[RidingPegasus]

A researcher on twitter recently cracked widevine level 1 quite quickly according to himself. No proof of concept was offered but he seemed to be claiming it was fairly simple. Netflix uses level 3.

The browser has to decrypt it somewhere along the line to play. Always was interested in tinkering around with it.

For a starting point I'd be going through chromium and checking out how they implement widevine.

For a while now there's been rumors in the torrent scene that a few people have broken it, but keep coy in case it gets patched. Then again it's trivial to screenrecord at the cost of time. Who knows?

[gsnedders]

Netflix only requires level 2 for HD streams, IIRC. SD streams can be level 1, I think.

Level 3 requires a secure path all the way to the display (so the decryption happens in a Trusted Execution Environment, the keys are stored in a Trusted Platform Module, and HDCP or similar to the display). Level 3 practically only exists on mobile currently, as Intel's SGX (their TEE) is typically disabled by default on what processors do support it.