Wowza SecureToken and FlowPlayer secure streaming plugin

[cegara]

Hi All.

I configured securetoken module as Security guide said.
I configured flowplayer plugin as flowplayer said: http://flowplayer.org/plugins/streaming/secure.html

But it does not work: on wowza i obtain this log:
ModuleSecureToken.onConnect: Action before response received: kill connection: clientId:182808838

FlowPlayer Conf:

<a
href="Extremists.flv"
style="display:block;width:520px;height:330px"
id="player">
</a>

<!-- this will install flowplayer inside previous A- tag. -->
<script type="text/javascript">
flowplayer("player", "../flowplayer-3.2.7.swf",
{
clip: {
url: 'mp4:sample.mp4',
provider: 'rtmp',
conectionProvider: 'secure'


},
plugins: {
rtmp: {
url: '../flowplayer.rtmp-3.2.3.swf',
netConnectionUrl: 'rtmp://<ip>/rtvcdmsecured'
},
secure: {
// path to the latest version
url: '../flowplayer.securestreaming-3.2.3.swf',
// a secure token
token: 'passtest'
}
}
}
);
</script>

secure token module conf ( Application.xml ):

<Module>
<Name>flvplayback</Name>
<Description>FLVPlayback</Description>
<Class>com.wowza.wms.module.ModuleFLVPlayback</Class>
</Module>
<Module>
<Name>ModuleSecureToken</Name>
<Description>ModuleSecureToken</Description>
<Class>com.wowza.wms.plugin.security.ModuleSecureT oken</Class>
</Module>
</Modules>
<!-- Properties defined here will be added to the IApplication.getProperties() and IApplicationInstance.getProperties() collections -->
<Properties>
<Property>
<Name>secureTokenSharedSecret</Name>
<Value>passtest</Value>
</Property>
</Properties>

Any Help please.

[rrlanham]

The token has to be compiled into the swf. You can refer to the JW Player guide for doing this:

http://www.wowza.com/forums/content....to-JW-Player-5

In Flowplayer the file will be different, but the NetStatusEvent that is used will be the same.

This is how to compile Flowplayer:
http://flowplayer.org/documentation/...vironment.html

Richard

[cegara]

Hi rrlanham

The Flash player have to be FlowPlayer, and in the flowplayer page the token could be placed on javascript code almost to test purposes.

The flowplayer forum not answer my qustion, I appreciate your support.

[rrlanham]

As far as I know, you have to compile a new SWF. Adding a token to javascript is not very secure, and I just don't know if or how that works. I think I tried it awhile ago and it didn't. You might want to hire a Flash developer to help. We have a list of independent consultants. Write to support@wowza.com if you want us to send that. Include a link to this thread.

Richard

[willwh]

Richard is correct, as usual

Compiling plugins for flowplayer is not too bad; http://flowplayer.org/documentation/...vironment.html <- this guide is a good start.

I had no problems compiling new securetoken plugins with the key embedded using the flex sdk on linux, just make sure you follow the guide closely, and make all the needed changes to build.properties and plugin-build.properties to match your env.

[aigars]

Compiled without problem. Just follow guide and all will be fine.

[bobmane]

As far as I know, you have to compile a new SWF. Adding a token to javascript is not very secure, and I just don't know if or how that works. I think I tried it awhile ago and it didn't. You might want to hire a Flash developer to help. We have a list of independent consultants. Write to support@wowza.com if you want us to send that. Include a link to this thread.

Richard

but how secure is using the swf? cant they just download and recomplie the swf?


isnt that why there are vendors who are selling token systems that don't rely on the swf?

i was told:

Protecting a swf (hash internal) is not best case and there are a multitude of programs that can strip that data out. Instead you should take the approach that you do a secure call into the system to generate hotlinking so you do not have a hardcoded hash. Protecting the swf better then becomes obsolete if are doing an external call.

so what is wowza position on this?

[rrlanham]

We think that whatever you do for security will help. I think that there is no way to absolutely prevent and make impossible theft of content except by not distributing it. Charlie has made the point that one-off or custom security features, like what you mention, are very good even if they aren't that good, just because it is one more thing to deal with for the bad actor, and being unique or custom will take dedicated effort to defeat.

SWF files can be decompiled by someone that knows that and has the tools to do it; then they can sift through the code to find your SecureToken so they can steal your content. That takes some effort and know-how. If you use an obfuscator, that becomes much more difficult, but still not impossible.

Take a look at the Security Overview article:
http://www.wowza.com/forums/content....urity-overview

Richard