TL;DR
This paper investigates how browser implementations of Widevine EME can leak user privacy, revealing that many browsers share identifying information without user consent, and introduces a tool to exploit these vulnerabilities.
Contribution
It provides the first comprehensive empirical analysis of privacy leaks in Widevine EME implementations and presents EME Track, a tool to demonstrate privacy breaches.
Findings
Many browsers disclose Widevine Client ID without explicit consent
Browser divergence in EME privacy compliance undermines user privacy
Reverse engineering reveals privacy leakage mechanisms in Widevine implementations
Abstract
Thanks to HTML5, users can now view videos on Web browsers without installing plug-ins or relying on specific devices. In 2017, W3C published Encrypted Media Extensions (EME) as the first official Web standard for Digital Rights Management (DRM), with the overarching goal of allowing seamless integration of DRM systems on browsers. EME has prompted numerous voices of dissent with respect to the inadequate protection of users. Of particular interest, privacy concerns were articulated, especially that DRM systems inherently require uniquely identifying information on users' devices to control content distribution better. Despite this anecdotal evidence, we lack a comprehensive overview of how browsers have supported EME in practice and what privacy implications are caused by their implementations. In this paper, we fill this gap by investigating privacy leakage caused by EME relying on…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Code & Models
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
