Hacker News new | past | comments | ask | show | jobs | submit login
Netflix confirms it is blocking rooted/unlocked Android devices (androidpolice.com)
212 points by msq on May 14, 2017 | hide | past | favorite | 219 comments



Anyone who roots their phone, in all likelyhood, knows how to pirate the content: granted Netflix is way more convenient, that's why I pay them. I don't watch on mobile devices so this doesn't bother me. If I did watch on mobile and I had a rooted device, they would definitely stop seeing my money though. When will these companies learn to stop going after the nerds; we're the one who actually know how to get around you if you piss us off.


I believe those that are using Plex with sonarr and radarr and a newsgroup sub have it just as convenient as Netflix except with way more content. After it's all setup of course.


Can confirm that I have way more content than Netflix (currently clocking in at around 125TB, I may have a slight problem). I cancelled my Netflix account after all that no-VPN bullshit. I like my privacy, thank you very much. I've to admit I quite enjoy when friends come telling me that tv show XYZ isn't on Netflix any more, asking to be added to my Plex server. Every single person cancelled their account after a few days of having access to my library. I don't even like pirating, I'd like to pay for my content (provided I like it) and often I do buy the DVD/Bluray just for it to sit in it's packaging in my basement collecting dust.


hope Kevin Grahl isn't your real name if you're pirating... I think if I were advertising that fact, I'd hide it...


The copyright mafia should not have that kind of power that you're assuming they have. I pirate too. I don't use any legal service to watch content or listen to content. I don't have the money to do so, so I pirate. I wouldn't've paid them if I couldn't pirate, I just wouldn't consume the media. If I like an artist or a movie I'll buy their content but I usually cannot because there's no place to buy it in my small village and it's far away from cities that have DVD stores. Most people in the country pirate. And most online stores don't allow Serbia as a purchase country so... TPB here I come!


If he's in the US and doesn't say what he pirated, no one would have standing to sue him, yarr. Now matey, if he been caught pirating a specific work with otherr evidence, then a statement like this would be walkin' the legal plank.


It is, and honestly I don't even care.. It's not like I'm making any profit by sharing my library and I don't have any moral issues with torrenting. As I've said above if I do like something I buy it afterwards with the only intention of supporting the industry.


I just said this because I know for me, I don't like to publicize any potentially gray things I do, simply for the fact that I don't trust any government, rather be safe than sorry, never confess to pirating, and always use VPN's, etc.


Fair point and I do appreciate that you took the time to comment on what could've been an unwanted slip.


Iirc the recent prosecutions focus on distribution rather than use.


He did also just confess to distribution though, via his Plex Server.

The gleeful attitude many have to pirating makes me sad. I've downloaded shows too, but whenever possible I use legal methods to watch. I believe it is content worth paying for, and if a show disappears from Netflix it's probably available somewhere else. It's at least worth checking before you go to your friend for Plex access.


I always appreciate the occasional poster with a gleeful attitude towards copying. I wish there were more people like him such to change the public's view on pirates.


Torrents will also distribute content unless you are leeching, which the GP is implying via sonarr/radarr


>"I cancelled my Netflix account after all that no-VPN bullshit."

I guess I missed this story. You can no longer access Netflix via a VPN? I would be curious to know how they are detecting this. Does this mean you can not access your Netflix content when you take a trip abroad?


It used to be the case that with a VPN you could access content only available in other countries. They cracked down pretty hard on that last year.


Right, I am curious if you can still access content in your home country via VPN from overseas?


How could they know that ? They just block every VPN possible.


GEO-IP. If the GEO-IP matches the country I am a Netflix customer in.


Nope. If they suspect you're connecting through a VPN they just block your connection.


Heck, they block you if you use Hurricane Electric's Tunnel Broker to get IPv6 connectivity, even if the endpoint is in the same country and even though a) TB clients have unique subsets and b) IPv6 geolocation is unreliable shit.

And that's on top of the pathetic selection when you're trying to be honest with them and not fake your country. Screw that.


Interesting. The US now has ISPs that are allowed to track their customers and so people are forced to use VPNs to have a basic level of privacy and at the same time Netflix(and I imagine others will follow) are mandating you can't use a VPN.

This is a pretty crappy situation and I guess you can vote with your wallet.

I am surprised that Netflix which increasingly relies on their own content would feel the need to placate this Hollywood greed?

I'm also curious what heuristic they are using to decide if I am on a VPN?

EDIT:

From: https://torrentfreak.com/netflix-vpn-crackdown-a-year-of-fru...

>"It is still unclear how Netflix’s IP-blacklisting works. A few providers have noticed that some of their IP-ranges were already banned before they were active, suggesting that Netflix automatically flags IPs from certain organizations"


How do you host this setup? Any howtos if I wanted to run a service for my family?


Personally I use Amazon Cloud Drive for the unlimited storage, there's a guide to set that up here: https://www.reddit.com/r/PleX/comments/58uhmo/guide_to_using...

Then once you have Sonarr and/or Radarr setup for TV/Movies you can use something like Ombi to allow family/friends to request content and have it automatically downloaded and added to Plex.


What kind of Internet speed do you need for streaming 1080p without transcoding?


If you encrypt the videos, then do they count as free in Amazon Cloud Drive?


I don't think that you are allowed to encrypt data on ACD.


There are a bunch of people over on /r/DataHoarder who have hundreds of TB's encrypted on ACD, some even hit a PB. As long as you're not downloading too much they don't care how much or what you store there.


Is the encrypted storage free on ACD?


TERABYTES? I didn't know that much TV _existed_


Terabytes is nothing. If one movie is a couple of GB, a thousand movies will be a couple of TB. Since 1900, there have been on average 2500 movies released per year (the early years were quiet, recent years are closer to 10,000).

So 2500 movies per year time 100 years time 4 GB per movie is 1 million GB, 1000 TB or 1 Petabyte.

And that's just movies. If you also want TV shows, it's probably going to be several times that (though until recently, they were produced at lower resolution).

Still 125 TB is a lot.


2500 movies a year? Who has time for that? Are there seriously people out there trying to download and store every movie released in 2017? I don't think I'd even approach watching 1% of the movies released in a year. I'm often playing catch up, watching ones from a few years back that I haven't gotten around to yet.

I often think our resource usage as a species is insane. In an age when you can download anything in minutes at any time of the day we (well, some of us) fill terabytes of hard drive space with endless duplicates of movies and tv shows we'll probably never watch, albums we'll never listen to and more recently books we'll never read. And that's just digital, don't get me started on raw materials


Oh there's way more than that... My, I mean, my friends server is about the same size and stuffed full of tv. Not even close to having s complete library.


MY friend thought he was doing well with an almost full 2TB drive, which also contains movies. But then again most of his stuff is 480p.

He has a 42" tv and from 12 feet away he finds it quite difficult to notice any difference with HD. Maybe he's alone in this?


I personally can't stand anything below 720p, the majority of my content is 1080p, x265, 6CH, 10bit wherever I can get my hands on it.


I find if the story is engrossing enough the quality doesn't really matter too much.


For tv shows, he's most likely fine. The only instance where I personally need HD is watching hockey because the puck is so tiny.


Heh... I've been re-encoding a lot of mine to HEVC, and some things lowering the quality a little at the same time to get back some space... I do with nvenc had a bit higher quality, but the speed over x265 is so colossal I use it anyway. Most TV content as I watch, I'll nuke.. stuff I really like, I'll keep and if not already hevc, I'll re-encode.

Fortunately, I don't get too much from say 1080p over 720p, and hevc at 1080p seems to do very well, even at the lower quality (relatively) settings... so I'm getting 1080p content saved at file sizes sometimes half 720p avc.

In any case, I still pay for netflix/amazon, just got an NVidia Shield TV and love it so far (though had considered DirectTV Now, but they don't support Android TV for no reason). I cut the cord a while ago, and other than the Superbowl (next year just going to a bar), haven't missed it.

May setup Plex eventually as well, for now, kodi over the lan works great.


If you cared about the Super Bowl that much, couldn't you just get a tv tuner card to use the OTA broadcast?


I tend not to buy stuff I know I'll only use once a year, if I can avoid it. I'm in a relatively small (by american standards) apartment, and would rather have space for a new kitchen gadget, which I also avoid at this point.


> the speed over x265 is so colossal

Encoding speed? Does it really save that much space?


Encoding speed of x265 (if you haven't got a very recent graphics cards) is really bad, but files are around 40-60% smaller than x264.


> 40-60% smaller than x264

Holy crap. Is that using Pied Piper compression or something?


h.265 (HEVC) compresses fairly differently, the modes and fallback methods are also better the higher the detail (dimensions)... with x.264 (AVC) you get pixelation, with HEVC you get blurring... for a 1080p or 4K output, this is MUCH more pleasant to watch and allows for some shortcuts that aren't as noisy.

One of the first things I noticed when first seeing DirectTV and DVD quality, for example was the pixelation of things, usually in the background... to this day it sometimes distracts me... that alone is about enough for me.

The way regions are selected for compression is also better, but I'm not into the technical details enough to explain well... all I know is I can get about 5/3 to 5/2 more content in HEVC while at an equivalent or better quality. So yeah, it's a big deal...


That's nothing, head over to /r/DataHoarder to see some real champs.


Down votes? Did I upset someone?


Can confirm, Sonarr+Radarr+NZBget+Usenet+Plex+1gb-internet and I have everything I need at a moments notice. I pay for Netflix and Amazon Prime for convenience and proper subtitles, that's literally the only reason.


Is radarr a couchpotato replacement? Any reason to prefer radarr?


radarr is couchpotato and sonarr in one.


could you give more info for a newbie trying to learn more/get into using these?


So, there are 3 parts to such a system.

The first, is a 'searcher'. Here, that is sonarr (for finding TV series) and radarr (for finding movies). There are some alternatives. Most notably couchpotato for movies. You simply tell these programs what you want to see, and they look through torrents and newsgroups to find that content.

Next, you need a downloader (or 2 if you use both torrents and newsgroups). For this, it is important that your 'searchers' can talk to the downloader, so things happen automatically. Basically anything should work here.

Finally, and optionally, there is a viewer. Plex is the biggest here. It allows you to view your media anywhere with an internet connection, it also tracks your library, and what you've watched. You can set up your searchers to export all downloaded files to plex.

For starters, I'd set up a simple searcher-downloader system, and build up from there.


I used to have a setup like this and those described in other comments, but it just became too hard to worry about. Synology updates breaking things, missing parts on newsgroups, etc. I've replaced it with Netflix and occasionally paying for specific content not available there (like Westworld). It's just 10x easier and about the same price anyway. I fly enough that I get to watch all the movies I want to on IFE. I just don't have the patience or time to put up with the inconveniences of piracy any more.


the maintenance of such a setup is still prohibitive. hardware failure is really annoying.


A download utility like put.io and a nice search site like skytorrents.in seem to do the job pretty well. As a bonus I can get subtitles or not, Vs whatever Netflix decides. And there's a wider selection of content. And streaming will start in high def. And I can use a different player if I want audio or brightness boost. Plus I spend less time endlessly browsing a catalog.


The thing is that Netflix doesn't really care about "the nerds". They don't need to. I'd wager that less than 0.005% of their user base will actually care enough about this to cancel their subscription. If these changes mean that their content is harder to get and less technically inclined people become paying customers, then that hit is totally worth it.


If they don't care about the nerds then why bother with blocking rooted devices?


Helps their negotiations with content licensors.


They won't be too successful even, look at what's happened with Google's own SafetyNet, it's trivially bypassed using several commonly available tools.


Nerds work for them to make their platform working.


And they compensate them quite generously. I don't think something like this would've the reason you'd say no to $350k+ salary to work for Netflix. You'd probably get over it.


Customers come before team and ego every single day of the week. If you don't believe that and aren't prepared to do things that have biggest positive customer impact, you should resign immediately.


What the customers want and the "biggest positive customer impact" are often not the same thing. Especially with bad clients.


The customer is party who pays you. From that perspective, they are the same.


Party with a need for faster horse?


The biggest loser here is likely the Chromecast. I use my phone to push that all the time, but I'm not about to unroot my phone just for Netflix.


Ostensibly what they want to stop is it becoming popular to root a phone to record content.

I imagine the number of people that care about rooting their phone is small enough that it doesn't really matter to their revenue.


Netflix is likely to loose more money from unsubscribing than revenue lost from the increased ability to pirate.


And what about non-mobile computers, which are (almost) never locked down? Why single out mobile?

I prefer watching Netflix on my TV rather than a tiny phone screen, but if I did want to watch it on mobile, I'm a bit worried how they might treat my Fairphone.


Netflix allows downloading only on their mobile apps


> When will these companies learn to stop going after the nerds

I believe they are not specifically going after the nerds. They need such heavy protection only because otherwise some nerds will make circumvention tools which the average person will then use.


Knowing how to pirate is quite different from being able to pirate easily. Torrenting is a small niche now (at least in the US) because of ISP DMCA notices etc., whereas billions of people own smartphones worldwide. If someone releases a netflix-ripper app, it would quite likely see a higher adoption than bittorrent.


A netflix ripping app would surely be banned from the Play Store, and would still not be able to solve the content distribution problem. Netflix doesn't care if you rip content, they care if you try to distribute ripped content to others, which is really only feasible with bitttorent or similar.


It doesn't have to be on the play-store. Also, netflix cares more about ongoing subscription than re-distribution. So if I rip a sizable chuck of what I want to watch, I won't renew my subscription.


What's to stop Netflix from uniquely forensically watermarking each user's streams? If anyone person starts to rip their streams for redistributing, then it will be easy enough for them to determine which user it was and block that account. The small number of people that would be able/willing to rip would be easy enough to track down.


Blocking accounts would just earn you an extra $12, not solve the problem. So you'd need to actively prosecute, and account sharing is so rampant that is going to quickly lead to terrible press.


They wouldn't be able to recoup damages from lost (potential) revenue from the cat (content) coming out of the bag (walled garden), even if they identify and go after the rip sources.

You can't expect to be able to collect a 9+ figures from a random individual


Just use a service like put.io for your downloading and torrents are suddenly easy again. With the Android app, I search, click the magnet, put.io pops up, the transfer is usually instant (due to dedupe), then I click stream.


How would a Netflix ripper be popular at all? You would have to pay the Netflix subscription + it would have no benefit over pirating.


define pirating, because it's legal in many parts of Europe to watch copy of movie even if you don't own original, it's illegal to upload content, it's legal to download it, so sites like fmovies.se gomovies.to and million other clones (which are actually using Google video to host their copies) are legal for their users


> Torrenting is a small niche now (at least in the US)

Could have fooled me.


> I don't watch on mobile devices so this doesn't bother me.

Nor do I, but the app was useful for sending the video to chromecast.

That said, I find chromecast painful and restrictive in terms of streaming content from other regions using VPN. Chromecast is very uptight and locked down to your native location. I stopped using Chromecast for that reason after not finding a workaround. When I was only watching my region's content (Australia) the Netflix app was useful. Unfortunately, Australia's Netflix content library was too weak, so I needed other regions to make it worthwhile.


I gave up on this sort of thing ages ago because it just wasn't worth the hassle, but the nerd in me likes a technical problem to solve, so...

With a decent router you could configure it to connect to the VPN of your choice and then route requests from your Chromecast's IP over it. The Chromecast would probably not know the difference, and you can also route anything else over whatever VPNs you like.


This sort of thing doesn't surprise me from Netflix. It has been tightening up its rules for some time.

I dropped Netflix after whoever is in the group that decides policy for Netflix decided that Hurricane Electric's IPv6 tunnels are "a VPN" that is being used to circumvent Netflix's location checks with no warning.

(I'm aware of the DNS tricks I can do to only return IPv4 addresses in response to queries for the netflix.com zone. I choose not to do them and, instead, to not avail myself of Netflix's content.)


Yeah they seem to be moving to newer, platform based security/drm models across the board.

For instance my HTPC has an Nvidia 1050ti card and can do UHD colour 4k output. I can play UHD test files just fine.

But the Netflix app won't show me 4K content as they require you to have a Kaby Lake CPU, which has some new hardware DRM module built in.


> Netflix app won't show me 4K content as they require you to have a Kaby Lake CPU,

So we've gone from "this website works best in Netscape", to "this website works everywhere" to "this app requires you to have a specific motherboard".

Sure sounds like progress. Who do we have to thank for this?


the man!

(i just have no idea how to get enough people to care about this kind of stuff to matter, and even if I'm the one people come to for recommendations, I can't in good conscious recommend the platform/device where netflix won't work)


Oh, the Intel Management Engine :)

Now quite a lot of eyes are on it after the recently discovered AMT vulnerability so we will see how good this DRM thing is in practice. Can't way for the day Netflix will start demanding running the latest BIOS version to patch DRM bugs.


They also want you to use Edge or their UWP app just to be able to get 1080p content, because of DRM.



Who is this trying to stop? People that rip their content? Because those ones certainly have other methods to do it (e.g. record video out).

If they're targeting consumers, why do they give a damn if the phone is rooted or not? As long as they pay netflix to stream the content to them?

Or is this "just" to prevent fake locations and such, to please their content producing/distributing overlords?


Netflix doesn't care. They drag their feet on this kind of thing as much as they can. In the end, though, they do this so they can keep their licensing agreements with content creators.


This. It is 100% about being able to license more titles. Many people forget what the early days of Netflix streaming was like. Remember when you needed silverlight to watch on a computer? Remember when you couldn't even get Netflix on Android? Netflix has come a long ways since those days, and they have done a LOT in moving forward fair-use expectations for digital subscription content.


Netflix loves doing DRM stuff "for the studios" as it creates a barrier to entry for other players. If Netflix pushed the truth that DRM doesn't matter, then a competitor might get a studio to sign a nice deal with them.


Ya, because studios want (require) DRM. My point is that Netflix has done a lot to reduce the obnoxiousness and hassle of DRM compliance.


Name one thing they have done


I'm not so sure. They now produce a ton of their own content which they may want to protect.

That content is not broadcast with DVB, it's not distributed on BluRay.

To that point if they can prevent there being a way to rip the raw video bitstream from the handful of platforms they do support, then they can prevent their shows being pirated (at least in full quality.)

The licensing of other content was definitely the reason they locked down the geo streaming though 100%.


Probably to appease the studios.


That's google essentially rendering the value-proposition of their bootloader-unlockable phones to be a negative one.

Wth would I pay extra for a Nexus/Pixel if unlocking it causes all Android software which uses DRM to start failing due to "not being compatible"?

Might as well buy a Samsung then. Or even better: an iPhone.

It's no longer your device anyway.

And to think Android was once open source. Now it's infected with DRM all the way down to the bootloader.

Such a shame. There are no free devices anymore.

Edit: to clear I've always been OK with DRM in apps (as opposed to HTML) because that clearly isolates it from the general purposey bits of the platform. Seems that's no longer the case with Android.


> I've always been OK with DRM in apps

You want to eat your cake and have it too. DRM is technically impossible, so problems like the one you described are inevitable. Bummer, I guess.


Can you expand on why DRM is technically impossible? I don't disagree but I'm wondering about your reasoning.


"Impossible" is a bit rhetorical, although in principle the content has to be decrypted to be seen and a Sufficiently Sophisticated Attacker can always somehow extract the decrypted data from the device, in more practical terms this can be made pretty much arbitrarily difficult.

What I really meant is that making DRM difficult to crack generally goes against owner control over the machine. The more control you have the easier it is to simply copy the decrypted data or at least attempt exploiting some bugs in the DRM engine if the former is impossible. So we see things like signed bootloaders or dedicated "secure" cores running alongside normal CPUs with some secret firmware on them.

In particular, it seems that Android's DRM can be subverted by the bootloader (presumably it uses the ARM TrustZone extension, which is configured by the bootloader and then locked away from the OS) and hence the OP has to choose between DRM and unlocked bootloader.


It's about trying to preventing you from accessing encrypted content while having to hand you the key somehow.

They are giving you access, so somehow you should be able to get the stream should you want to.


If DRM is technically impossible, then encryption is technically impossible too... yet we use it.


DRM is data asking "dear program, please don't let to copy me". It falls apart the moment you have anything to interpret data that doesn't honour this request. Encryption, on the other hand, is a technically sound idea.


Actually the Fairphone is quite free. Unfortunately the Fairphone 2 isn't rooted by default anymore, but you can install an alternative (official) Software. Like with the FP1 you must even opt-in to install Google Apps. I can only encourage you to support the project. Even though not all parts of it are free yet, if you check out the young history, you'll see that it has the clear goal of providing a truly free (and conflict free) phone.


The way this message will translate to the nerds|power users|hackers|rooted user|content creator|

"Netflix does not value your money, therefore you cannot use our services. However, you can always pirate the content on Internet for free."


Why bother with content that is difficult to access, when you can watch one of the billions of other videos and streams available on YouTube, Twitch, Vimeo, or any other website.

If a content owner wants to make access to their content difficult, why should their content be relevant?


Can someone explain what is it about some crappy shows and Hollywood movies that it deserves such invasive attacks on device ownership?

When Microsoft tried Secure Boot there was a huge outcry. But when HBO/Netflix/Verizon/WB demand a complete lockdown of your device (to the point where AACS 2.0 demands you have a special CPU, Motherboard, GPU and more components that lock you out and disable themselves if you use custom software/drivers), then suddenly even on HN I see a huge amount of people defending a complete lockout from your device to the point where you're not allowed to even install a custom, better, driver.

What is it about some shows/movies that would be SO DAMAGING to whole society if a few people would be able to copy them on another device or even give it to a friend?!


The funniest thing is, it doesn't even protect the shows and movies. They're still widely available. So this only impacts legitimate, paying customers, and doesn't impact pirates at all.

Who benefits? The people that make this DRM tech. Who I'm sure make all sorts of claims about how this time, it really will solve the problem...


> AACS 2.0 demands you have a special CPU, Motherboard, GPU and more components that lock you out and disable themselves if you use custom software/drivers

That's a standard I have zero knowledge of, because I have absolutely zero intentions going down that road for any reason what so ever. And I wish that would apply to much more people!

My PC represents the last bastion of true computing freedom, and I'm not giving up that, just to be able to watch some movies in a freaking web-browser.

(In the name of pragmatism and not being a complete neckbeard, I have separate, unfree, locked down devices for that specific purpose)


AACS 2.0 is a DRM standard used in UHD/4K Blu-Ray disks. It requires the device to call home via internet to retrieve the decryption keys for the BR disc you're holding in your hand. You need a full stack supporting DRM (including a CPU with ironically called "Software Guard Extensions"). At this point there's obviously no way of playing back these on Linux or non-whitelisted hardware, which is an issue because they're the only source of truly high-quality 4k/HDR content (the videos are encoded in 50+ MBit bitrate as opposed to HDR content on streaming services which barely gets to 15Mbit and is therefore not really much visually different than fullHD content).

Also, I've just noticed that Netflix on the web demands to "verify my hardware" (on Chromebook) to determine if my laptop is properly locked down for video playback. The DRM assault is getting worse, not better.


Thanks for the detailed response. You mentioned:

>"AACS 2.0 is a DRM standard used in UHD/4K Blu-Ray disks."

How does this relate to the context of streaming from HBO/Netflix? Are these companies offering 4K streams on their services?


They offer 4K streams already, but they don't use this DRM standard. They mostly now use Widewine or some similar which is also slowly pushing to the same restrictions as AACS 2.0 on BR discs has.

It was more demonstration of a trend.


Netflix does offer a 4K streaming tier for a few dollars more.


Would love say, if I had enough control over my tablet to not tell youtube when my screen was turned off, so they can't force me to buy youtube red for "background listening" the free lectures their users kindly upload for them, like they've recently started doing. Is not reporting that my screen is turned off considered pirating?

I for one am shocked that their monopoly position has resulted in such behavior.


Use firefox. Problem fixed.


Not Firefox on iPad at least. The previous fixes of watching in private mode and watching through 3rd party sites seem to be blocked now as well as far as I can tell.


> What is it about some shows/movies that would be SO DAMAGING to whole society if a few people would be able to copy them on another device or even give it to a friend?!

American society worships the ultra-successful like cults - the cult of the millionaire - pro athletes, singers and actors.

Hollywood and it's products, therefore, are sacred.


Isn't it possible for a rooted device to fake beeing a non-rooted device to (selected) applications? To my understanding root means having the full control but I fear that this definition doesn't apply to smartphones.


Yes. It's an arms race.

To detect root, apps will try something like attempt to call su. If you're rooted and don't want the app to detect it, you can jail the app and prevent it from being able to detect it.

Note that this is in theory. Almost all apps will implement root/jailbreak detection using the same crappy method, just like almost all of them use the same crappy method to detect if e.g. cert pinning is active. But some will use a very clever method that is not widely known and not well-documented.

While it's true you can theoretically defeat any of these checks, in practice it (like most of reverse engineering) can be made incredible complex and difficult. For example, Facebook/Instagram have (as of the last time I checked) a complex custom system for checking if cert pinning has been bypassed, such that you can't just return-void the checks very easily.


Obviously I don't know the implementation details of how Netflix is detecting rooted devices, but my guess is they're using Play Services's new "GMS Certification".

This involves using signed hardware that helps determine if the execution environment is trusted. So, users can still root the device, but Android + Play Services can still determine if features (such as DRM) can be relied on.

It makes sense for Google to develop these features, especially as it wants to move Android to new devices (Cars?), reduce risk for mobile payments, in addition to giving stronger security features to content distributors. This also lets Android devices compete with security features like Apple's secure enclave.

Honestly, if you are going to root your device you must accept you are not using it in the supported way the vendor intends. Therefore, you should not expect all the features of the supported configuration. I think that's a fair trade-off. Rooting your device is awesome!


I think it's actually the SafetyNet Attestation API. Checking for root means requiring "certified, genuine device that passes CTS". It also excludes "genuine but uncertified device, such as when the manufacturer doesn't apply for certification". https://developer.android.com/training/safetynet/attestation...

I was reluctant to unroot an old phone to try Android Pay, but having to do it just to watch some movies a tad too far. For me anyway. https://phunehehe.net/xperia-android/


My Nexus 6p is running the latest purenexus room, so it is unlocked. Before I rooted, I installed both DirecTV and Netflix and logged in to both. Rebooted recovery, flashed magisk 12, rebooted. installed magisk manager from playstore, enabled su hide in magisk settings. Rebooted again. pass safety net, Netflix works like always


So ... because the vendor doesn't support you modifying something that you bought from them, it's also ok that they then intenionally break it? I'm not sure I am following ...


If they put it in their TOS, sure.


The question was not whether it is be legal, but whether it is acceptable.

Being an asshole is also legal, but it's still not OK to be an asshole.


Oh, I understand what you mean. I thought you were speaking in the legal context. Mea culpa!


I guess another avenue would be to patch the Netflix app to skip the check.


This is very unlikely. If they use the Safetynet API provided by Google (and why should they not), your phone tells the Google server whether your phone is okay (this includes root and other things) and the Netflix server would ask Googles servers whether the client is acceptable. Changing code in the app won't help much because the check is serverside.


Actually the check is a combination of serverside and client side. The server generates a random binary with a predictable output. The client then executes the binary and verifies its output with the server. It's a very clever trick and nearly impossible to spoof.


yes, the keyword you are looking for is Magisk though it's not really for ordinary users


I think all these are stopgap measures until proper hardware DRM comes of age.


So we should lobby for legislation that stops hardware drm in its tracks. Or makes it comply with society interests.


That's not very realistic. Besides, the technology that would enable something like hardware DRM also has some legitimate uses in security. The same tech can ensure that your banking app isn't compromised even if the OS itself is compromised.


A law that mandates that code signing can be done only by the owner solves that beautifully. As a bonus it kills walled gardens.


You still don't always have control over the kernel, although most of the time you can if you want.


As someone with an unlocked and rooted android phone, what are they afraid of, and where can I get it?


Get Netflix ? Yalp Store (https://github.com/yeriomin/YalpStore) should work I guess. There are also mirror sites for apks. Netflix/Google may decide to block playback too in the future, at which point you'll have to explore other options. You can also try to use Magisk to circumvent safetynet.


By "where can I get it?", I meant "where can I get the thing that Netflix is presumably afraid of me using on my rooted phone?"


i am not sure since i watch majority of content on fmovies.se and similar sites, ain't gonna pay for limited Netflix, if they offered me same Netflix as in US I would not mind paying, but they can keep that crippled local version for themselves, one would think it's illegal in Europe to offer very different version of your product depending on what is location/race of your customer, one would say it's pretty racist/bigoted


This is particularly absurd because it's trivial to record from any device that has HDMI out; HDCP 1.x is quite thoroughly broken, and there is a steady stream of HDMI splitters that can strip HDCP 2.x


The problem is dumping all that data to disk, or encoding on the fly and doing so.

HDMI caps are mostly kind of shitty quality. Look at the UHD BluRay releases (smurfs excluded.)


I know there are non-compressing UHD cards; can x264 on a modern multicore not keep up at -qp 0 -preset ultrafast for 4k/24p?


Does "unlocked" mean carrier-unlocked or bootloader-unlocked? I'm confused by this sentence:

For example, Artem's unlocked stock Pixel is still on Widevine Level 1, the most secure level, but fails SafetyNet because it is unlocked.

(What does "unlocked stock" mean - does the Pixel ship carrier-unlocked? Was it unlocked by calling up the carrier and asking for an unlock, or in some other way?)


I would assume bootloader unlocked, I believe that causes SafetyNet to fail and can't imagine why a carrier unlocked phone would.


Yeah, an unlocked bootloader passes androidboot.verifiedbootstate=ORANGE to the kernel cmdline.

That said, the kernel could just lie about what was passed to it sooooo...


bootloader unlocked, otherwise they would eliminated completely their user base in many countries where nobody sell locked phones anymore, i never seen the point really, if i have contract for 18 months why do you care what i do with phone if i keep paying anyway?


I have a carrier-unlocked Nexus 5X and Netflix works fine.


Bootloader unlocked.


Are they going to block admin Windows accounts too?


Why would they....

ohh you believe if you are an "Admin" on windows you have control over the OS.... no Redmond has control over the Windows OS, they have DRM built in well below "Admin"


Ok, let's put it this way: Are they going to block root Linux accounts too?


Well

1. Root on Linux is not the same as Admin on Windows. Sorry

2. They do limit Linux playback to 720p, you can not play 1080p or higher streams on linux largely due not having control over the OS.


> 1. Root on Linux is not the same as Admin on Windows. Sorry

No need to be sorry, but how so?

> 2. They do limit Linux playback to 720p, you can not play 1080p or higher streams on linux largely due not having control over the OS.

I didn't know that. Is it done based on OS detection or is it just Netflix neglecting to support? What if I fool Netflix into thinking I'm running windows? Will I be able to play 1080p/4k then?


>No need to be sorry, but how so?

With root on linux there is nothing outside of your control, With Admin on Windows there are still all kinds of things outside of your control. Just look at the Telemetry controversy as an example. No way for even an "admin" to disable it

>I didn't know that. Is it done based on OS detection or is it just Netflix neglecting to support?

In order to play HD Content you much have a OS that refuses to follow the Admin's wishes, instead follows the wishes of the OS Vendor.

You much have full stack DRM built into the OS that is not bypassable.

Currently the Only OS that support browser based HD Playback from netflix is Windows in the Edge Browser because MS DRM is built into the OS and the Admin of the OS has no control over it.


> What if I fool Netflix into thinking I'm running windows? Will I be able to play 1080p/4k then?

Not without SilverLight or their app as far as I can tell.


Has the reason for the 720p cap been confirmed anywhere? All I'm getting from the helpdesk is that it is browser limitation, not policy. Is there something in the HTML5 DRM standard that imposes this limit?


https://help.netflix.com/en/node/23742

Resolution:

  Google Chrome up to 720p

    Internet Explorer up to 1080p

    Microsoft Edge up to 4K*

    Mozilla Firefox up to 720p

    Opera up to 720p

    Safari up to 1080p on Mac OS X 10.10.3 or later
Mainly it has to do with PlayReady / Widevine support at the OS Level. Windows has PlayReady baked into the OS, and will communicate with the Edge Browser in a Secure way that can not be bypassed by any user on the System

Linux and other browsers on Windows lack the ability to do this at an OS Level there for netflix limits the stream quality because the OS does not have the proper DRM Controls

This is the exact same reason they do not want the Netlfix app on Rooted devices


> They do limit Linux playback to 720p

Joke's on them. I only use Netflix on my laptop on the go and then my bandwidth is usually bad enough that 1080p is unachievable anyway.


Thats called windows 10 s


This is kinda silly though. Pirates will not bother using netflix. You have stremio, pop corn time, the pirate bay and 100 of streaming websites with more content for free. If somebody is paying, let the client have the unlocked phone.


So they are now admitting they have gone completely insane with DRM craze. That was expected.

Now let someone come and disrupt this industry swamp with DRM-free video.


The drm is probably a requirement to stream many of the videos. I would rather Netflix with drm than not being able to stream legally


I'd rather not support those who proliferate DRM up to the point of pushing it into HTML standard.


> The drm is probably a requirement to stream many of the video

Then why does Netflix apply drm to all served content, including its own?


Next thing you know the photos you upload to facebook might use DRM so that you wouldn't be able to move to other site. Would you be happy about such a development?


I'm unsure how this is related to my argument. I never said I liked drm, I basically just said that it's a tradeoff I'm willing to make because it's probably a necessity if they want to license the content legally. Obviously I would be mad at Facebook but it's an entirely different situation


> because it's probably a necessity if they want to license the content legally.

For sure the same argument could be applied to fb photos, the point is - it's a slippery slope and I'm not willing to walk it. It is a tradeoff though, the one which means that society is willing to trade their freedom. "The dancing pigs" phenomenon if you wish, the Felten & McGraw quote applies so much to security as it does to freedom and privacy: Given a choice between dancing pigs and security/freedom/privacy, users will pick dancing pigs every time.


I still don't understand how the argument applies to Facebook photos. With Netflix we are talking about a requirement imposed by the people creating their content so my guess would be that the analogue in Facebook terms would be if users started not posting photos unless Facebook implemented drm but I don't really see the point of that analogy.


Average customer doesn't care about DRM. Netflix became popular because it was convenient. Yeah, DRM is inconvenient for us geeks, but that won't matter for a while.


Sadly it's true. Average person don't even know that DRM exists. To extrapolate this a bit, from my experience average Windows 10 user don't even know how much spying it is there and those who know simply don't care, the same is true with DRM - the small percentage of people that know about it just don't bother to care.

As a thought experiment I wonder if my relatives will start to care about it when the wedding pictures I have taken for them suddenly will be DRM so they would need to ask my permission to print each and every of one (I guess not, they probably be just mad at me).


It's shit like this (and the VPN bullshit) that keeps piracy alive. popcorntime has chromecast support and a much better selection anyway. Or kodi or whatever people use these days. The only selling point and advantage that Netflix ever had over the alternatives was convenience. That's no longer the case.


Bad move, in my opinion. So now most 30$ Android-TV devices are not going to be able to run Netflix? I hope they don't blame piracy afterwards.


Wait. I can't cast Netflix to my TV from my phone anymore?

What the f* are they expecting us to do? Surely they can't be that stupid?!


What I don't understand is what Netflix has from it. Is Google paying them money for that "feature"?


rooted != unlocked

My phone is not rooted. It is unlocked. Netflix app works fine on this phone.


If your phone is unlocked, you will no longer find the app in the Play Store, or any updates to it. If it's already installed or sideloaded, it will work, for now.


Not true. My phone is unlocked, the Netflix app was not installed, and right before posting my above response I installed it from Play Store.


Yep. I have a normal onePlus one that came out with Cyanogen. Never modified it, Netflix doesn't work for me.


we are not talking about carrier unlocked phones


Neither am I. My phone came unlocked new.


This is outrageous.


Why prevent installing the app when you could instead stop specific content from being played?

Surely not all Netflix content is licensed under terms which prevent it from being distributed to rooted devices.


Testing and complexity. (in their estimation) There's just not a large enough population to shoulder the additional engineering overhead and maintenance costs of partitioning the data and testing/monitoring with every single release.


I wish Netflix would just step up and lead the way with their original content.


There are going to be people that blame Netflix for this, but it's really not their fault. They didn't even care if people used VPN's to access their service. Pressure from the content providers forced them to do this.


>There are going to be people that blame Netflix for this, but it's really not their fault.

There are going to be people that continue to excuse netflix and believe it is all pressure from content providers.

News Flash for people that believe that, Netflix is a content provider now. They fully support DRM for their content, they are not being "pressured" by content providers to do this. They support anti-consumer policies like DRM, and are just like the MPAA in this regards

Stop allowing Netflix to hide behind their PR machine and blame 3rd parties for polices they fully support and endorse

No I do not believe for 1 second Neflix is being pressured by anyone to enact these draconian drm polices nor where they forced to support EME in HTML5.

Netflix is just another anti-consumer, anti-freedom corporation.


I agree with everything but:

> They are not being pressured

I'm sure they are; but they are becoming aggressive and they are no longer a cool upstart company battling against a big media monopoly that everyone hated. They are that monopoly now


This - Netflix lobbied for Web DRM, they apply it to their content as well and they even disable downloading for a lot of their shows.

They're behaving EXACTLY like all other DRM obsessed content providers.


Here's another news flash - Netflix without content ceases to become worth their subscription fee. What did you really expect Netflix to do? Ignore the demands of their content providers and then have the content taken away?


Keep defending netflix if you want, they are not innocent victims of content provider threats, they are content providers.

MPAA did not come in strong arm Netflix, Netflix is a willing and eager participant in the development and spread of DRM


There's no need to defend Netflix as they're simply doing what they need to contractually do to stay in business. Did you really think Netflix was going to defy the demands of their content providers? Content is king and if Netflix didn't have it they wouldn't be worth subscribing to.


Again, Netflix is actively pushing DRM on content they themselves produce (no "content provider" pressure there).


> They didn't even care if people used VPN's to access their service.

Netflix employees used to help out users in Australia with VPN issues back before Netflix launched over here. It's all different now.


And unless I see a different selection to everyone else in Australia, the offerings have rapidly gone downhill, C-grade/fire-sale content. Some gems from time to time, but 98% unwatchable rubbish.

Edit: For the price I pay, I don't mind that too much though.


netflix is now pumping out a lot more original content, and a good number of them are complete trash. they still have some of the best shows out there (house of cards, narcos, stranger things, etc), but it feels like they're more interested in quantity, not quality.


OT, but at this phase, they are. They're still producing the same amount of high quality content (probably more and at a faster pace), but with so much new content, there's a SNR issue.

Think of it like Netflix successfully became HBO faster than HBO could become them, so now they're expanding content to fit the new and old general demographics- the cable and youtube viewerships.

They're also big on data, so if they're making it, it's not because they think no one wants it. We share an account with my SO's sisters, and despite all watching about the same amount, it's amazing just how different (and accurate) the recommendations are for each of us.


That's great unless you want to watch movies. Their DVD service gave access to a library of thousands of movies from blockbusters to obscure niche films. Their streaming service sucks in comparison.


> Their DVD service gave access to a library of thousands of movies from blockbusters to obscure niche films.

You write this in the past tense, but the DVD service is alive and (mostly) well. ("Mostly" because they are not replacing rarer DVDs as they go missing from their inventory.)

I presently subscribe to both services because I love older films.


Their DVD service required a minimum of 48 hours forethought before viewing a video. Some people watch whole seasons of shows in that period.

For most, a large enough selection instantly is much better than a full selection w/ a 3 day lead time


I used to agree with this, and the same argument about DRM in general, but Netflix now has a significant body of original content, so I'm less sure about it. In particular, they appear to be blocking the entire app from even downloading (not even running!) on affected devices.

Do their contracts with the content providers say "All your content, even content that doesn't come from us, must be provided with this much DRM"?


It's probably a lot easier to have a blanket ban on VPNs and rooted devices than to allow them when you watch X versus when you watch Y.


I am sure it is, I am also sure if netflix has a ethical problem with DRM, and is actually in active opposition to DRM they would put forth the effort to allow their content DRM free, eliminate geo-fences, and allow the app on Rooted devices limited to only Netflix owned content

They however are not opposed to DRM like many people believe, they are Huge supporters and developers of DRM technology.

If you oppose DRM, Netflix is just as much an enemy as the MPAA is


I'm guessing they're on the same boat as Tim Berners-Lee, thinking it a necessary evil if the world wants big budget films delivered through their browser. Personally, I'd only get on that boat if my life depended on it, which I think is the case for Netflix (I'm still not sure why TBL is on it). I think Netflix is at least fighting for DRM that isn't based on rootkits, something of a win for the general population.


Aren't HTML5 EME plugins sandboxable, though? That is, aren't they definitely not rootkits?


I wasn't saying HTML5 EME supported rootkits. DRM doesn't belong in the web standard, that's a fundamental belief of mine against DRM in general. I'm saying TBL and Netflix are both campaigning for non-rootkit-like DRM, better than the worst DRM, but DRM none the less. Netflix is a company, it's only real concern is making money, regardless what they're owners/employees personally believe, they won't get big budget films without it, so I understand why they're working for "Good" DRM. But no individual should be lobbying for "better" DRM.


> I think Netflix is at least fighting for DRM that isn't based on rootkits

But you have read the headline, haven't you? They only work with a google rootkit installed, now.


I think that describing Google Play Services (or Android? or I'm-not-sure-what) as "a google rootkit" isn't super conducive to a meaningful discussion, even if there's a technical interpretation under which it's true.

In particular, most users of Netflix on Android have a threat model that involves Google legitimately having the ability to push software updates to the phone that run as root. So "rootkit" is not a very useful term, any more than describing any Debian package maintainer script as a "random volunteer's rootkit" would be.


Suppose you needed to install this particular Debian package with root privileges (well, necessarily, but you get the point) that you otherwise would not want to install and that then goes on to enforce a certain behaviour of your computer against your interests as a prerequisite for using some other piece of software.

Suppose further that someone put forward the argument that it's not so bad, as at least there is no rootkit involved.

Then, yes, it would obviously be perfectly sensible to in that context call that Debian package a "random volunteer's rootkit".

Whether most users would like to have some other functionality provided by that same package is completely irrelevant to the question at hand, as is whether most users would install the package.


> Suppose you needed to install this particular Debian package with root privileges (well, necessarily, but you get the point) that you otherwise would not want to install and that then goes on to enforce a certain behaviour of your computer against your interests as a prerequisite for using some other piece of software.

This happens to lots of people under the name of systemd. I think any definition of "rootkit" that includes involuntary installations of systemd is so broad that we cannot conclude anything from the term. (There are legitimate criticism of Debian requiring systemd, but they're basically entirely orthogonal from the criticisms of, say, the Sony BMG rootkit.)

So, let me ask - what in particular are you seeing as the "google rootkit," and how would you describe its negative behavior in words other than "it's a rootkit"?


> So, let me ask - what in particular are you seeing as the "google rootkit," and how would you describe its negative behavior in words other than "it's a rootkit"?

Well, I am not all that well-versed in Android/Google components/APIs/whatever, so I can't really tell you what specific component that would be, but as I understand it, there is some mechanism provided by the platform that allows an app to check whether the owner is locked out from controlling their own device, right?

So, it's some component with high privileges that gives the power to control how you use your device to a party that's not you ... now, "rootkit" isn't really all that clearly defined, but I would say that that's clearly the core of what makes a rootkit a rootkit, don't you think?


The relevant service provides some information about your device to Google, which makes a decision (I'd assume based on heuristics or ML) about your device's integrity compared to Google's baseline. An app's vendor can choose to condition the Play Store entry on the result of the Google calculation.

A rootkit, traditionally, hides its existence from you and provides root access (i.e., code execution as root) for some outside attacker. Oxford defines it as "a set of software tools that enable an unauthorized user to gain control of a computer system without being detected;" Veracode defines it as "a clandestine computer program designed to provide continued privileged access to a computer while actively hiding its presence;" Wikipedia, citing McAfee, says that a it's "designed to enable access to a computer or areas of its software that would not otherwise be allowed (for example, to an unauthorized user) and often masks its existence or the existence of other software." I think these two properties are the core of what makes a rootkit a rootkit (and also the core of what makes it bad).

This Google service neither attempts to hide its existence nor does it provide remote access / code execution to anyone.

The closest term I can think of for something that provides information to others is "spyware", but even that's a serious stretch. This utility is most similar to the function called by desktop software installers that check to see if you have enough disk space, so the installer can choose to abort based on the result. And I'd definitely not call that a "rootkit" or "spyware".


I think you are far too literal, instead of looking at the big picture.

I mean, Windows doesn't even have a default privileged user named "root", does that mean that the Sony BMG rootkit was not a rootkit, because, traditionally, that's the name applied to stuff that gave access to the root account on a unixoid system? If all you cared about was etymological purity, you certainly could make that argument.

Now, what does "access to a computer" mean? What does "otherwise not allowed" mean? What does "remote access" mean? What does "code execution" mean? What does "hiding" mean?

Does the average user actually know that there is a component on their phone that reports to google whether they have tinkered with it? Is it advertised to them that that is the case? What would it take in your mind to qualify as "hiding"? And mind you, traditional, unixy, rootkits aren't necessarily undetectable either, not even on the running system.

Suppose there were some mandatory software installed on your phone that allowed some other party to control which telephone numbers you are allowed to call. Is that "remote access"? I mean, it's obviously giving someone remote control over what your phone will do, or refuse to do. What would it take in your mind to qualify as "remote access"? Would that necessarily require code execution? And if so, what does "code execution" actually mean? Is a javascript interpreter you can load code into (aka a web browser) "code execution"? Or is it not because it's in a sandbox? But then, what if the phone has a hypervisor, and the "rootkit" only gives you root access to the linux kernel running on top of that hypervisor ... that's also kindof a sandbox, so that doesn't qualify as a rootkit either? Or does it?

Suppose you were to ask people "do you want to have software installed on your phone that reports to third parties whether you have tinkered with your phone?" ... how many people do you think would say "yes"? If it's installed on the phones of people who would answer "no" to this question, wouldn't that qualify as "access [...] that would not otherwise be allowed"? How would you justify that as authorized use of the phone? Or would you?

What distinguishes spyware from rootkits is exactly that spyware just exfiltrates data, whily rootkits allow some sort of control of the system (but also, the distinction isn't always all that clear-cut).

Now, you might argue that google's component is just spyware (and you kindof did) ... but that's again missing the big picture, because the whole point of this spyware obviously is to control what the user can do with their device, even if part of that mechanism then is technically implemented by a third party and/or on a remote server.

> This utility is most similar to the function called by desktop software installers that check to see if you have enough disk space, so the installer can choose to abort based on the result.

That shows that you are completely missing the point: This is about power structures, not about technical implementation details. You might as well be arguing that a gun is most similar to a computer case, because they are both made from metal, in a discussion about whether someone holding a gun to your head is comparable to someone threatening to hit you with a baseball bat.


Doing the easy thing isn't (or didn't used to be) Netflix's style, one of the reasons HN has long loved its tech writeups. So the blanket ban is either a reversal of that culture or simply Netflix finding itself with aligned interests with other content producers and acting accordingly.


Maybe one day they'll have a separate price plan and app just for Netflix Original content. I'd switch to that right now if they offered it. Then we'd see which side of the fence they're on.


I'm sure they're under equal pressure to not say as such. It would be nice if they could just flat out state "as part of our contract with X, we must <enter exact clause here>".

Edit: I just realized that cable companies sometimes have hostile notices about their dealings with certain stations. I'm guessing Netflix isn't quite in the same position of power though.


They certainly are going above and beyond. It's basically impossible to find a good VPN that works with Netflix, and they also block pretty much every IP range where you can get a VPS. They are just much more effective than any other geoblock I'm aware of.

I think in this case they have worse odds though, Freedom or Lucky Patcher or some Xposed module will be up to the task if there is enough interest.


Above and beyond? This is a simple yet effective countermeasure that the content providers have likely insisted upon.


NordVPN works fine. FWIW.


Just following orders.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: