I don't know if it's worth it but I'll give it one last try. My intention is not to change anybody opinions, but to clarify how strong DRM works, in case someone still doesn't understand (which is just as likely as that I didn't understand someone).
- Authentication of software stack is through widevine, which comes from a chromebook image
Currently it may be so. In the case of strong authentication, widevine (or similar userspace software) would only be a small
piece of the authenthication. Strong DRM woks with a device that sets up some privileged software on boot up that has access
to public and private keys the rest of the system doesn't. The hardware needs to have this backed in. At the very minimum it needs to
be able to load something in a "secure world" only if it can verify that something's signature with a backed in public key (on CPU ROM, wired ROM, fused in from device factory...).
If the signature fails verification it can stop the system booting or it can let it boot without access to the secure world.
Then this secure world can verify the signatures of the bootloader, the bootloader can verify the signatures of kernel, the kernel verify the modules, and the applications
and so on. The entity controlling the private key that signs the first signature can decide what other entities are recognized as valid signers, and so they can
impose what they consider acceptable at any level.
Then remote servers can ask the browser to present a certificate signed by a secret key that's in the secure world, unaccessible to normal software. The browser can
ask widevine or friends and they can ask the secure world to sign a certificate saying that the software running is acceptable (for instance it's signed by software publlshers that signed
a contract ensuring their software won't leak the protected content). If the browser obtains that certificate it presents it to the server and the server gives it a key to decrypt the
protected content.
If the hardware does not ensure the authenticity of the secure world, the secure world won't have the key it needs to sign that and the server will reject the browser.
So any hardware that doesn't require the secure world to be signed by an entity with the right contract with the content producer, won't be able to play the content.
The authenthication is not some software-only mechanism that can be emulated in a virtual machine, because then the DRM would be ineffective, the only thing
stopping someone from copying protected content would be the the doubt of whether the content is good enough for the effort, not any engineering impossibility.
The hardware needs to be backdored from someone that the content provider trusts (typically the hardware vendor) in order for strong DRM to work. Software-only schemes
are fundamentally not strong enough.
Almost all mobiles, Intel CPUs since 15 years ago, AMD cpus since 10-12 years ago, and many ARM systems have the hardware to play this game.
Netflix may not be requiring this hardware to be there today, but the hardware is there for most of their users already.
The Pyra and a few select other computers are too honest to play this game. They are designed to be owned by the user, not the vendor. So they won't be
able to access content protected with a strong DRM.
- If Netflix decided to change it it would effect millions of users
Millions or not that'll be a tiny part of their users.
Many will be able to see the content thanks to software updates to browsers and/or OS because their hardware is already verifying the authenticity of their Secure software,
so they'll be able to update to software that will be signed with the proper keys trusted from the content providers. They won't realise there's been a change when the content
provider server starts requiring their software stack to be verified.
Those not seeing the change will be users of
- a PC with Intel or AMD processor
- an Android or iOS mobile phone or tablet updated to some version I don't know
- a smarttv
- ...
The only affected users (pissed off users) will be:
- those using user controlled hardware, like the Pyra, RockPro64, Wandboard, Talos II, Blackbird, and some others (that's a random list, not even trying to be complete).
- those using more mainstream hardware but refusing to change their software to some signed version if they still have the option.
- those with old hardware without OTAs which will probably just add this to a list of other things that no longer work or buy something new when the list grows too long.
so tinkerers and dontcarers.
- It would also piss off Google
Google, Apple, Microsoft, Intel, AMD, Nvidia and friends will be in the loop, will know of the change before you or me and will have informed Netflix and friends that they've updated their users to signed versions of DRM friendly software,
before Netflix or the major content providers enforce that.
If Google would piss off because of DRM they could be offering hardware that doesn't enforce it. But they've designed quite sophisticated systems that ensure the capability is there.
They didn't spend that money to never use the capability. And I don't think Google is the worst in that list, last time I checked chromebooks were half sane in their verified boot.
Aliens "could" invade tomorrow also.
Aliens would hesitate to invade because they would feel themselves not so alien as the current invaders.
Veni, vidi, ploravi, ii (which transletes to "realy? they built this crap ? I'm not taking this world, I won't touch it with a parsec-long pole")
You can believe this is too complex to deploy or the public is smart enough not to give their computing away just for the privilege of paying for being able to bore in front of a turned on TV instead of a turned off TV, and I wish you were right,
but I only say this is a plan, workable, competent, published and understandable. I only say when there's a plan it can be followed, not that it will be. I can't tell the future.
And that's it. I won't reply anymore on this. I'll let you rest.
github.com
