Hacker News Reader

Comment by agilob | Hacker News Reader

>Will this break Netflix/YouTube/AmazonVideo?

>No. This does not break or limit access to subscription services or other DRMed content.

I can't run Netflix app on rooted Android, but could on a rooted TV. I guess this isn't something Netflix was prepared for.

View on HN

You can also watch pretty much anything on a "rooted" computer (i.e. one where the user has admin access). I'm not entirely sure why phones are the one device where that's somehow considered a big deal.

But Netflix only allows 720p on computers because of this. So there's that...

I thought that 720p was a linux limit, AFAIK on macOS and windows at least you get 1080p, but sucks that you can't watch in your fully capable hardware in a good quality. Amazon does the same.

Not on my gear (all Linux). Also, what do you think Android is?

720p is non-widewine-DRM limit afaik. Free as in freedom distros don't have proprietary DRM that would allow you to watch more than 720p by default, but you can install the proprietary blobs and get higher resolutions.

You need widevine to play Netflix at all, and widevine is always proprietary. It has a few modes though, L3 is software only (easier to crack) and it's commonly limited to lower resolutions. L1 uses hardware to decrypt and will only output video over encrypted connections (like HDCP). Since L1 is harder to crack you need it to get the full resolution. I don't think there's any implementation of L1 for Linux other than for android and probably some custom embedded ports. There's also L2 but idk what that does.

> You need widevine to play Netflix at all

No you don't. Safari doesn't support Widevine at all for example.

Oh right, I forgot about FairPlay and PlayReady. They exist too, and you need some DRM system to watch Netflix regardlesss.

Incorrect. I can watch 4K on my PC just fine using Edge or the Windows App, you also get 4K with Safari.

https://help.netflix.com/en/node/13444

that's interesting. I wonder how Netflix detects that. would it be as simple as using an Edge user agent, or more complex using the Edge browser engine with embedded DRM keys

Edge supports Microsoft's PlayReady DRM and Safari supports Apple's FairPlay DRM, both of which are stronger than Widevine.

are each of those tied to their implementors? or can they be used on any supported OS and hardware like widevine can?

All of them have varying levels of secure implementation, and services will usually only send high resolution content to devices that can demonstrate (with signed keys) the more secure options.

Including Widevine. Widevine Level 3 is a software based solution that can be used on a variety of platforms, but the space for Widevine Level 1 requires OS and hardware integration (which doesn't include Windows for example, but is available for Android if the OEM does the requisite work).

it's a shame. really don't understand the thinking behind it. it's easy for them to detect and ban shared accounts, but it's also easy enough to rip a decrypted stream, even if it is only at 1x rate. not sure why they bother. I suppose their recompense for piracy comes from those manufacturers willing to pay them for signed keys in exchange for hassle-free compatibility

to get 4K resoltution with Edge on Windows, you need to activate VBS (Virtualization-based Security) and Secure Boot. In that config, DRM keys are stored in a trusted application in secure world, and Edge from normal world ask the TA to decrypt the stream.

Server side Netflix has nothing to do, just send out the encrypted stream if asked by a client.

if asked specifically by a proven Windows client with VBS and secure boot enabled? or could the same method be implemented on any OS?

The entire graphics chain needs MS signed drivers, so no.

(Netflix do the same thing on MacOS with Apple signed drivers, backed up by hardware based security.)

thanks for the info

Important to note you need a very recent version of Safari. If you are using an older MacMini as your HTPC, your Safari version may not be new enough. I found this out the hard way. Edge on macOS works though.

That's funny. Wonder if there are any DRM keys that can be extracted after root.

If there were they would be revoked.

I guess their WebOS app doesn’t have root detection.

What happens if they add it?

They only add it on mobile devices were you can download the content to view it online as a decryption key has to be stored locally and the content producer don't want them to facilitate piracy /backup copies.

Yet!

You can run Netflix on rooted Android, you just have to hide root from the app

the operative word here is "just"

As someone who has hid root from banking apps in the past, there is no just here. You need to keep up with release notes of software updates in several components (custom OS, magisk and any roothide mods you use). That's fun to do for a while, but not long term. And definitely something I wouldn't expect from the mythical average user.

I agree, but the average user doesn't generally root his android phone. If you have the technical abilities/motivation to root your phone, you may have the ability to use MagiskHide and manage an exclusion list in Magisk.

I agree, it's not for the average user. I'm happy to root my android (mostly because android backups really suck otherwise) but would definitely not recommend it to most people. I think it took me an average of 2 hours every 6 months to keep hiding root correctly.

> you just have to hide root from the app

No longer going to be possible due to hardware remote attestation.

Reply on news.ycombinator.com