4

EME is a technology to allow proprietary code to be run in browser to frustrate piracy.

What are the security implications of this? Will it have full access to my computer (like the good-ol' ActiveX plugins?), and will it have any security benefits over Flash?

0

1 Answer 1

7

EME doesn't "allow" proprietary code, that's a misinformation of Wikipedia based on this four years old post , a post which does not provide real information, just the assumption that at some point a full DRM solution will be integrated into the browser.

The EME is just an API to interact with the license server and the Content Decryption Module. This CDM is the one responsible for decrypting the video. It runs in a sandboxed environment, so no access to your computer is needed.

The whole purpose of EME is to not need a plugin to use a DRM system, so you don't need to rely on third party plugins (Flash, Silverlight...). Therefore, you are removing an often vulnerable point.

In summary, the EME doesn't add any security at all from the server side, but it provides security in the client side removing the need of installing a third-party plugin.

6
  • Well the CDM is sandboxed, but how strong is a sandbox exactly? May 12, 2016 at 17:22
  • @AndréBorie I don't know the answer to that question, but I'm curious, how do you want to exactly measure that? IMO, the sandbox doesn't depend on EME but on the browser itself, so it may be better in Chrome than in Firefox for instance.
    – user15194
    May 12, 2016 at 17:28
  • Fine, what's the security advantage of the CDM over Flash/Silverlight/Java May 13, 2016 at 17:59
  • @CharlesShiller I told you already. It is sandboxed into the browser (that is, it doesn't have access to the system). Third party plugins run at the system level.
    – user15194
    May 14, 2016 at 12:03
  • 1
    @nmit026 it would be as hard as breaking the DRM system. EME is not the one providing you with security capabilities, the DRM is.
    – user15194
    Oct 18, 2017 at 8:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .