Hacker News Reader

Comment by eru | Hacker News Reader

Does the encryption in DRM protect the metadata?

AFAIK no. The point of DRM is to prevent recording / playing the media on a device without decryption key (authorization). So the goal is different than TLS that is used by the client to ensure the content is authentic, unaltered during transmission and not readable by a man-in-the-middle.

But do we really need such protection for a TV show?

"Metadata" in HLS / DASH is a separate HTTP request which can be served over HTTPS if you wish. Then it can refer to media segments served over HTTP (unless your browser / client doesn't like "mixed content").

> But do we really need such protection for a TV show?

DRM may be mandated by the content owners. TLS gives Netflix customers privacy against their ISP snooping what they're watching.

> But do we really need such protection for a TV show?

What you watch can be a very private thing, especially for famous people.

No, and it doesn't protect the privacy of the viewer either!

FWIW, neither does the TLS layer: because the video is all chunked into fixed-time-length segments, each video causes a unique signature of variable-byte-size segments, making it possible to determine which Netflix movie someone is watching based simply on their (encrypted) traffic pattern. Someone built this for YouTube a while back and managed to get it up to like 98% accuracy.

https://www.blackhat.com/docs/eu-16/materials/eu-16-Dubin-I-...

https://americansforbgu.org/hackers-can-see-what-youtube-vid...

Did TLS 1.3 fix this with content length hiding? Doesn't it add support for variable-length padding that could prevent the attacker from measuring the plaintext content length? Do any major servers support it?

Reply on news.ycombinator.com