<p>Another option is single use URL/access tokens. But this could get complicated if the browser uses range requests, which is almost certain. And even then the user could still get around that with enough motivation. DRM is the only really secure way.</p>

CC BY-SA 3.0
2015-12-17T21:25:58.547Z
Thanks for the input. We have already implemented expiring URL. but downside of it is that url is accessible for non logged in users until it expires. I guess that leaves DRM a better solution
Yaya
CC BY-SA 3.0
2015-12-16T20:00:07.303Z
2015-12-16T20:00:07.303Z
SlimSCSI
<p>We started using a Vimeo pro account. It has the ability embed a player in a web frame and (I think) prevent downloading. You can specify what domain(s) can load the video file. The dev working on the site was able to remove all the default Vimeo interface overlay elements. It'll go live soon. I'll post the link when it does.  I'd love to know if you guys/gals can obtain the file as we've tried to lock it up.</p>

CC BY-SA 3.0
2015-12-18T04:28:37.710Z
That's no protection. Do post the link.
Gyan
CC BY-SA 4.0
2020-01-20T05:50:51.413Z
This simply stops someone from sharing the URL. There's browser plugins that allow you to download the video when on the whitelisted website. As long as someone know the URL, DRM (encryption) is the only way to go.
Casey Gibson
CC BY-SA 3.0
2015-12-18T02:48:22.907Z
2015-12-18T02:48:22.907Z
Nick Spiropoulos
<p>Unfortunately, no, that's the entire reason DRM exists.  It is a bit like trying to prevent someone from recording an on-air broadcast.  When you send video data over the internet to someone's player, they can simply store the information being sent to the player unless you obfuscate it and make it so that the player will only work under certain circumstances and will not share the data.  This, by definition, is DRM.</p>

<p>What DRM attempts to do is control the reading of the data entirely, so that it can not be copied.  This has varying degrees of success and rarely, if ever, works particularly well.  It may keep honest people honest, but if you are sending someone data in a way that they can access it, measures to try to stop them from copying it are... difficult.  The most advanced systems use special display drivers and encrypt the data right up to the point it is being displayed on the screen (HDCP), that way other software on the computer can't directly pull the information off the frame buffer being prepared for the screen.</p>

<p>There may be some ways you can mildly obfuscate the access to your video, but ultimately, if you send it in the clear, it is trivial for a knowledgeable viewer to store the datastream.  If you use DRM, it is substantially harder, but still likely to be able to be worked around by a dedicated attacker.</p>

CC BY-SA 3.0
2015-12-17T20:58:17.357Z
It is true that no security measure is ultimate. A determined attacker could break into any security system. Taking into consideration of normal users who are having average tech knowledge, I think DRM is the way to go. Thanks for the answer.
Yaya
CC BY-SA 3.0
2015-12-17T21:10:07.607Z
@user12305 - yes, but tools are created for people of average skill to bypass DRM.  I don't keep up to date on which systems are currently broken and to what level, but in general, DRM has a pretty horrible track record, though it's still better than just being unprotected if you need to try to keep it protected.  Just don't be surprised if it fails, especially if you go with poor quality DRM.
AJ Henderson
CC BY-SA 3.0
2015-12-17T21:20:34.737Z
got it. would you be able to suggest any good quality DRM?
Yaya
CC BY-SA 3.0
2015-12-17T21:47:36.960Z
@user12305 - unfortunately not.  I don't keep up particularly closely on DRM technology and it is constantly changing as increasingly severe exploits are found to bypass them.
AJ Henderson
CC BY-SA 3.0
2015-12-17T17:18:35.797Z
2015-12-17T17:18:35.797Z
AJ Henderson
<p>We want to provide VOD service via http/https, but we dont want users download a video by finding out the url directly from the web player or using a developer plugin like firebug. </p>

<p>We are told that only option for us is to implement DRM to protect video content.
Is it true that DRM is the only option?
If there are other options, please suggest it.
Any expert opinion is most welcome on this.
Thanks in advance.</p>

CC BY-SA 3.0
2015-12-16T23:40:04.317Z
I hope you get this direct-download issue solved.  I also want to point out that people can simply use screen-recording software (like Camtasia or even Snag-It) to record the video and audio as they watch it. The video quality will suffer slightly, but not by much. I don't think there is ANY way to prevent that!
BrettFromLA
CC BY-SA 3.0
2015-12-17T21:05:48.603Z
@BrettFromLA thanks for the head up. we are aware of such activities, but not worried at all about it.
Yaya
CC BY-SA 3.0
2015-12-18T07:25:16.857Z
don't you think youtube would have found a solution to that by now?
jiggunjer
CC BY-SA 3.0
2015-12-18T21:01:26.963Z
@jiggunjer keepvid.com lets you download videos from YouTube. They didn't figure out a solution, apparently.
BrettFromLA
CC BY-SA 4.0
2020-06-19T03:32:24.833Z
You could let people download the videos, but watermark every video with each user's name, so that you know  from whence leaks spring.  That, or reconsider your business model, because charging people for static content is a sinking ship.  Consider a service-oriented approach.
Jason Conrad
<video><streaming>
How to prevent users from downloading videos?
Yaya
# How to prevent users from downloading videos?

(Asked by: username_0 on 2015-12-16)

We want to provide VOD service via http/https, but we dont want users download a video by finding out the url directly from the web player or using a developer plugin like firebug.

We are told that only option for us is to implement DRM to protect video content.
Is it true that DRM is the only option?
If there are other options, please suggest it.
Any expert opinion is most welcome on this.
Thanks in advance.

**Tags:** video, streaming

> **Comments:**
> **username_1**: I hope you get this direct-download issue solved.  I also want to point out that people can simply use screen-recording software (like Camtasia or even Snag-It) to record the video and audio as they watch it. The video quality will suffer slightly, but not by much. I don't think there is ANY way to prevent that!  
> **username_0**: @username_1 thanks for the head up. we are aware of such activities, but not worried at all about it.  
> **username_2**: don't you think youtube would have found a solution to that by now?  
> **username_1**: @username_2 keepvid.com lets you download videos from YouTube. They didn't figure out a solution, apparently.  
> **username_3**: You could let people download the videos, but watermark every video with each user's name, so that you know  from whence leaks spring.  That, or reconsider your business model, because charging people for static content is a sinking ship.  Consider a service-oriented approach.  

---

## 3 answers

### Answer by username_8 on 2015-12-17. Score: 4 | Accepted answer

Unfortunately, no, that's the entire reason DRM exists. It is a bit like trying to prevent someone from recording an on-air broadcast. When you send video data over the internet to someone's player, they can simply store the information being sent to the player unless you obfuscate it and make it so that the player will only work under certain circumstances and will not share the data. This, by definition, is DRM.

What DRM attempts to do is control the reading of the data entirely, so that it can not be copied. This has varying degrees of success and rarely, if ever, works particularly well. It may keep honest people honest, but if you are sending someone data in a way that they can access it, measures to try to stop them from copying it are... difficult. The most advanced systems use special display drivers and encrypt the data right up to the point it is being displayed on the screen (HDCP), that way other software on the computer can't directly pull the information off the frame buffer being prepared for the screen.

There may be some ways you can mildly obfuscate the access to your video, but ultimately, if you send it in the clear, it is trivial for a knowledgeable viewer to store the datastream. If you use DRM, it is substantially harder, but still likely to be able to be worked around by a dedicated attacker.

> **Comments:**
> **username_0**: It is true that no security measure is ultimate. A determined attacker could break into any security system. Taking into consideration of normal users who are having average tech knowledge, I think DRM is the way to go. Thanks for the answer.  
> **username_8**: @user12305 - yes, but tools are created for people of average skill to bypass DRM.  I don't keep up to date on which systems are currently broken and to what level, but in general, DRM has a pretty horrible track record, though it's still better than just being unprotected if you need to try to keep it protected.  Just don't be surprised if it fails, especially if you go with poor quality DRM.  
> **username_0**: got it. would you be able to suggest any good quality DRM?  
> **username_8**: @user12305 - unfortunately not.  I don't keep up particularly closely on DRM technology and it is constantly changing as increasingly severe exploits are found to bypass them.  

---

### Answer by username_4 on 2015-12-16. Score: 1

Another option is single use URL/access tokens. But this could get complicated if the browser uses range requests, which is almost certain. And even then the user could still get around that with enough motivation. DRM is the only really secure way.

> **Comments:**
> **username_0**: Thanks for the input. We have already implemented expiring URL. but downside of it is that url is accessible for non logged in users until it expires. I guess that leaves DRM a better solution  

---

### Answer by username_5 on 2015-12-18. Score: 0

We started using a Vimeo pro account. It has the ability embed a player in a web frame and (I think) prevent downloading. You can specify what domain(s) can load the video file. The dev working on the site was able to remove all the default Vimeo interface overlay elements. It'll go live soon. I'll post the link when it does. I'd love to know if you guys/gals can obtain the file as we've tried to lock it up.

> **Comments:**
> **username_6**: That's no protection. Do post the link.  
> **username_7**: This simply stops someone from sharing the URL. There's browser plugins that allow you to download the video when on the whitelisted website. As long as someone know the URL, DRM (encryption) is the only way to go.  

---

