Videos hotlink protection

[bplex]

This can happen to any site that allow hotlinking.

Duh... This is what we are trying to avoid. The problem is that disallowing hotlinking doesn't actually disallow hotlinking anymore. Newer browsers such as Firefox 3 and IE 8 (beta) pass referrer information without having to actually be on the site. When those browsers become more prominent, this will almost negate any efforts to prevent hotlinking with methods currently in place. Thus, people like myself are finding new ways to help prevent hotlinking.

I see some site pass video id to FLV player and it fetches the url. Anyone with a proxy to monitor access or having flash decompiler can break it.

Yeah, but at this point, we are talking about users who know what they are doing. No hotlinking protection is going to be fool proof. People are always going to be able to get around blocks and such. The issue is not trying to make something that is fool proof. Rather, we are trying to come up with something that prevents people from being able to do it easily. As I stated before. Anything that can be read or displayed by a browser can be copied. What we are trying to do is come up ways to make it harder to copy.

[RAMMSTEIN]

What we are trying to do is come up ways to make it harder to copy.

Yes that is true because are videos are not protected at all. Every user can see where the flv is hosted when he open the player source and they make a download link easy. Every week i have to change the video folder name due to this issue and i do not allow embed code for that. :(

[bplex]

Just another status update on where I am at:

1. Stream Security - I'm still working on a way to protect the actual stream. As it stands right now, someone could put up a different player on another site and use your stream to play videos outside of your player. I'm working to prevent this.

As of right now, I have created a simple method to protect the stream. It's not 100% fool proof. Someone could probably still record the stream (or download the file using programs like Orbit). However, directly linking to the stream would be difficult to do. I'm still working to find a method of securing the stream from the RTMP side of things... well, at least a free method. This would provide greater security against hotlinking. It would probably not add any for those who wish to actually download the file.

2. Multi-server Support - Because the files have to be stored on the streaming server, multi-server setups would require streaming server software setup on your secondary servers (which isn't a problem to do). To do this, the streaming URL needs to be dynamic. This is very simple to do. I just have to do it.

Haven't touched this yet, but, as I stated before, this should be fairly simple to do.

As of right now, setting up all of this isn't going to be simple. Straightforward, but not simple. When I'm actually done with everything, I'll probably start a new topic and leave this one for the official hotlink protection that we have been hearing about for 2.7.

[mersh]

Don't you think they are just running a Flash streaming server?

[bplex]

They are. That is what RTMP is.

[RAMMSTEIN]

i would like to ask something.It is possible to make FTP accounts if you have a RTMP server because if you can't the RTMP server is not a solution. Thee reason is that you can not have multiserver feature.


A good way for the file protection is this ( i found this at a online geme site )

Built-in Anti-Hotlinking / Hotlink Protection :: Over the past months the act of hotlinking games has been a growing concern for online arcade owners and we made it one of our top priorities to come up with a powerful solution. Tested in IE 6.0-7.0, FireFox and even Netscape, the built-in hotlink protection module has done its job. When activated, instead of displaying the actual filename of the game being played, phpAS will display a uniquely generated name each time the game is loaded, thus not allowing hotlinkers to link to your game files.

Their PHP code to protect the swf file

<?php
session_start();)
error_reporting(0);

$code = $_GET['code'];
if ($code != $_SESSION['playcode'])
exit;

include ("./includes/config.php");

$gameid = $_GET['gameid'];

$sql_query = "SELECT * FROM games WHERE gameid = $gameid";
        //store the SQL query in the result variable
		    $result = mysql_query($sql_query);
		    if(mysql_num_rows($result))
		    {
		    //output as long as there are still available fields
		    while($row = mysql_fetch_array($result))
		    {
		    
		    $gamefile = $row['gamefile'];
		    $gamelocation = $row['gamelocation'];
			   }
         }

    if ($gamelocation == 1)
    $gameurl = $gamefile;
          
    else
    $gameurl = "./games/files/".$gamefile;


    $file_extension = strtolower(substr(strrchr($gamefile,"."),1));
    switch ($file_extension) {
            case "swf": $ctype="application/x-shockwave-flash"; break;
            case "wmv": $ctype="application/x-mplayer2"; break;
            default: $ctype="application/force-download";
    }
    header("Content-Type: $ctype");

    
echo file_get_contents($gameurl);

$_SESSION['playcode'] = "gameover";

?>

A demo protected game is here. http://www.247arcade.com/games/970/w...sion-mode.html

[bplex]

RTMP is not an appliance. It's a software that you run on your server. You can FTP to it like any other server. The code that you have below is only a portion of the code. The code that I have written is similar to what you posted. I will be posting my solution in the next couple of days.

[ramius]

RTMP is not an appliance. It's a software that you run on your server. You can FTP to it like any other server. The code that you have below is only a portion of the code. The code that I have written is similar to what you posted. I will be posting my solution in the next couple of days.

Thank you bplex I will really appreciate a solution for this!:)

[bplex]

Ok guys:

After working on this for over a week, I have finally ironed out the kinks and have created a working RTMP setup for vShare. Please note that a step-by-step on this is going to take some time as the setup is not quite as easy as other systems. I will be opening another post for people who would like to do something like this and will explain more about this in that posting.