1

We want to provide VOD service via http/https, but we dont want users download a video by finding out the url directly from the web player or using a developer plugin like firebug.

We are told that only option for us is to implement DRM to protect video content. Is it true that DRM is the only option? If there are other options, please suggest it. Any expert opinion is most welcome on this. Thanks in advance.

Improve this question
  • 1
    I hope you get this direct-download issue solved. I also want to point out that people can simply use screen-recording software (like Camtasia or even Snag-It) to record the video and audio as they watch it. The video quality will suffer slightly, but not by much. I don't think there is ANY way to prevent that! – BrettFromLA Dec 16 '15 at 23:40
  • @BrettFromLA thanks for the head up. we are aware of such activities, but not worried at all about it. – Yaya Dec 17 '15 at 21:05
  • don't you think youtube would have found a solution to that by now? – jiggunjer Dec 18 '15 at 7:25
  • @jiggunjer keepvid.com lets you download videos from YouTube. They didn't figure out a solution, apparently. – BrettFromLA Dec 18 '15 at 21:01
  • You could let people download the videos, but watermark every video with each user's name, so that you know from whence leaks spring. That, or reconsider your business model, because charging people for static content is a sinking ship. Consider a service-oriented approach. – Jason Conrad Jun 19 '20 at 3:32
4

Unfortunately, no, that's the entire reason DRM exists. It is a bit like trying to prevent someone from recording an on-air broadcast. When you send video data over the internet to someone's player, they can simply store the information being sent to the player unless you obfuscate it and make it so that the player will only work under certain circumstances and will not share the data. This, by definition, is DRM.

What DRM attempts to do is control the reading of the data entirely, so that it can not be copied. This has varying degrees of success and rarely, if ever, works particularly well. It may keep honest people honest, but if you are sending someone data in a way that they can access it, measures to try to stop them from copying it are... difficult. The most advanced systems use special display drivers and encrypt the data right up to the point it is being displayed on the screen (HDCP), that way other software on the computer can't directly pull the information off the frame buffer being prepared for the screen.

There may be some ways you can mildly obfuscate the access to your video, but ultimately, if you send it in the clear, it is trivial for a knowledgeable viewer to store the datastream. If you use DRM, it is substantially harder, but still likely to be able to be worked around by a dedicated attacker.

Improve this answer
  • It is true that no security measure is ultimate. A determined attacker could break into any security system. Taking into consideration of normal users who are having average tech knowledge, I think DRM is the way to go. Thanks for the answer. – Yaya Dec 17 '15 at 20:58
  • @user12305 - yes, but tools are created for people of average skill to bypass DRM. I don't keep up to date on which systems are currently broken and to what level, but in general, DRM has a pretty horrible track record, though it's still better than just being unprotected if you need to try to keep it protected. Just don't be surprised if it fails, especially if you go with poor quality DRM. – AJ Henderson♦ Dec 17 '15 at 21:10
  • got it. would you be able to suggest any good quality DRM? – Yaya Dec 17 '15 at 21:20
  • @user12305 - unfortunately not. I don't keep up particularly closely on DRM technology and it is constantly changing as increasingly severe exploits are found to bypass them. – AJ Henderson♦ Dec 17 '15 at 21:47
1

Another option is single use URL/access tokens. But this could get complicated if the browser uses range requests, which is almost certain. And even then the user could still get around that with enough motivation. DRM is the only really secure way.

Improve this answer
  • Thanks for the input. We have already implemented expiring URL. but downside of it is that url is accessible for non logged in users until it expires. I guess that leaves DRM a better solution – Yaya Dec 17 '15 at 21:25
0

We started using a Vimeo pro account. It has the ability embed a player in a web frame and (I think) prevent downloading. You can specify what domain(s) can load the video file. The dev working on the site was able to remove all the default Vimeo interface overlay elements. It'll go live soon. I'll post the link when it does. I'd love to know if you guys/gals can obtain the file as we've tried to lock it up.

Improve this answer
  • 1
    That's no protection. Do post the link. – Gyan Dec 18 '15 at 4:28
  • This simply stops someone from sharing the URL. There's browser plugins that allow you to download the video when on the whitelisted website. As long as someone know the URL, DRM (encryption) is the only way to go. – Kc Gibson Jan 20 '20 at 5:50

Not the answer you're looking for? Browse other questions tagged or ask your own question.