[Hoodedcrow]

Would like to read a writeup on this, I was certain it was going to be something like this from the app's announcement.

Also I recall a discussion on Graphene's forums that DRM ID is not only retained there, but stays the same across profiles.

[coppsilgold]

I simplified the process in my description. The DRM ID Android has is not what I was referring to.

I was referring to the static private key that is stored in the silicon. At any time an application can initiate a license request process using DRM APIs which will elicit an unchangeable HWID from your device. The only protection is that it will be encrypted for an authorized license server private key so collusion may be required (intel agencies almost certainly sourced 'authorized' private keys for themselves). Google or Apple also has the option to authorize keys for themselves. In 'theory' all such keys should be stored in "trusted execution environments" on license servers and not divulge client identities for whatever that's worth: <https://tee.fail>.

[comex]

Citation?

[coppsilgold]

    Content Decryption Module (CDM) in your browser or Mobile SDK generates the license challenge

<https://go.buydrm.com/thedrmblog/the-anatomy-of-a-multi-drm-...>

The "license challenge" (it might be a mistake I think it's supposed to be a license request) is just a packet (that can be saved and later sent to anywhere) and it contains the encrypted certificate which doubles as your HWID. An adversary needs to control the private key of the license "server" the challenge is for (this is a privacy measure introduced to prevent the CDM from offering the HWID to anyone who wants it). Now if you want the HWID you need to work for it (one time) by stealing a private key, bribing/blackmailing employees or issuing secret edicts ("here is a new license server we need a certificate for"). Working for Hollywood is also an option I suppose.

Pirates sacrifice devices when they publish ripped content due to the certificate being revoked after Hollywood downloads the torrent and by doing things like this:

    For large-scale per-viewer, implement a content identification strategy that allows you to trace back to specific clients, such as per-user session-based watermarking. With this approach, media is conditioned during transcoding and the origin serves a uniquely identifiable pattern of media segments to the end user.

<https://docs.aws.amazon.com/wellarchitected/latest/streaming...>