Comment by judge2020 | Hacker News Reader

Comment by judge2020 | Hacker News Reader

Parent Full thread

To my understanding, Widevine has two modes: L1 and L3. L3 is software protection where the browser protects against most simple reverse-engineering, but sends an unencrypted video stream to the OS' window compositor, so you can still screen record the content if you'd like. L1, on the other hand, requires a full chain of trust, meaning the encrypted video stream is sent to your GPU unit (or TV SOC), and the GPU has safeguards to prevent the OS from being able to capture that part of the screen, and most importantly has a HDCP handshake with the output device.

When a service is selecting which streams your client is granted a license to, if you claim L1 protection, the license request includes a signature from the GPU/chip doing the decryption, so the service will know whether your device only supports L3 software protection, or has a full chain of trust for the content and thus can protects against things like the user screen recording video content. Chances are the contracts rightsholders have with Netflix et al. require L1 for HD or UHD streams, and only allow L3 420p streaming (note that Netflix Originals seem to stream at 720p on L3, at least from what I've heard).

If you are really interested in scraping a copy, the HDCP keys were leaked at some point and you can buy "HDMI splitters <wink>" for ~$30 which will remove the encryption. Now trivially bypassed, and a pain in the butt for everyone else.

That was for an old version of HDCP up to 1080p, right ? Not to mention, capping and transcoding is tedious and will alter the quality. I doubt if anyone still does it as there seem to be better exploits for the determined.

Due to the amount of very high quality files you have on torrenting sites, L1 is being broken already indeed, they just don't publish the methods and devices they are using for that so they don't get patched.

Yes, all the files you see on torrent sites are decrypted using L1 keys extracted from a nvidia shield using a TrustZone exploit.

> they just don't publish the methods and devices they are using for that so they don't get patched.

Well not exactly, it's hard to patch this when the keys leak from a very popular device.

There are splitters that can do 4K 60Hz HDCP 2.2. You had to really search for them because AliExpress used to remove listings that mentioned this feature explicitly. HDFury devices will do HDCP 2.3 -> 1.4 conversion (at which point you can just use a HDCP 1.4 splitter/stripper).

Stupid question: is it also not possible to simply use VGA instead?

VGA won't create that "full chain of trust" parent is talking about. The GPU essentially says if it's outputting to an HDCP (encrypted) output and if so is expecting encrypted input. As an example if you use an HDMI -> DVI adapter or similar you'll get a scrambled-ish looking picture which is essentially you viewing the ciphertext picture.

This is pretty much inherently super lossy, so not a good bypass. You need to decrypt the actual WV stream for a good copy.

Wouldn't the only loss be from the re-encoding, which many webrips do anyways?

> Wouldn't the only loss be from the re-encoding

Which is pretty dramatic, assuming you don't want absurdly large files.

Where do you see webrips in 2022? Looking on BTN, I only see webrips for public broadcast content that literally nobody cares about. Everything else is decrypted streams (WEB-DL).

The big p2p groups with WV keys are decrypting just about everything, scene groups desperate for a reason to exist after getting utterly outdone by the p2p crowd are releasing webrips of content nobody wants.

Reply on news.ycombinator.com