The layers of a secure stream
- Transport encryption (HTTPS): protects the connection between viewer and server
- Signed URLs and tokens: stream addresses that expire and work only for the session they were issued to
- Content encryption (AES-128): scrambles the video segments themselves
- DRM: delivers the decryption key inside a license that only a protected module on the device can read
- Geo rules: playback only where you hold the rights
- Device and concurrent-stream limits: one account cannot serve a crowd
- Forensic watermarking: a leaked copy can be traced to its source
How much security a service needs
Match the protection to the content. Free and promotional video needs HTTPS and little else. Paid content you own is well served by signed URLs, account limits and encryption. Licensed films, series and sport normally require multi-DRM, and the most valuable titles require watermarking as well.
Rights holders set out their requirements in the license, so read it before choosing a plan or a platform.
Common weak points
- A paywall enforced only in the app, with stream addresses that anyone can replay
- Tokens that never expire
- No limit on simultaneous streams, so one login is shared widely
- DRM on the web player but not in the apps, or the reverse
Last reviewed