Yt-dlp: External JavaScript runtime now required for full YouTube support

They’d need dedicated hardware to enforce any kind of effective DRM. Encrypted bitstream generated on the fly watchable only on L2 attested device.

Which is why Windows 11 requires TPM.

Netflix is already there for 4k streams

I guess at that point we could do it the old fashioned way by pointing a camera at the screen. Or, I guess, a more professional approach based on external recording.

And it's an entirely useless effort. No idea how it is done but the internet is full 4k rips.

Can you explain in simple terms what would prevent one from running the decryption programmatically posing as the end client?

I knew of this chrome bug which could allow netflix to be ripped. I had heard it in comments of some section of youtube and I might need to look further into it but its definitely possible.

They find devices that are easy to hack (and I mean rip and tear) and extract the decryption keys from each of them, from what I have heard cheap chinese tvs and set top boxes, they extract the keys from the chips (hardware hacking, heard some even use microscopes to read the keys by hand), and then use them to decrypt streams, I heard that they catch them pretty fast to they use like 1 device per season. This is why they use mostly stollen devices.

Interesting - do you have any sources to read further?

Here are a couple ideas:

The decryption code could verify that it's only providing decrypted content to an attested-legitimate monitor, using DRM over HDMI (HDCP).

You might try to modify the decryption code to disable the part where it reencrypts the data for the monitor, but it might be heavily obfuscated.

Maybe the decryption key is only provided to a TPM that can attest its legitimacy. Then you would need a hardware vulnerability to crack it.

Maybe the server could provide a datastream that's fed directly to the monitor and decrypted there, without any decryption happening on the computer. Then of course the reverse engineering would target the monitor instead of the code on the computer. The monitor would be a less easily accessible reverse engineering target, and it itself could employ obfuscation and a TPM.

TPM isn't the only misfeature that makes Windows 11 an abomination. People who don't switch to a respectful platform is in for a lot of pain.

Let's say the only devices you can get that will run YouTube are running i/pad/visionOS or Android and that those will only run on controlled hardware and that the hardware will only run signed code. Now let's say the only way to get the YouTube client is though the controlled app stores on those platforms. You can build a chain of trust tied to something like a TPM in the device at one end and signing keys held by Apple or Google at the other that makes it very difficult to get access to the client implementation and the key material and run something like the client in an environment that would allow it to provide convincing evidence that it is a trusted client. As long as you have the hardware and software in your hands, it's probably not impossible, but it can be made just a few steps shy.

Attestation requiring a hardware TPM 2.0 (or higher), and not being able to extract the private key from the TPM on your system.

TPM is Mathematically Secure and you can't extract what's put in. See, Fritz-Chip.

Yes, it's called: Web Environment Integrity + hardware attestation of some kind

> "the technical means through which WEI will accomplish its ends is relatively simple. Before serving a web page, a server can ask a third-party "verification" service to make sure that the user's browsing environment has not been "tampered" with. A translation of the policy's terminology will help us here: this Google-owned server will be asked to make sure that the browser does not deviate in any way from Google's accepted browser configuration" [1]

https://www.fsf.org/blogs/community/web-environment-integrit...

The analog hole is real.

maybe to stop the .01%. switching to app only, sign in only would get them pretty much all the way there.

They own the os, with sign-in, integrity checks, and the inability to install anything on it Google doesn't want you to install they could make it pretty much impossible to view the videos on a device capable of capturing them for the vast majority of people. Combine that with a generation raised in sandboxes and their content would be safe.

Search for widevine decrypt. You’ll find code and forums where at least some L3 (software) keys are publicly shared. For high resolution on some platforms, you need L1 keys, but as far as I understand the decryption process basically stays the same once you have a working key.

Random article: https://www.ismailzai.com/blog/picking-the-widevine-locks

Claimed to be L1 key leaks (probably all blacklisted by now): https://github.com/Mavrick102/WIDEVINE-CDM-L1-Giveaway

It's not as easy as downloading a YouTube video though

"their" content? This is Youtube.

Of course, the same can be said for FB, Tiktok, instagram, Pintrest, reddit, ... and I'm sure the list keeps going. Frankly, Youtube is pretty damn good about this, really.

The really shitty thing is that vulnerable devices get blacklisted en masse, so all legitimate users get stuck with 480p video content on streaming services. The Nexus 5 got this treatment, as I understand it, because it was too easy to extract the keys.

DRM protection schemes usually don't rely on TPM, the real magic happens inside your GPU and the monitor.

No where else to go that pays. They can pay which entices those to stay.

Google owns that monopoly.

>They’d need dedicated hardware to enforce any kind of effective DRM.

That's already here. Even random aliexpress tablets support widevine L1 (ie. highest security level)

Breaking HDCP is a lot easier than breaking the other things. You don't have to attack the torment nexus directly. This is not the most ideal option but it is information theoretically correct assuming your capture rig is set up properly.

I might be recalling it wrong,but I remember reading that there was some old hardware that refused to record protected TV/Movies probably a VCR or a DVR.

Camera manufacturers can easily refuse to record a stream of they detect it is protected, may be via watermarks or other sidechannel.

More easily in the past (I don't think if it's still true for 4K) you only needed an HDMI splitter to bypass HDCP copy protection.

Wonder if you could train a neural net to take camera recordings and basically reconstitute the original. For a given setup, the distortions should be pretty consistent.

You won't find a ton of up-to-date info that would let you do the same - the scene groups hold their methods closely specifically because of this cat-and-mouse game.

iOS can already attest to websites that they are running in unmodified Safari. https://developer.apple.com/news/?id=huqjyh7k

I guess that isn't quite enough to prevent screen recording but these devices also support DRM which does this.

It would be harder to break HDCP and you wouldn't even get the original compressed media content. It's a worse idea.

It provides a good incentive for manufacturers to invest into security for their devices.

No, it provides no incentive at all!

It's the users who suffer when this happens, not the manufacturers. The manufacturers couldn't care less, the money is already in the bank.

If the manufacturers were required to replace all the revoked devices at their cost, that would be a real incentive.

Old VCRs looked for a hidden signal that rental videos put out so you couldn't record them. But it was easy to block with a cheap device that you put in the middle.

You don't get access to the decryption code nor the keys - both are hardwired in silicon.

We'll eventually be able to reverse-engineer that and run it programmatically, but it will take a long time.

And when they catch you doing so, they'll ban your (personalized) encryption key so you'll just have to buy another graphics card to get another key.

This is how it already works, not some future thing. But the licensing fees make it so it only gets used for Hollywood-level movies.

They can use all available tools at the same time.

TPMs existed for at least a decade though.

Not a Netflix user here: Are you saying that paying customers get cut off from higher video quality, that they are possibly paying for, and pressured into buying new devices? That shit should be illegal!

Yes, that's exactly what happens!