How to serve videos in a website somewhat securely

Question

I am asking a question that's somewhat related to these:

Secure way of serving videos

secure streaming of videos

However, no one provided an answer that seems relevant to my situation.

My situation is as follows: I'm building a very simple Learning Management System. Students have access to Video lessons if they have paid for it. I would like to prevent:

• bots/spiders from finding these videos and downloading it
• for people to simply view source, copy the url of the video, and share it with other people

I doubt very much people will try to hack the site to steal the videos.

What is the best way to secure these videos from being shared? Do i have to store the videos on my webserver? Can i leverage video platforms like youtube or vimeo?

Answer 1

Long story short, there is no simple solution.

I will say straight up that if there was a way to stop people from downloading videos, every video website would be doing it.

I have thought of a few ways, listed out below, of what you could do to make it not worthwhile for the student/viewer to download the videos.

• obscure the URL
• change the URL frequently
• restrict the number of downloads per IP address/subnet
• make them view it in a custom-built "custom-served" video player
• use a video streaming service already available

Each are discussed in greater detail below.

Obscuring the URL

You could obscure the URLs like so:

http://mylearningmanagementsystem.com.au/e12d8cd38f00f204e9801998ecc8427e/video.flv

You could calculate a hash of the name of the file itself (or salt and hash, the above is just an example) and use that in a URL.

This could be achieved in such a way that they would be obscure enough, but still bookmarkable and user-friendly for the viewers.

If you wanted to go one step further, you could have video broken up into parts - this is discussed in the custom built section.

Change the URL frequently

With some code, you could set the videos to change URLs every Sunday night at 11.59pm for your timezone. However, any page that you link to would have to be either automatically or manually updated, and that is a hassle in itself (how do you test the code/what if it falls over and you don't realise/things like that).

Even if you get all of that working, any user that bookmarked the page would suffer from link rot.

Restricting the number of downloads per IP address/subnet

With some funky server-side code, you could limit the number of times a video can be downloaded to an IP address (or depending on the user case, a subnet of the IP).

This is not my strong point, but you could look at articles on Dynamic IP Restrictions. The below is an excerpt from the website

Dynamically blocking of requests from IP address based on either of the following criteria:

• The number of concurrent requests.
• The number of requests over a period of time.

There is also the possibility of doing the same with Drupal.

Make them view it in a custom-built "custom-served" video player

You can go the extra mile and make your own video-management system (which it seems like you are), and serve the videos from your own server (which is what I meant by custom-served) but some programs that have attempted this were flawed like Sony's CD management software or were punishing honest users, like Apple iTunes' FairPlay DRM software.

If you do end up going the route of giving users a program/web service to watch videos and restrict them to an password/encryption key, you could annoy the customers who paid for your content in good faith. This is essentially what all copyright protection systems tried and utterly failed with, because either the program wasn't secured well enough or people simply stopped using it because it was awkward to work with.

When you serve the videos to the users, you could break them up and separate them by chapters, as in the first chapter is one video, the second is another, and so on (like below):

http://mylearningmanagementsystem.com.au/video_title/chapter_01/video.flv
http://mylearningmanagementsystem.com.au/video_title/chapter_02/video.flv
http://mylearningmanagementsystem.com.au/video_title/chapter_03/video.flv

... and you could combine that with the hashing idea in the first section (Obscuring the URL):

http://mylearningmanagementsystem.com.au/e12d8cd38f00f204/8fd3611c40e74c3d/video.flv
http://mylearningmanagementsystem.com.au/e12d8cd38f00f204/92d7f54d09c80436/video.flv
http://mylearningmanagementsystem.com.au/e12d8cd38f00f204/27bd98792bea3103/video.flv

This could have its downsides though:

• low internet users who pause the video at the start to let it load, will experience issues (less common a problem now, as the internet is now much faster and easier to access)
• if one video is missing, the whole video will be unplayable
• how will you manage each link? Will each video name have the same hash or a different hash?
• will you have to manually break up each video?

The key point here is that this does make a lot of unnecessary work for you. The next option would be to use a video streaming service that is already available.

Use a video streaming service already available

There are plenty of options out there to host and share your video. YouTube and Vimeo are two of these options. I will explain why I prefer the latter.

1. Password protection

   If you wanted to share the videos only with a specific number of paying people, you can protect your videos with a password on Vimeo. AFAIK, YouTube does not offer this service - it only allows you to select members to view the video.

   Not only that, but you can add a bunch of videos to an album (in Vimeo), and password-protect the album, so you only have to change the password for the album.

   Keep in mind that you may run into increased support messages like "But is this the current password or the one for last week?"

2. Set embed settings

   You can make the video unable to embed on any page, so that users would have to go to Vimeo directly, type in the password (if you set one above), and view it inside their web browser. AFAIK, you can embed any video from YouTube that you can view.

You will have to keep in mind that a quick Google search revealed that there are heaps of online sites that allow you to download videos from these video-hosting websites. There are even browser addons for Firefox and Chrome.

If your business depended on your videos for monetising purposes and you wanted to go one step further, there are paid streaming services that specialise on content distribution with proper access right management and content protection. One of these services is Brightcove. Excerpts from Brightcove follow:

Brightcove Video Cloud securely delivers the highest quality on-demand and live video experiences to reach your audience—no matter where they are. We simplify delivery to an increasingly complex ecosystem of devices and standards across the web, mobile and connected TVs

... and ...

Protect your valuable content

Ensure your video is safe. Use RTMPe stream encryption and SWF verification to prevent video stream ripping and content theft and ensure that your video stream plays back only in your authorized players.

Fine-grained Access Control

Pinpoint exactly when and where your content is displayed to comply with content licensing restrictions, global launch roll-out schedules or secure behind-the-firewall delivery. The user-friendly graphical interface allows you to restrict access by date, domain, geography, player or IP address. For even greater control restrict access to sensitive materials by IP address range and ensure content is accessible only from within approved networks.

At the end of the day...

If you can view it, you can download it, no matter how much you obscure it.

If there was a way to stop people from downloading videos, every video website would be doing it.

If you had unlimited resources, you could combine all of the techniques listed above to make it not worth anyone's time. But, after all the effort you put in, a viewer could always set up one of many screen capture programs to record all the videos onto their hard drive.

It's up to you, and how vigilant you want to be with your videos. Remember that the effort and time you spend making it harder to rip a video, is proportional to making it harder for regular paying customers to get and use the content as well.

More information:

• How can I make a video not downloadable?
• Vimeo privacy settings
• Video streaming service | Online Streaming Video | Brightcove

Answer 2

Maybe it's a bit too late, but I'm putting this here so that it would help others.

As others have stated, there's no way to secure contents once they reach someone's computer. But we can prevent uncontrolled sharing of the content by putting some barriers in place.

One such method that I've noticed many websites including linkedin, pluralsight, and many others use is a resource url with authorization information secured with hash. Such tokens include enough information for identifying the content to be served and a time-frame between which the url is valid.

Suppose the video you want to secure is : example.com/videos/1234.mp4 Here's an example of how you'd generate a token on first request of the resource (after you've authenticated the user and done other verfications) :

validFrom = unixTimestamp
validTo = unixTimestamp
video = 1234.mp4
privateKey = yourSecretKey

token = HASH(validFrom.validTo.videoUrl.privateKey)

Now, create a url with all the above information excluding the private key. Your final url would be something like this :

example.com/video?validfrom=1566831998&validto=1566839198&path=1234.mp4k&hash=HhgcWmRViYeQLn4AZoQvkVXotPU

Now, whenever a request is made for a video at the path /video, you'd take all the parameters from the url (excluding the hash), and create a hash as you did earlier from the parameters and your private key in the same order. The url can be said to be valid and untempered if the hash that you just generated matches with the one that was included in the URL. This same technique is used in JWT authentication and is really efficient. As you don't have to store or retrieve information to and from any database. This makes it very quick and easy to implement.

Once you've validated the token, you can return the FileStream to the media that was requested in the url.