8, 16-bit and 32-bit console roms, I almost only play to games I have owned and loved at the time.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#115

Earlier quoted context omitted.

Yep I realized that and edited my parent comment but you beat me to it.

Another complication for LVDS capture is that HDR content is always tonemapped/filtered (OLED ABL etc) before it is sent to the panel, and that processed version is what you would get with LVDS capture. It might be usable, but it would be a downgrade from other capture or decryption methods which grab the unprocessed HDR video.

With a $20 HDMI grabber you get 4K HDR video with full Dolby Vision or HDR10 metadata, without any tonemapping applied, én masse.

Combine that with some software mods to hide the UI at all times and you've got a perfect recording.

Re-encoding is the slowest and most annoying part of this process, but release groups re-encode everything anyway, so that's not an issue either.

DRM only hurts the legitimate customers, no one else.

I'm subscribed to the highest tiers of Netflix, Disney+, Prime Video, Paramount+, YouTube Premium, CuriosityStream, Nebula and Zattoo.

Yet often enough, I have to rip media from bluray because the streaming version only has audio or subtitles available in the local language or the quality is subpar.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#116
post #33

Earlier quoted context omitted.

DRM schemes never worked, and it has been speculated that the people building them always knew it, but had other goals. Backn in the days it was: Of course you can break DVD copyprotection schemes. But you cannot build a legal opensource DVD player software. Today it's: Of course every Netflix series can be found on the pirate bay. But you're not legally allowed to build an alternative netflix player frontend.

Just as an aside and probably a dumb question - is Pirate Bay still a thing? I know they have archival stuff you can access, but I thought Pirate Bay died out a long time ago and even pier to pier networks have all but disappeared with streaming. I feel like this is kind of a naïve question, but I haven't needed to use pier to pier stuff since streaming did become the standard and remember a lot of articles on Pirate…

Yes, the Pirate Bay is still a thing:

https://thepiratebay.org/index.html

Feel free to look up your favorite movies from 2024. They're on there.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#117
post #82
post #46

Earlier quoted context omitted.

If you take the capitalistic lust of the corporate executive to its logical extreme, given the massive costs of the DRM tech you'd think that at least one of them would realize that they could make more money if they didn't have to pay for something that doesn't work. The economics of distributing the copies are such that it doesn't actually matter if it's easy or hard for 1 or 100,000 people to break the protection.

I work for a large streaming service and a significant part of my work is content protection. Honestly, tech folks misunderstanding of DRM and content protection is significant. There's some assumption that people are inherently honest and that we're just money grabbing. In the years that I've been doing this I've seen a lot of things and nothing has convinced me that if we turned off DRM we'd: 1) save money 2) not h…

I'm gonna be extremely blunt given that I have you in my audience, large streaming media worker bee: It's not surprising in the slightest that you have a bias towards the effectiveness of DRM when your livelihood depends on it. The fact that the unit-cost is "relatively insignificant" is simply a continuation of the straw man argument that props up the entire notion that DRM is somehow cost effective. I don't personally think you are a jerk or anything for working your job, but I can say that I would not personally find it fulfilling to spend my own career on something with such diminishing returns. I guess all of those insignificant expenses add up to some good money in the end, at least in someone's opinion. The incentive to continue burying the failed promises of DRM and keep it propped up as long as possible is evident though; the story really hasn't changed in the 30 years or so that I've been following it.

The lack of a "save video" button in the player app is the most effective means to prevent the average person from distributing the content. By your "lock on the door" analogy, a UI that does not allow the thing you don't want your users doing is providing more or less equivalent protection to the DRM. It doesn't matter how many locks you put on your door if all the attacker needs to get what they want is to look through the window. Why continue to invest in the additional technology if it is not actually adding significant additional protection? By the time any user presents a willingness to do anything at all to circumvent your standard software interface, you have lost; the user will succeed. Plugging in a $30 recorder and pushing the button is all it takes, and all the sweet cutting edge secure enclave crypto quantum DRM in the world cannot prevent it. How many of those 20k illegal streams you cite even bothered to break the precious DRM? My guess is zero.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#118

Earlier quoted context omitted.

If you approach it at the most fundamental level, it seems like a clearly impossible goal to achieve. You are having users playing back content on their private devices, and then want to try to prevent them from copying that. That's basically impossible to achieve on somebody's own machine, and literally impossible to do once two enter into the picture. In the absolute worst case a high resolution/hertz cam on one's…

> In the absolute worst case a high resolution/hertz cam on one's own screen with a quick ML software polish job, would look near to completely indistinguishable from the original content. I’m not even interested in piracy (no ethical dilemma I just can’t be bothered), but I think this would be an absolutely fantastic tech demo, and also very funny. Ultimately the video has to be displayed on a screen, so this must b…

Every now and then I do event tech for some small tech conferences, lectures, etc.

A while ago we had an issue where, under some circumstances, macbooks would enforce HDCP for their output. Obviously an issue if you're trying to record and stream a talk. And we didn't have any hdcp removal devices on hand.

So I set up a Sony FX30 with fujinon broadcast optics on a tripod, aimed at the screen. Some white balancing and adjustments to brightness and ISO curve later and the image was undistinguishable from the original.

We actually used that setup for all talks on that day, and it worked perfectly fine.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#119
post #46

Earlier quoted context omitted.

If you take the capitalistic lust of the corporate executive to its logical extreme, given the massive costs of the DRM tech you'd think that at least one of them would realize that they could make more money if they didn't have to pay for something that doesn't work. The economics of distributing the copies are such that it doesn't actually matter if it's easy or hard for 1 or 100,000 people to break the protection.

I can get DRM, right now, for my videos, with 500,000 plays for $1665. That’s publicly available, commercial pricing. That’s a third of a cent per play. At Netflix scale, it’s probably cheaper. DRM is a drop in the bucket compared to normal costs. A Netflix subscription is, what, $10? That’s enough to pay for 3,300 encrypted plays. The same provider, if I was doing over 10,000,000 plays, will drop it to just under on…

Sharing with friend and family is not "serious theft". It is benevolent and what people do with books and DVD, without industry people becoming insane about.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#120
post #64
post #59

Earlier quoted context omitted.

And yet content will still be torrented within hours. It’s always the honest consumers that lose.

This assuredness that piracy will always win will be our demise.

It's like when that first Motorola came out with a locked bootloader, or maybe the second one, I think the first was trivially crackable. I remember that year, all of the people claiming it was just a matter of time. And nowadays, among other reasons, custom roms are largely dead because people want access to PayPal, Netflix and their banking app.

It's grim. I hope to win the lottery and leave the industry before the term "computer" has lost all meaning.

Post reply on HN