Comment by scoopertrooper | Hacker News Reader

Comment by scoopertrooper | Hacker News Reader

Parent Full thread

I can't see them changing up their APIs in any meaningful way. It'd seem kind of pointless to me. At the end of the day, if you're exposing something on the internet, then it won't take a huge amount of time for people to reverse engineer how web clients interact with the server.

Main game should be rotating the L1 keys. I don't know about L2 keys, but rotating L3 keys seems like a lost cause to me, some dude made a Chrome extension that can extract them.

Some theorise that Microsoft's Pluton/TPM antics with Windows 11 are a ploy to bring L1-style keys to the desktop.

https://www.extremetech.com/computing/317512-microsoft-pluto...

https://www.anandtech.com/show/16269/microsoft-pluton-hardwa...

You can't really "rotate" L1 keys without breaking HD playback on millions of old vulnerable devices and pissing off a ton of legitimate customers in the process. A hardware vulnerability can't be fixed with a software update. Instead, nowadays when a key is leaked usually Google just revokes the key of the unique device it was extracted from and not the entire model. But major streaming services often blacklist or limit playback quality on known compromised models.

As for L1 on desktop, Google did announce exactly that [1], but TPM would be likely too weak for that, so maybe something like Intel ME would be used. But so far there's no evidence of them actually rolling anything like that out. So for now if you want hardware DRM on desktop you have to use Edge or native Windows 10 apps with PlayReady DRM.

And about the APIs, streaming services do sometimes change up APIs, make old app versions stop working, etc., but often things work with no or minimal changes even years later. They do have to be careful not to break compatibility with all of their own apps across multiple platforms as well.

[1] https://web.archive.org/web/20210819093936/https://widevine....

Here is the plugin: https://github.com/cryptonek/widevine-l3-decryptor

Reply on news.ycombinator.com