The DRM Wrapper
When the video is the business, the URL can't be the security.
The incident
The course library was the entire company — years of production, priced accordingly. A browser extension downloaded any lesson in one click, because the 'protection' was that the URL was hard to guess. The pirated bundle appeared on a forum within a month, at zero dollars.
Why the obvious approach fails
Obscure URLs aren't protection — they're delay. Any URL the player can fetch, an extension can fetch, and one paying subscriber can supply the whole internet. Watermarking and takedowns fight the copies after they exist. Real protection changes what a downloaded file is: encrypted segments that are garbage without a key, and keys that are short-lived, per-viewer, and issued only to authorized sessions. It won't stop a nation-state pointing a camera at a screen — nothing does — but it moves piracy from one click to real effort, which is where most of it stops.
The standard
- Video segments are encrypted at rest (AES-128 as the floor); a downloaded segment without a key is noise.
- Decryption keys are short-lived, signed, and issued per authorized viewer session — never embedded in the page or manifest.
- Key requests are authorization checks: subscription state and session validity gate every issue.
- Studio-grade tiers use platform DRM (Widevine, FairPlay) where the content contracts demand it.
- Key issuance is logged per user — anomalous key volume from one account is an alert, because it's how stream-ripping looks.
How Cortex validates it
At plan time
premium-content blueprints declare the protection tier, key lifetime, and authorization gate before build.
At validation
assert: segments.at_rest == encryptedassert: key_issue.requires(valid_session, entitlement)assert: key.ttl <= declared && key.scope == per_viewerAssertion syntax is illustrative.
At review
the approver sees the exfiltration test: segments pulled without a session are unplayable, an expired key is refused, and the issuance log traces every grant.