Live data from Hacker News

Trying to extract Widewine key: A journey to failure

github.com

121–130 of 133 posts

Re: Trying to extract Widewine key: A journey to failure

#121

Earlier quoted context omitted.

> If nothing else, im sure it shows up in the analytics if someone's netflix account is 24/7 streaming every episode of every show without break. That would happen with or without DRM.

But DRM would in principle require you to watch it all in real time, which would probably help with profiling the abnormal behaviour.

Without DRM you could stream faster than realtime, but that would be even weirder right? But maybe I'm missing the point of this thread.

Re: Trying to extract Widewine key: A journey to failure

#122

Earlier quoted context omitted.

The UHD restriction is not a technical one. Content producers and the rest of the media industry has strict requirements about streaming. UHD content uses proprietary DRM systems from Microsoft and Apple that are considered more secure than WideVine, which is why those browsers are permitted to watch 4k. You can't watch UHD content on Edge for Linux, for example, because the necessary DRM isn't implemented.

So does this mean that the DRM is still at least partially implemented in software? I also seem to remember that Netflix on Windows (don't know about mac) also requires hardware decoding support for HEVC1 (or whatever their codec is). I never got it to work with an intel GPU (8th gen udh630 — supposed to support it) but it worked with an AMD GPU.

Partially, for sure. However, even with hardware support you need some kind of licensed (signed?) binary interface with the DRM hardware to ensure that nobody is decoding a hundred Netflix streams at a time.

I don't know a lot about how everything works below the hood, but you can probably find some of the details on the Microsoft website [0] if you want.

[0]: https://www.microsoft.com/playready/

Re: Trying to extract Widewine key: A journey to failure

#123
post #78

The majority of media-based DRM implementations are completely bunk and fundamentally broken. You — yes, you, reader — are able to take advantage of DRM implementations and break their fundamental premise without much effort. What's the point if someone with a faint degree of technical ability can redirect your content? I'd argue you're just putting lipstick on a pig. The idea itself is nice; I get the point. If I'm…

The majority of media-based DRM implementations are completely bunk and fundamentally broken. You — yes, you, reader — are able to take advantage of DRM implementations and break their fundamental premise without much effort

But, apparently not Widevine and not the kind of HN reader who wrote the article. They spent weeks trying to extract the key and failed. The article is a story of their failure.

Re: Trying to extract Widewine key: A journey to failure

#124

Can someone explain what's the point of DRM for video streaming when you can do screen recording so easily. It could make sense in books and games but why is netflix such a heavy proponent for it?

I think people often evaluate DRM as if it stands alone. In reality it's only one component in an integrated system of technology, economics and law.

A good enough DRM system does not have to be 100% unbeatable all the time. It's sufficient to:

a. Delay a hacked release until after most of the sales have already occurred. This is very often the case with successful game DRM. A crack after six months is irrelevant because virtually all the sales are in the first month or so. A crack that comes out after everyone with interest has already ponied up doesn't matter much, and in fact an unbeatable DRM that never gets cracked would suggest misallocation of resources!

b. Focus cracks on a handful of specialists who can then be investigated and potentially prosecuted or bought out. A DRM so easy 100,000 people can crack it is very different to a DRM that only 5 people have cracks for and where they keep their cracks private. The latter becomes amenable to non-technical approaches. Again, an unbeatable DRM would probably represent a waste of effort.

There are quite a few DRM schemes that have achieved this level of good-enough success which is why despite decades of people railing against it in online forums such as this one, it sticks around regardless.

Re: Trying to extract Widewine key: A journey to failure

#125
post #78

The majority of media-based DRM implementations are completely bunk and fundamentally broken. You — yes, you, reader — are able to take advantage of DRM implementations and break their fundamental premise without much effort. What's the point if someone with a faint degree of technical ability can redirect your content? I'd argue you're just putting lipstick on a pig. The idea itself is nice; I get the point. If I'm…

My dad used to say that locks are only used to keep the honest criminals out.

Re: Trying to extract Widewine key: A journey to failure

#126

Can someone explain what's the point of DRM for video streaming when you can do screen recording so easily. It could make sense in books and games but why is netflix such a heavy proponent for it?

You will most likely find that your OS gives you a black square for the DRM content when you record the screen. This is facilitated by OS support on Windows, iOS, etc. It’s also why HDCP exists to prevent capture from HDMI etc.

A workaround for that is to put a lightweight OS onto a virtualbox VM and then record the output from the Host OS after putting the VM into fullscreen mode, or you cand buy a cheap HDMI splitter that accepts HDCP on the input but doesn't put it back on the output.

Re: Trying to extract Widewine key: A journey to failure

#127

Earlier quoted context omitted.

The production costs in music are orders of magnitude lower than those for video. It takes far fewer people far fewer days to record a song than a TV show or a movie. The equipment involved in recording, mixing, and special effects are all dramatically cheaper, which also makes the entire process more accessible and enables scales that do not exist for most media. A business model for one thing does not generalize.

The cost of the input is irrelevant. Sell things for money generalized pretty well in basically every other field. It actually generalized pretty well in video too. This is just adding "remove the DRM". It'll be fine once all the old studio execs retire...

The cost of the input affects the cost of the output, which makes all the difference in the world.

Let's start with the most obvious: "sell things for money" hasn't worked out that well in music. Streaming services (with DRM) are 83% of revenue in the music industry now: https://www.businessofbusiness.com/articles/vinyl-record-sal...

The price of music is dramatically lower. Its consumption model is entirely different - a song may be played dozens of times on a radio station or a streaming platform, each performance for pennies. Video, on the other hand, is predominately a single-shot mechanism. There's enough new content that almost no customers will watch the same piece of video multiple times. You have to make back all of your revenue in that initial purchase. Combined with higher production costs, you need higher prices. You also need a guarantee people will have to pay those prices to justify the investment and even begin the process. DRM is such a guarantee.

Re: Trying to extract Widewine key: A journey to failure

#128

Earlier quoted context omitted.

This seems to be confirmed by the fact that most torrent sites have 4K copies of brand new streaming only content while no publicly known exploits exist. Since you are running the exploit locally without affecting other peoples machines, I imagine it would be close to impossible to work out what exploit they are using.

Are those actual decrypted copies of the original stream, though? Or did they just re-record the output? For the latter you'd only need to break HDCP, right?

Yeah. They're WEB-DLs, not WebRips.

Re: Trying to extract Widewine key: A journey to failure

#129

Can someone explain what's the point of DRM for video streaming when you can do screen recording so easily. It could make sense in books and games but why is netflix such a heavy proponent for it?

You will most likely find that your OS gives you a black square for the DRM content when you record the screen. This is facilitated by OS support on Windows, iOS, etc. It’s also why HDCP exists to prevent capture from HDMI etc.

It doesn't on linux distros. It's dead easy to record DRM'd media, although it takes a little bit of oomph to not drop frames. This is why Netflix limits Linux to 1080p.

Re: Trying to extract Widewine key: A journey to failure

#130
post #78

The majority of media-based DRM implementations are completely bunk and fundamentally broken. You — yes, you, reader — are able to take advantage of DRM implementations and break their fundamental premise without much effort. What's the point if someone with a faint degree of technical ability can redirect your content? I'd argue you're just putting lipstick on a pig. The idea itself is nice; I get the point. If I'm…

The majority of media-based DRM implementations are completely bunk and fundamentally broken. You — yes, you, reader — are able to take advantage of DRM implementations and break their fundamental premise without much effort But, apparently not Widevine and not the kind of HN reader who wrote the article. They spent weeks trying to extract the key and failed. The article is a story of their failure.

That's one way of looking at it. Who says you need to extract the key for playback?
Post reply on HN