-
In testing access to the FV playback of my private videos via Firefox Developer Inspection tools, I’ve found that the URL generated by the FV Plugin does Not Timeout — which is a serious problem.
Here’s a sample setting of S3 Server Permissions assigned to all my Private Videos — https://prnt.sc/sj9g4m
Here’s my FV Player Settings in WP for AWS S3 — https://prnt.sc/sj9ai2
Lastly Here’s what I’ve done to test the security FV is providing over access to my videos, which is no security at all — https://prnt.sc/sj979k
What follows is a SAMPLE of a FV GENERATED URL that can be copied and posted anywhere to gain FREE UNRESTRICTED ACCESS to videos THAT I THOUGHT WERE BEING PROTECTED — I NEED TO KNOW HOW TO SETUP FV PLAYER TO PROVIDE THE PROTECTION I NEED.
-
-
In the above sample URL it shows “Expires=900” — Is this the value that determines when the video expires? If so whatdoes the 900 represent in minutes/seconds? When I used to use the S3Flowshield player, I set the timeout to occur in 5 seconds after loading.
And so if this 900 represents 900 seconds then is the link active for 15 minutes? This is way to long because it certainly allows for the URL to be used to download the video.
By then in viewing the WP Settings for FV (https://prnt.sc/sj9ai2) I see that the Default Expiration Time is set in MINUTES, Not SECONDS. And so even 1 minute is enough time for the URL to be copied and used to download the video.
Futher I left that Default to Zero, as I was told that by Enabling the Ajax setting that the value in this field s/b Zero — Is this correct? And also, that FORCE DEFAULT EXPIRATION TIME setting also is not needed for the Ajax setting.
So, what does the Ajax setting do? Should I Disable it and enable these other two settings? And is there any way that the setting can be set lower than 1 minute.
Also, I do recall a past issue that arose if the expiry was set lower — I think that it was either a page refresh would not allow reaccess, or there was some sort of buffering issue if the timeout was set too low. Can you clarify this too?
Hello dplum,
AWS lets you protect the videos agains hotlinking and some basic video downloading tools. But these days you can get browser extensions which let you download such videos.
We set the minimal expiration time to 900 seconds (15 minutes) to provide a safe minimal time to buffer the video. Recently we did some improvements on that part, so even a much shorter values could be used. With exception of iOS which just doesn’t trigger proper errors for us to catch when the link times out.
But to really protect the videos from downloading you need a proper DRM. FV Player Pro does give you encrypted HLS which is about to get a lot easier with our new plugin which will integrate the Coconut video encoding service.
Then we would like to explore the DRM provided by EzDRM service.
Thanks,
MartinI’m unfamiliar with HLS, could you point me to some tutorials on this way of delivering videos?
Also, when you say a “new plugin” — do you mean an enhanced version of FV Player? If so, when do you expect it to be available?
Hello Denis,
we are finishing the user guide for that FV Player Coconut plugin now: https://foliovision.com/player/securing-your-video/encrypt-videos-directly-wordpress
Thanks,
MartinHello Martin,
This is great news. When will the Coconut plugin be available?Regards.
JuliusHello Julius,
FV Player Coconut can be obtained here: https://foliovision.com/downloads/fv-player-coconut
It’s a free addon, so you can just log into your exiting foliovision.com account and get it. Note that you have to use the FV Player Pro plugin together with it to be able to get the video encryption features.
In case of any issues please check the documentation here:
1) Setup guide: How to Setup Encrypted HLS with Coconut https://foliovision.com/player/securing-your-video/setup-encrypted-coconut
2) End-user guide: How to encrypt videos directly in WordPress with Coconut https://foliovision.com/player/securing-your-video/encrypt-videos-directly-wordpress
Please let us know if you run into any issue when following our documentation.
Thanks,
Martin
