This is great news! Undermining remote attestation is a win for the open web and free society. And perhaps it means we can get Libreboot on something newer than Ivy Bridge.
Both exist to treat the user as a hostile entity.
At the individual level, remote attestation has a particularly terrible end game. Think of all those websites that attempt to enforce their desired business whims client-side, that we rightfully laugh at - browser fingerprinting, image save as, anti-adblock, etc. Now imagine they're successful!
Another possibility is still a source leak, where 4k content gets lifted off Netflixes own internal content storage.
Assuming there is a watermark, how would you track them down? It's not like you need to register your hdmi capture device.
Cinema DCP packages, however, do - it's either watermarked at the DCP distributor or in the decryption module, but that stuff is out of reach for most warez crews.
But then only ~6 accounts to have >50% probability of seeing every combination of each bit and be able to combine them at random.
There's no need for that, the CENC standard has more robust watermarking support, but it's not really used in practice yet because it's not commonly supported by browsers and possibly other clients.
Now, as for whether or not you can distinguish the re-encoding from it's original source.... difficult but plausible in certain scenarios? Perhaps if the content was heavily re-encoded to the point where you can statistically determine the presence of the generational noise. With only a single re-encode it may be impossible to determine.
[0] https://goughlui.com/2016/11/22/video-compression-x264-crf-g...
if so, that is definitely not a good thing.
Apple is a good example here. You can't even touch the internal storage whether you want it encrypted or not, because all access to the onboard storage is gated by their black box security processor.
I'd rather just forego the silicon and do it all in software, since there's no way to ensure that the OEMs aren't being bastards. Another reason is that the hardware vendor is in a great, centralized position to be backdoored either by hackers or the bad guys with badges.
Remote attestation is required for many privacy-preserving activities. It isn't just DRM.
I didn't say it was just DRM. Remote attestation creates a vulnerability whereby remote entities demand that you attest to running a software environment that they control.
It's possible to do boot verification and attestation without baking in privileged manufacturer keys. If the attestation key were generated and installed by the owner, they could prove everything to themselves remotely, without being forced to prove anything to hostile parties.
If this were the case here, I wouldn't be cheering.
Also note that voting etc could easily be implemented with smart cards (eg SIMs, credit card chips, etc). These are still trusted computing, but are at least limited in scope. Top-down control has no place in general CPUs if we wish to remain an open society.