Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft PlayReady – Complete Client Identity Compromise

seclists.org

Post reply on HN
Print view View original

141–150 of 175 posts

Re: Microsoft PlayReady – Complete Client Identity Compromise

#141

Post by gjsman-1000 »

jorams wrote: post #124
bobdvb wrote: post #82

Earlier quoted context omitted.

I work for a large streaming service and a significant part of my work is content protection. Honestly, tech folks misunderstanding of DRM and content protection is significant. There's some assumption that people are inherently honest and that we're just money grabbing. In the years that I've been doing this I've seen a lot of things and nothing has convinced me that if we turned off DRM we'd: 1) save money 2) not h…

The argument from the other side is at least as frustrating. > ...nothing has convinced me that if we turned off DRM we'd: 1) save money 2) not have issues with piracy proliferation > That night our anti-piracy team took down 20,000+ illegal streams You already have enormous issues with piracy proliferation. The money you spend on DRM may be "relatively insignificant", but it's still money being wasted on "protection…

> already proven to be utterly ineffective

The fact that it does not always work, is in no way a proof of ineffectiveness.

Otherwise, the tax system, speed limit signs, front door locks, and glass windows are also “completely ineffective.”

He is literally telling you, from his own experience in his company, it’s effective. Don’t cite a sloppily-produced research paper from somewhere to make him deny reality.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#142

Post by int_19h »

jsheard wrote: post #11
londons_explore wrote: post #6

Is there any video DRM scheme which successfully protects video content appearing on the pirate bay within 24 hours? I really don't see why so many millions (billions?) of dollars have been spent on technologies which so far have never kept the bad guys out.

4K streaming content is hit or miss because most services lock that behind Widevine L1, which requires implementors to use a secure enclave and the entire signal path to use strong encryption. If an L1 implementation gets compromised it quickly has its keys revoked and is downgraded to L2/L3, so piracy groups have a limited time window to dump as much 4K content as possible. Those lower Winevines tiers are permanentl…

Not immediately; sometimes when they revoke the keys it can take a few months for the likes of StreamFab and AnyStream to catch up even with 1080p. E.g. StreamFab is currently stuck on 480p for Netflix, and it has been like that since January.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#143

Post by gjsman-1000 »

gorkish wrote: post #117
bobdvb wrote: post #82

Earlier quoted context omitted.

I work for a large streaming service and a significant part of my work is content protection. Honestly, tech folks misunderstanding of DRM and content protection is significant. There's some assumption that people are inherently honest and that we're just money grabbing. In the years that I've been doing this I've seen a lot of things and nothing has convinced me that if we turned off DRM we'd: 1) save money 2) not h…

I'm gonna be extremely blunt given that I have you in my audience, large streaming media worker bee: It's not surprising in the slightest that you have a bias towards the effectiveness of DRM when your livelihood depends on it. The fact that the unit-cost is "relatively insignificant" is simply a continuation of the straw man argument that props up the entire notion that DRM is somehow cost effective. I don't persona…

Right, as though extensions for downloading videos haven’t been Top 10 most installed on all major browsers for over a decade.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#144

Post by int_19h »

dialup_sounds wrote: post #138
xyzzy123 wrote: post #47

Earlier quoted context omitted.

Yes if a particular group gets to externalise / socialise the costs of maintaining a protection then obviously from the perspective of the protected group then it's worth it. The question is, is it good for society overall. Who or what is being protected and what impact does that have on everyone else? Speed limit / stop signs represent a decent point of discussion I think.

There is no "particular group" or "everyone else". Everyone has rights over their own creative work, even if that's mildly inconvenient to others. It's part of the social contract of modern society.

The people who profit from all this are mostly not those who can claim that it is their own creative work.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#145

Post by jorams »

gjsman-1000 wrote: post #141
jorams wrote: post #124

Earlier quoted context omitted.

The argument from the other side is at least as frustrating. > ...nothing has convinced me that if we turned off DRM we'd: 1) save money 2) not have issues with piracy proliferation > That night our anti-piracy team took down 20,000+ illegal streams You already have enormous issues with piracy proliferation. The money you spend on DRM may be "relatively insignificant", but it's still money being wasted on "protection…

> already proven to be utterly ineffective The fact that it does not always work, is in no way a proof of ineffectiveness. Otherwise, the tax system, speed limit signs, front door locks, and glass windows are also “completely ineffective.” He is literally telling you, from his own experience in his company, it’s effective. Don’t cite a sloppily-produced research paper from somewhere to make him deny reality.

> Don’t cite a sloppily-produced research paper

I'm not, I'm citing their own comment in which they describe taking down 20,000+ illegal streams of their already DRM-"protected" content on launch day. He's describing it not being effective at all.

Glass windows, speed limit signs, the tax system (what?) provide value to the people affected by them. DRM is a pure negative for customers.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#146

Post by gjsman-1000 »

jorams wrote: post #145
gjsman-1000 wrote: post #141

Earlier quoted context omitted.

> already proven to be utterly ineffective The fact that it does not always work, is in no way a proof of ineffectiveness. Otherwise, the tax system, speed limit signs, front door locks, and glass windows are also “completely ineffective.” He is literally telling you, from his own experience in his company, it’s effective. Don’t cite a sloppily-produced research paper from somewhere to make him deny reality.

> Don’t cite a sloppily-produced research paper I'm not, I'm citing their own comment in which they describe taking down 20,000+ illegal streams of their already DRM-"protected" content on launch day . He's describing it not being effective at all. Glass windows, speed limit signs, the tax system (what?) provide value to the people affected by them. DRM is a pure negative for customers.

You’re assuming it would not have been 100,000 without the DRM. You cannot prove, or cite any research, showing it would not have been much worse. In which case, it could indeed be quite effective.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#147

Post by jorams »

gjsman-1000 wrote: post #146
jorams wrote: post #145

Earlier quoted context omitted.

> Don’t cite a sloppily-produced research paper I'm not, I'm citing their own comment in which they describe taking down 20,000+ illegal streams of their already DRM-"protected" content on launch day . He's describing it not being effective at all. Glass windows, speed limit signs, the tax system (what?) provide value to the people affected by them. DRM is a pure negative for customers.

You’re assuming it would not have been 100,000 without the DRM. You cannot prove, or cite any research, showing it would not have been much worse. In which case, it could indeed be quite effective.

Indeed I can't, just like you cannot prove, or cite any research, showing it wouldn't have been 1,000 if the content was accessible without arbitrary artificial restrictions on the devices consuming it.

By all means keep taking down illegal streams. I'm not excusing the people providing them. I'm saying maybe stop treating every paying customer as if they're going to do that to the detriment of the service provided. Because it is negatively affecting the service.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#148

Post by xurukefi »

qingcharles wrote: post #135
xurukefi wrote: post #8

Earlier quoted context omitted.

The "client" whose "identity" is abused here is not an end user. A "client" in this context is a program or library that talks to the license servers and receives the content decryption keys. On my Windows machine I see a "Windows.Media.Protection.PlayReady.dll", which I guess is the client that they cracked. Maybe there are also other clients that are widely accepted by license servers. The attack essentially means…

Does PlayReady now require a secure enclave/TPM on your PC? Otherwise as you say, the only thing protecting the keys is obfuscation. This has been the same way all the way back to the first Microsoft DRMv1 in 1998 (?). The decryption keys have to be stored on your device so you can play your media or your game. So, the level of encryption is totally moot. The level of obfuscation is all that really protects the conte…

With PlayReady, as with any other DRM scheme really, there are different tiers. There is SL2000, which is done completely in software (whitebox crypto), and there is SL3000, which does require a TEE. Which tier is requried for which type of content is driven by streaming provider or studio requirements. I think it is pretty common to allow content up to 1080p to be used with whitebox crypto, whereas 4k+ content will require hardware DRM.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#149

Post by layer8 »

bee_rider wrote: post #83
somenameforme wrote: post #37

Earlier quoted context omitted.

If you approach it at the most fundamental level, it seems like a clearly impossible goal to achieve. You are having users playing back content on their private devices, and then want to try to prevent them from copying that. That's basically impossible to achieve on somebody's own machine, and literally impossible to do once two enter into the picture. In the absolute worst case a high resolution/hertz cam on one's…

> In the absolute worst case a high resolution/hertz cam on one's own screen with a quick ML software polish job, would look near to completely indistinguishable from the original content. I’m not even interested in piracy (no ethical dilemma I just can’t be bothered), but I think this would be an absolutely fantastic tech demo, and also very funny. Ultimately the video has to be displayed on a screen, so this must b…

Getting the colors right would be difficult.

Re: Microsoft PlayReady – Complete Client Identity Compromise

#150

Post by surajrmal »

tithe wrote: post #137
squigz wrote: post #53

At some point this silly game of cat-and-mouse is going to escalate, and streaming players won't work unless your entire computer is locked down and "verified" by Microsoft or Apple.

> ...unless your entire computer is locked down and "verified"... This is exactly what the WEI (Web Environment Integrity)[0] specification sought to achieve, but at the browser level. [0] https://en.wikipedia.org/wiki/Web_Environment_Integrity

Most operating systems already offer this. At some point only native apps will be supported instead of the web if browsers don't also provide it.
Post reply on HN