W3C Approves EME DRM Standard for the Web, Security Researchers Worried About Flaws

The World Wide Web Consortium (W3C) announced a new standard called EME, or Encrypted Media Extensions, this past week that adds copy protection to web-based streaming video. This means that streaming sites like Netflix and Amazon Prime Video will be able to protect their content without asking you to install plugins like Flash. But the publishing of the standard is being seen as favouring convenience over freedom.

The EME is a standard that supports encrypted multimedia content on the Internet. For copyright holders, EME is being seen as way to implement DRM platforms in browsers to protect streaming rights for companies like Netflix. But experts like Cory Doctorow feel that the EME standard mostly benefits copyright holders only.

Security researchers, for example, will have a tough time looking for bugs and disclosing security vulnerabilities inside DRM platforms as they will need to get the approval of DRM platform owners. So researchers won't be able to flag an issue, like warnings of epileptic seizures, for example, without the approval of the owner, which could leave the bug potentially unanswered for years.

Similarly, Doctorow explained on the Electronic Frontier Foundation (EFF)'s blog that those who try to bypass DRM for legal purposes, such as finding out vulnerabilities or adding subtitles for the disabled, can face civil and criminal penalties. He states that DRM limits, or in fact, outright prevents the owner of a computer from exercising their rights to do what they wish when they acquire a copyrighted work.

In fact, EFF fought against the standard published and has suggested a compromise wherein the W3C members promise to use the law to attack only those who infringe the copyright work, and not those who use it for legal reasons like making W3C-standard videos more accessible for people with disabilities.

However, many of the W3C members have disagreed with the concerns and believe that the DRM standard is in fact better for accessibility and proved more privacy protections for browsers. For plugin developers, W3C simply wants to them to adapt to the new standard rather than force plugins like Flash. As of now, the new standard seems pretty binding and W3C may improve the extensions with revisions in the future, but what's clear is that EME is here to stay and one may as well get used to it.