Hacker News Reader

Comment by brokenmachine | Hacker News Reader

I don't think they reencode it. They've found a way to download it directly. I think they have found a way to extract the keys.

View on HN

Source? It's hard to see how they actually did it when all you have is a .mkv file, but in rare cases I've noticed ui elements/quality drops that was indicative of being ripped via capture cards. Of course, that doesn't mean all rips are done this way, but it's pretty hard to tell the difference between a rip done via capture card done perfectly, and a rip where the underlying stream was decrypted.

I have read a few people commenting that that's how it is done. I read a very good comment once here on hn that described extracting keys from insecure devices (might have been TVs, or possibly an older Android device?), although I can't find the comment now.

Also they often contain every subtitle and audio track (often 40 subtitle tracks!), which would be either a lot of work or not possible at all if they couldn't extract the stream properly. I suppose they might be able to get those from the low quality unencrypted streams but it just seems implausible.

They release shows pretty much immediately as soon as they are on netflix, don't they?

It seems improbable to me that they are systematically recording and reencoding every show manually, although I guess it could be possible in theory.

A friend of a friend tells me that they've never seen UI elements or quality drops on any scene rips.

All signs seem to point to the encryption being broken in my opinion.

>Also they often contain every subtitle and audio track (often 40 subtitle tracks!), which would be either a lot of work or not possible at all if they couldn't extract the stream properly.

Are subtitle tracks even encrypted? Unlike video, there's no secure path (eg. HDCP) for subtitle (or even audio) tracks, so they're presumably trivial to rip.

If you were ripping via HDMI you'd still need to sync them up though. Not very difficult but tedious. I still believe they're using leaked or hacked keys.

e.g. https://github.com/medvm/widevine_keys

I believe this specific method is outdated, but my understanding is that current methods also bypass drm instead of using screen capture.

That gets you L3 keys, which only provide sub-hd resolutions.

There are devices out there with vulnerable TEEs (trusted execution environments), where DRM operations commonly happen. You can then extract L1 keys from those environments - for example with the Nexus 6[0] NVIDIA Shield[1].

[0] https://googleprojectzero.blogspot.com/2017/07/trust-issues-...

[1] https://nvidia.custhelp.com/app/answers/detail/a_id/4682/~/s...

Those keys were downgraded to Level 3 many years ago.

Reply on news.ycombinator.com