Message Security Layer: A Modern Take on Securing Communication(techblog.netflix.com)
techblog.netflix.com
Message Security Layer: A Modern Take on Securing Communication
http://techblog.netflix.com/2014/10/message-security-layer-modern-take-on.html
9 comments
As soon as I saw Encrypted Media Extensions, my first thought was, "Ewww." (As in, "Ewww, not something the general populace is likely to benefit from.")
This a very interesting development, an OTT* protocol for secure communication that can sit on top of HTTP. Perhaps this was inevitable given that so much of the underlying security infrastructure has been compromised. It appears to be able to function independently of the application layer protocol as well.
[edit] *I originally wrote 'over-the-top protocol', which in the telecom industry just means "on top of HTTP". Puzzled as to why this got down-voted until I realized some people probably interpreted it as a negative remark. On the contrary, I think OTT protocols like this may be a great way to leverage existing infrastructure while layering on new and potentially better approaches to security.
[edit] *I originally wrote 'over-the-top protocol', which in the telecom industry just means "on top of HTTP". Puzzled as to why this got down-voted until I realized some people probably interpreted it as a negative remark. On the contrary, I think OTT protocols like this may be a great way to leverage existing infrastructure while layering on new and potentially better approaches to security.
Given Netflix's position on browser DRM, and their references in this post to "platform integration" and device keys, it sounds like they're trying to implement HDCP for sockets.
Ugh.
Ugh.
That's pretty much what this is. As I understand it, this predates WebCrypto, too, and is also the reason that Mozilla will (pointlessly, dangerously) deliver WebCrypto code over non-TLS HTTP connections.
@sleevi_ and @BRIAN____.