Azure Media Services DRM screen capture protection

Question

Referring to: https://social.msdn.microsoft.com/Forums/SECURITY/en-US/c009d689-8f4d-402b-ba16-e498e7b8bda3/does-azure-media-plataform-provides-any-protection-againts-screen-recording-by-mean-of-drm?forum=MediaServices

He says "E.g., if you play Widevine protected content in Chrome browser on Windows, you can still make screen capture.". But how does Netflix prevent screen capture when using Chrome on Windows then? I know Netflix uses Widevine as well.

On a side note: I'm really struggling to setup Azure Media Services DRM protection: https://stackoverflow.com/questions/66198524/how-to-setup-drm-protection-with-azure-media-services-to-prevent-screen-capture

I want to block screen capture on all platforms, and not support platforms that can't do this.

Answer 1

There is a confusion about Widevine security levels: Widevine security level (1, 2, 3, 1 is the highest) and Widevine API security_level (1, 2, 3, 4, 5, with 5 being the highest). The above 2 samples are for API security_level = 1, so they are NOT Widevinne L1. Below is a sample with Widevine security_level = 4 which maps to Widevine L1.

https://openidconnectweb.azurewebsites.net/AMTestPlayer?url=https://eventgridmediaservice-usw22.streaming.media.azure.net/efcb9913-c181-4449-8f04-72522a47587f/MicrosoftElite01.ism/manifest(format=mpd-time-csf,encryption=cenc)

This sample, for example, does NOT play in Chrome since Chrome does not support Widevine L1. It works on newer Android which support L1.

For the exact mapping of 2 Widevine security levels, please see my doc https://learn.microsoft.com/en-us/azure/media-services/previous/offline-widevine-for-android#frequently-asked-questions (the table in the 2nd question of FAQ section).

Answer 2

I'm told that Chrome/Chromium have been progressing pretty rapidly (6 weeks/release cadence) and they have added this support on non-native platform (such as Chrome on Windows).

If you use the AMS v3 API, the default Widevine ContentKeyPolicy (in our doc) should enable this. I don’t think there is a specific “switch” for this. Same for PlayReady, a default feature not intended to disable.

Sample 1: https://openidconnectweb.azurewebsites.net/AMTestPlayer?url=https://eventgridmediaservice-usw22.streaming.media.azure.net/2fa069bd-2b0c-4674-bff7-26ebd6cdc224/MicrosoftElite01.ism/manifest(format=mpd-time-csf,encryption=cenc)

Sample 2: https://openidconnectweb.azurewebsites.net/AMTestPlayer?url=https://eventgridmediaservice-usw22.streaming.media.azure.net/001ac9d4-0cbe-4677-acdc-d5ec5ebed1f1/MicrosoftElite01.ism/manifest(format=mpd-time-csf,encryption=cenc)

What SDK client are you using? .NET, Node.js or other?

Answer 3

The samples you provided do not work (see screenshot)

I tried on:

• Firefox on Ubuntu
• Chrome on Android

Anything cross-platform, as I'm not on Windows

I've tried the Node.js and Java samples from https://github.com/Azure-Samples/ without success

Answer 4

You may want to check with the Device manufacturer - or their developer documentation. I see mentions about Chrome and Samsung Internet on Android on certain devices not protecting against screen capture with Widevine alone.

It may also be a good question for the Google Widevine team to see if their DRM system actually can protect against screen capture on an Android device or not. Seems to be a lot of hits on that topic when doing a quick search.
I'll ask around some more.

Answer 5

As I've repeatedly said, it's all devices not just my Huawei phone. In your sample the security level is set to 1, but it does NOT work.

I should've gotten an DEVICE_IS_PROVISIONED error, but instead it just plays the video on EVERY DEVICE I've tried.