News for hackers. Stuff that matters.

A comment on Requirements for DRM in HTML are confidential. Parent comment

Re:Requirements for DRM in HTML are confidential by captainmuon on Tuesday January 14, 2014 @06:11AM (#7056386)
Doesn't really apply here. When sending an encrypted message, the adversary doesn't know the secret key. With DRM, the adversary is the receiver of the message. You (or your computer) already has the secret in Kerckhoff's sense. It's just a matter of finding out where the key or the unencrypted data is stored - in the worst case by hooking up hardware to the mainboard or the screen.

You could make DRM "Kerckhoff hard", but you'd have to use a completely trusted architecture with secure boot and signed applications - which is not conicidentially where all major players are moving. Even then, there are a couple of loopholes (bugs/jailbreaks, you could tamper with the hardware, or you could just record the signal during playback ("analoge gap"))

[ Parent | on HN ]
Re:Requirements for DRM in HTML are confidential by snarfy on Tuesday January 14, 2014 @10:27AM (#7057497)
People don't seem to understand this about DRM. It's based on encryption, but encryption only allows a secret message between alice and bob, away from the prying eyes of carol. But in a DRM situation, alice and carol are the same person.
[ Parent | on HN ]
Re:Requirements for DRM in HTML are confidential by tripzilch on Tuesday January 14, 2014 @07:00AM (#7056525)
> or you could just record the signal during playback ("analoge gap")

And for that we are striving for newer technologies to close that gap from the analogue side. I'm not being entirely serious (yet), but thinking about Occulus Rift or Google Glass, etc.

Once we get our media/games to jack in directly to our brains, like all the cyberpunk novels prescribe, it's going to be pretty hard to get a tap between the analogue side :)

[ Parent | on HN ]
Re:Requirements for DRM in HTML are confidential by marcosdumay on Tuesday January 14, 2014 @09:03AM (#7057047)
Whatever means you use, you must have an unencrypted stream somewhere, and you can tap that stream.

In your example, just make a computer that pretends to be your brain, and you'll get the data to post at Pirate Bay.

[ Parent | on HN ]