0

So I saw this post: Securing a video using encryption about encrypting videos so people wouldn't just download them, and upload them somewhere else.

Pretend that my site made people pay for membership to watch the videos on the site, and Say that I could encrypt the videos, and it would be impossible to decrypt/download them(Not saying that I can).

To fix the problem of someone recording with a screen recorder, or even with a camera on the computer screen, would it be legal (with some kind of contract you agree to when you sign up), and/or a good strategy to put the user's (viewer) credit card info that they used to buy membership in some kind of watermark over the video (covering the whole video but really transparent)? It would prevent them from leaking, because they obviously don't want their credit card stolen.

This isn't for blackhat purposes, I'm not going to do this, I'm just wondering if it would be reasonable, and if it would work.

Putting aside all the legal issues, I just want to know if it would work/be reasonable

EDIT: Also, if this isn't legal (it probably isn't) would it still work if some other personal info was used (like an ip address or something)?

Improve this question
8
  • 1
    The PCI Council (specifically, their DSS) would have major issues with portions of your scenario / question. You are asserting many theoretical options and asking legal questions - which is out-of-scope for Information Security.
    – 0xSheepdog
    Commented Apr 19, 2017 at 17:57
  • @0xSheepdog Putting aside all the legal issues, I just want to know if it would work/be reasonable
    – Noah Cristino
    Commented Apr 19, 2017 at 17:58
  • Edited @0xSheepdog
    – Noah Cristino
    Commented Apr 19, 2017 at 17:59
  • Well, since you can put a watermark on a video, as many of the video providers have demonstrated, I don't see why this wouldn't be possible with enough processing behind the scenes. Reasonable? By whose standards? Not by many that I can think of.
    – 0xSheepdog
    Commented Apr 19, 2017 at 18:07
  • At the very least you are expanding what parts of your system have access to PII.
    – user123931
    Commented Apr 19, 2017 at 19:25

1 Answer 1

Reset to default
0

Ignoring all the PCI-DSS and legal implications, for your approach to be an efficient deterrent, people need to be able to retrieve the personal information from the videos - if nobody can extract that info then the deterrent doesn't work because no one will be actually able to see that personal info.

However, when people see where it is, they can now remove it or blur it out before sharing the video, making your approach pointless.

Most watermarks out there are designed to be either secret and invisible (security by obscurity is bad but in this case a compromise isn't a major issue) so that people can't remove it and yet the content creator can still decode that watermark in leaked videos to be able to track who was the original uploader, or, they can be extremely visible on purpose making the protected content worthless (like stock photos with the brand name in the center, so they show a sample of the work while not being usable as actual stock photos).

So, either go with the secret watermark route (in which case embedding an unique user ID is enough for you to track down the user without exposing personal data), or go with the big "in your face" watermark in which case no personal data is needed either because the watermark makes the media unusable, so you're not actually loosing anything by leaking unwatchable media.

Finally, have you considered making it so that people don't have to steal your stuff? Affordable pricing, great UX, no DRM nor other BS like geo-blocking would make your service quite a good investment.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .