How does Disney+ prevent screen recordings of their content?

Question

I tried to take a screenshot of a movie on the Disney+ web app when I realised that the video turns black as soon as I try to take a new screenshot with Snipping Tool. When I tried to do the same thing with OBS and Discord streams, I saw the same effect.

Interestingly, this only works for Chrome on my machine (I also tried Firefox and Edge and they just let me record my screen).

When I saw this, I became really curious on how they achieved this. Does anyone have any idea how I can recreate this for my own web projects?

Adorl

They use Widevine: ottverse.com/widevine-drm-how-does-it-work – Shearwater

Answer 1

I became really curious on how they achieved this.

• They use Widevine.

  • Widevine homepage.
  • https://ottverse.com/widevine-drm-how-does-it-work/
  • https://en.wikipedia.org/wiki/Widevine
  • News reports:
    • https://www.cordcuttersnews.com/sadly-disney-wont-work-on-chromebooks-linux-some-android-devices-because-of-drm/
    • https://www.tomsguide.com/news/disney-plus-will-work-on-chromebooks
    • https://www.androidpolice.com/2019/10/22/disney-will-only-work-on-devices-that-support-the-strictest-widevine-l3-drm/

• It's also used by Netflix, Hulu and others.

• Widevine is Google's DRM system that's baked-in to Chrome.

  • All other major browsers have adopted it as well, because no-one will use a browser that can't access Netflix.
  • Mozilla's and Microsoft's support is less user-hostile and as you noticed.

• It's just a standard HTML5 <video> element - when the browser downloads the video stream it will see that it's encrypted with Widevine and that engages the Widevine client-side code which does all the DRM biz.

  • Though there are HTML and DOM features that facilitate DRM, I'm unsure of the extent that any JavaScript is required to use it - as theoretically everything the browser needs to know to load the DRM system should be embedded in the raw media stream.

• On Windows, I understand (though unconfirmed) that Widevine makes use of SetWindowDisplayAffinity to block screenshots.

  • Nothing stops you from doing this in your own native code (e.g. if you had an Electron fork), but please don't because it's a real dick-move to your users, in addition to not working at all if the user has the DWM disabled (e.g. they're running Windows 7 with Aero disabled).

Has anyone any idea how I can recreate this for my own web projects?

You'll need to license Widevine yourself. This is a complicated process intended only for large media production companies and content rightsholders, not individuals or small businesses.

Anyway, even if you could, please don't. Why would you want to make to harder for users to share and appreciate your media? Just stick it up on YouTube instead.

Shearwater

Thank you for your answer! My initial thought was to use the feature as an additional security measure for critical data such as passwords. Not for DRM :D – Adorl

@Manox That's a good point - I am surprised that Windows desktop password managers don't block screenshots (not taken by users, but by spyware) - though given that passwords are hardly ever displayed on-screen (instead we get dots/asterisks) I think the risk is overstated. – Shearwater