Yar, that's a fallback... if you aren't viewing the page with an iOS device, you'll get the flash player. Streaming via html5 through a regular web browser isn't secure. But as browsers can support flash, there's no need to put out html5 streaming to them... This is about mobile devices since:
1. Apple have never supported flash
2. Adobe are giving up on flash mobile.

So, got to get secure streams to mobiles/pads....

What, NOONE has an AppleTV to test on??? Damn, you lot disappoint me!
Imagine the potential buying power.... HD porn in a secure way on your big phat plasma....

--edit
if someone wants to buy me one, I'll happily test it :P

Works again now. I had to open a new page in Safari. Refreshing alone didn't work.

there definitely is a key sent, otherwise the client would not be able to decrypt the file. in the m3u8 file there's the following field for example:

at best this is perhaps good for preventing people from ripping streams using browser plugins.

Someone else on the wowza forum also posted a step by step guide of easily decrypting the streams:

http://www.wowza.com/forums/showthre...7600#post67600

thanks pstation - I wouldn't say "at best this is good for preventing from browser plugins". It is a real effort to lock down iOS streams.
This is exactly what I wanted testers for (hence the title). I know what every step entails and where keys are sent. The point is is to make it so darn difficult to rip the stream that it won't be worth it.

Sure, if you have an ass-to-mouth exclusive of David Cameron on Barack Obama , then it's gonna get ripped one way or the other. If you want 100% security, don't put it on the internet ;)

Anyways, I see how you did it and so I can probably close that door...
Additionally, I found a bug in the streaming logic - where the request for the key didn't go through the same checks to verify it was coming from an embedded <video> tag.

If you would like to hit me up on email (see sig), I would like for you to test further once I've modified a few things...

It works fine with AirPlay and AppleTV. :)

Actually - I take all that I said previously back...
You didn't get the key at all, just the URL, so there wasn't a bug in the logic. :thumbsup

Sure, I see you got the encrypted chunks but never the key.

that is excellent news :thumbsup
I saw how airplay works now and it really is a restream from the ipad - I was thinking the ipad was simply sending the URL and AppleTV was grabbing the stream (in which case this wouldn't work), but nope - it really is restreaming to the tv
many thanks

bump for a good cause

If ipad users could retest please.... iOS stream
cheers

Android doesn't support m3u8 playlists, however, if you name the playlist simply m3u, the browser can play them.

I tried m3u but it won't work on android 1.5 (the only version I could install on vmware fusion)...

Great what you're doing, content theft really is a horrible thing costing me a lot of money, but anything you display on a video monitor (stills and video) can be captured. In the end if software can't do it people will tap from the signals sent to the LCD screen and record that. It takes one small nerd with electronics knowledge and an iPhone to do that. If people can phish for credit card details using custom electronics they can also build something like that and the chance that someone will still create software for this always remains there. But what you do surely makes ripping very difficult, most people would give up very quickly. But make sure that your legit viewers do get good quality without stuttering or artifacts otherwise there's no point.

And are you in France? If yes, me too, and I have a question for you then, pls mail to euker at almostthelastpage org

Thanks EukerVoorn and to everyone that tested.

The iOS stream is finally locked down solid to only iDevices. Thanks for all your help and those clicking on the iOS stream from various iDevices - the logs certainly helped me a lot.

If anyone with a non-jailbroken iPad could hit the iOS stream, I'd very much appreciate seeing if you can stream. This is the only iDevice I haven't tested with since the last few modifications made and I want to make sure it doesn't lock the iPad out...

Jailbroken iPads and iPhones using some 3rd party browser will probably not work.

Porno jew is very rippable

Thanks Barry for the kind words - on that streaming page is a culmination of a lot of hard work to make flash-streaming secure (what you see on non-iOS) and iOS HTML5 streaming secure.
I would go so far as to say the iOS streams are actually *more* secure than the flash streams, because they cannot be ripped by screen rippers due to the iOS platform. It really is very secure.

The flash stream identifies screen rippers by injecting user-identifiable information to identify the screen ripper. NB: the iOS test page in this thread uses flash vars to tell the player when/what to inject. This is purely for my testing, and the players I now deploy have that embedded within them to prevent tampering with flashvars.

There are a few more sprinklings of smarties to add on to make it even that bit more impossible to crack that I can add for live deployment, but this is (I think) as good as it gets - exactly what you say: make it the most damn difficult to rip to level the playing field against the pirates.

It's about god damn time this industry stopped playing catchup and take the lead. And you know what, it was a phrase like that a couple of years ago on this board (by whom I don't know), that said something like "at one point the mainstream looked to adult for ideas, now we are just a joke" that made me sit up and figure out how to deal with this piracy issue. fwiw, I am not doing this for financial gain.

HTML5 is going to be the way forward for sure, but as it stands, only Apple has implemented its own standard and locked it into its engine, meaning others (ie what I did here) to lock their standard (no-piracy) into their engine. Kudos to Apple for that. Until other OS' do the same, HTML5 will be an insecure method of streaming.

Finally, there is not a single browser plugin out there that can rip the streams I implement on the sites of my clients... And there is not a single off-the-shelf ripper out there (beside screen rippers) that can do the same. Of that, I'm sure.

???
What has that got to do with the price of eggs?

It's a bot. Just ignore it.

Borked, I like what you're doing and I like your view on things even more.

I don't really get this? are you assuming the devices are not jailbroken? or you assuming they don't have $30 hd capture card with a $5 passthru adapter? You can't protect video it's just not possible, it will be ripped. If i can hack apart netflix to stream in korea I can hack your stream even if it meant pulling the key from the jailbroken device.

Bump for a good cause indeed.. I seriously think it's impossible. That said we have a pure video site coming with hd content and any protection is something.

Sell it if it works!

Was hoping this thread would take off.. Intrested in this I am.
We have access to apple tv as part of a project we do; all devices really.

Obviously can't spend much time but if your in a pinch we can try some urls for you.

Radik,
Like I said earlier, nothing is impossible. Nobody believes anything on-line is 100% secure and if they do, they are a fool.
The idea here is to take the advantage back. These methods will stop the *huge* *vast* majority of the pirates. And by injecting identifiable info into the stream will then identify them.

The AppleTV was demonstrated earlier in the thread to work, which is great. When combined with the auto-detection of bandwidth you can then stream the highest quality vid to the iOS as for the apple tv, the device will be on wifi.

However, please test the stream on an iPad please. And if you are game to hack the stream and put the resulting vid online, then my logs will prove invaluable to me.

btw, that isn't ripping the stream, that's decrypting the video chunks from the jailbroken device's memory, which is hacking. And for 1 chunk for 10 seconds, there's a lot of chunks to decrypt, and with each chunk having its own key, that's a painful process....

like I said, make it a very difficult process and you've taken back control of the game.

tried and tested and ready for the wild!