iv-org / invidious

Invidious is an alternative front-end to YouTube
https://invidious.io
GNU Affero General Public License v3.0
16.28k stars 1.81k forks source link

[Enhancement] Fix the decrypt function - the decryption of the encrypted videos #3245

Open unixfox opened 2 years ago

unixfox commented 2 years ago

Currently, the decrypt function doesn't work anymore.

For example, encrypted age-restricted videos won't load anymore as we fetch them not through the special ANDROID user agent that allow to have decrypted URLs for all videos, but instead through the TVHTML5_SIMPLY_EMBEDDED_PLAYER agent.

PrivacyDevel commented 1 year ago

Here are some videos that seem to cause this bug: hc0ZDaAZQT0, 7a0qw5Ziqm8

The bug seems to currently affect some instances but not others. Here is a list of instances that are now able to play these videos but didn't use to: https://github.com/PrivacyDevel/DPR-addon/commit/c36b7a68ea5bea403b03cff2baad59a6a02029d7

It is also possible that one of these videos works on one instance but not the other one as well. The instances on this list manage to play both.

PrivacyDevel commented 1 year ago

Late update: some invidious instances may or may not play those videos. None of them managed to play them reliably over a longer period of time.

As far as I am aware only my Invidious instance is able to play them reliably because of the patch that I made so that it uses the Piped-Backend in the background to get its videoplayback urls.

user234683 commented 1 year ago

Is it known why it's not working? I have the same decryption method implemented in youtube-local and I'm getting 403s even though parsing the function is working fine. What is yt-dlp doing differently? It doesn't seem to be the nsig decryption (I used --verbose in yt-dlp, took one of the decrypted URLS, undid the nsig decryption, and it still loaded for this decryption-required age restricted video: https://www.youtube.com/watch?v=fV4LHzN_ZKY)

unixfox commented 1 year ago

The decryption function is completely outdated, nowadays it's a big JavaScript file that need to be evaluated then the result is the decryption key.

Someone tried to push a fix here: https://github.com/iv-org/invidious/pull/2222