Live data from Hacker News

I reverse-engineered Netflix's 4K restrictions

github.com

51–60 of 102 posts

Re: I reverse-engineered Netflix's 4K restrictions

#51
post #4

I may be an idiot, but: What does this actually, y'know, achieve? It seems the answer to me is probably nothing? It doesn't work on Firefox. It appears not to work on Chrome. The suggestion is to use Edge, which on Windows already gets 4K support in Netflix anyway.

[deleted]

Re: I reverse-engineered Netflix's 4K restrictions

#52
post #25

Earlier quoted context omitted.

For Netflix specifically; it’s because the groups that rip 4K content from Netflix burn a device (i.e. a Widevine L1 key). This is why they typically release 4K Netflix shows in batches. Here is a good thread on the topic: https://www.reddit.com/r/Piracy/comments/17ez7mi/how_come_it...

Thank you for sharing the breadcrumb~ How does Netflix detect "suspicious" activity? Does $NFLX allow 4k streaming over GrapheneOS? If so, could you pin a different certificate and do some HTTP proxy traffic manipulation to obfuscate the device (presumably an Android phone) identity or otherwise work around the DRM? I want to understand more about this but unfortunately the reddit thread is bits and pieces scattered…

A DRM system is, abstractly, a black box that contains some initial static key material, which is used to identify+authenticate the device and load in more keys at runtime, typically over some network protocol. The DRM uses those dynamically provisioned keys to decrypt the content.

For hardware DRM schemes, the initial key material is typically provisioned during manufacturing.

Since the server-side is able to identify the client device, they can in theory fingerprint the content if they want to. That way if someone cracks and shares the content, they can look at the fingerprint and figure out which device (and which account) leaked it - and then ban them.

I've never seen direct evidence that Netflix fingerprints their 4K content (although I've never properly looked), so I suspect the device-burning thing might be a bit of an urban legend. But it is technically plausible.

Re: I reverse-engineered Netflix's 4K restrictions

#53
post #43
post #25

Earlier quoted context omitted.

For Netflix specifically; it’s because the groups that rip 4K content from Netflix burn a device (i.e. a Widevine L1 key). This is why they typically release 4K Netflix shows in batches. Here is a good thread on the topic: https://www.reddit.com/r/Piracy/comments/17ez7mi/how_come_it...

What I've noticed about Netflix's supposedly 4k content is that it looks like crap compared to the same show downloaded through illicit means (and viewed on Plex or something else). What's the deal with Netflix's not-very-good 4k streams? Colour quantization or something? It's not just a one-off, why do 4k netflix shows look like rubbish compared to a moderately encoded whatever from bittorrent?

It depends. The most common reason is bitrate - the non-Netflix could have been ripped from another source (BD), or even from another service that has rights to the show in a different market (with higher bitrate).

The other trick some groups use is so-called hybrid releases. This involves combining video and audio from multiple sources to achieve the best possible quality. These are usually explicitly tagged as HYBRID, and afaik mostly applies to 4K remuxes.

Re: I reverse-engineered Netflix's 4K restrictions

#54
post #14

Earlier quoted context omitted.

I've spent a long time wondering the same thing. The standard answer is that it's fallout from the anti-anti-piracy cat and mouse game. The more conspiratorial answer is that bandwidth is expensive and streaming sites will take any excuse to serve you a lower resolution than what you actually paid for, while still being able to say that they technically support 4K. There are sensible-ish technical reasons why they ca…

Netflix does charge more for 4k, so they simply pass along the cost: https://help.netflix.com/en/node/24926

Netflix still saves money when someone watches in a lower resolution.

Re: I reverse-engineered Netflix's 4K restrictions

#55
post #22

Earlier quoted context omitted.

i don't think it works! there's no mystery here...

I can't vouch for this extension in particular (because I haven't tested it), but I've used and written similar extensions myself and can confirm that the concept is legit.

Spoofing the user agent and decoding capabilities and [...] is a useful way to unblock things that are crippled on various browsers, indeed.

The problem here is requiring hardware-attested DRM: Widevine L1 on Edge on Windows, and Apple FairPlay on Safari on MacOS. The only way to get hardware attested DRM is via browser specific (i.e.: native code) support that interfaces with the OS & GPU drivers. You can't get there through an extension.

Re: I reverse-engineered Netflix's 4K restrictions

#56
post #55
post #22

Earlier quoted context omitted.

I can't vouch for this extension in particular (because I haven't tested it), but I've used and written similar extensions myself and can confirm that the concept is legit.

Spoofing the user agent and decoding capabilities and [...] is a useful way to unblock things that are crippled on various browsers, indeed. The problem here is requiring hardware-attested DRM: Widevine L1 on Edge on Windows, and Apple FairPlay on Safari on MacOS. The only way to get hardware attested DRM is via browser specific (i.e.: native code) support that interfaces with the OS & GPU drivers. You can't get ther…

Right, but the point is that Netflix still refuses to play 4K on some browsers with hardware DRM support. Even getting it to work in Edge was a challenge last time I tried - iirc I got it working via https://github.com/lkmvip/netflix-4K-DDplus

Re: I reverse-engineered Netflix's 4K restrictions

#57

Earlier quoted context omitted.

Thank you for sharing the breadcrumb~ How does Netflix detect "suspicious" activity? Does $NFLX allow 4k streaming over GrapheneOS? If so, could you pin a different certificate and do some HTTP proxy traffic manipulation to obfuscate the device (presumably an Android phone) identity or otherwise work around the DRM? I want to understand more about this but unfortunately the reddit thread is bits and pieces scattered…

They can trace a torrented 4K piece of content to the device (or private key) that ripped it using A/B watermarking. See AWS offering: (and probably what they use for Prime Video, Netflix has their own) For large-scale per-viewer, implement a content identification strategy that allows you to trace back to specific clients, such as per-user session-based watermarking. With this approach, media is conditioned during t…

To what extent does this watermarking survive transcoding? Would not transcoding multiple times possibly affect it?

> They also use a traitor tracing scheme (Tardos codes) such that if multiple pirates get together to try and remove the watermark they will fail, you would need an unreasonably large number of pirates to succeed for some length of time.

Why?

Re: I reverse-engineered Netflix's 4K restrictions

#58

Earlier quoted context omitted.

They can trace a torrented 4K piece of content to the device (or private key) that ripped it using A/B watermarking. See AWS offering: (and probably what they use for Prime Video, Netflix has their own) For large-scale per-viewer, implement a content identification strategy that allows you to trace back to specific clients, such as per-user session-based watermarking. With this approach, media is conditioned during t…

To what extent does this watermarking survive transcoding? Would not transcoding multiple times possibly affect it? > They also use a traitor tracing scheme (Tardos codes) such that if multiple pirates get together to try and remove the watermark they will fail, you would need an unreasonably large number of pirates to succeed for some length of time. Why?

> To what extent does this watermarking survive transcoding? Would not transcoding multiple times possibly affect it?

They are designed to survive being recorded by a phone at an angle. The embedding is only 1-bit per segment which can be multiple megabytes.

> Why?

Tardos codes scale as the square of the number of traitors times a constant. For example, a movie would typically have 2000 segments -> 2000 bits of encoding. By my calculation, at around 7 traitors some start to skate by detection. And there are ways to make detection additive across leaked content, so with another 2000 all 7 will get caught. This is because while they may not score highly enough to be reliably accused, they will be under suspicion, and that suspicion can later be enhanced.

To be clear, what the traitors are doing is pooling all the segment versions they have available to them, and adversarially choose a segment at random. This is the best strategy they have, a close second is to choose the segment that the majority have.

Trying to remove the actual 1-bit watermark from the segment isn't typically feasible. Every segment will have a unique adjustment to encode it. The embedding algorithm will take a secret key.

Re: I reverse-engineered Netflix's 4K restrictions

#59

Earlier quoted context omitted.

Thank you for sharing the breadcrumb~ How does Netflix detect "suspicious" activity? Does $NFLX allow 4k streaming over GrapheneOS? If so, could you pin a different certificate and do some HTTP proxy traffic manipulation to obfuscate the device (presumably an Android phone) identity or otherwise work around the DRM? I want to understand more about this but unfortunately the reddit thread is bits and pieces scattered…

They can trace a torrented 4K piece of content to the device (or private key) that ripped it using A/B watermarking. See AWS offering: (and probably what they use for Prime Video, Netflix has their own) For large-scale per-viewer, implement a content identification strategy that allows you to trace back to specific clients, such as per-user session-based watermarking. With this approach, media is conditioned during t…

Netflix does not encode content per-user, it's all static content on CDNs

Re: I reverse-engineered Netflix's 4K restrictions

#60
post #59

Earlier quoted context omitted.

They can trace a torrented 4K piece of content to the device (or private key) that ripped it using A/B watermarking. See AWS offering: (and probably what they use for Prime Video, Netflix has their own) For large-scale per-viewer, implement a content identification strategy that allows you to trace back to specific clients, such as per-user session-based watermarking. With this approach, media is conditioned during t…

Netflix does not encode content per-user, it's all static content on CDNs

A/B watermarking is about static content on CDNs...

For every segment in a video there will be two versions. Every user will get a unique sequence of segments served to them.

Post reply on HN