Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am curious as to how this works as I see tiny GET requests every so often when watching videos (I am using youtube and big bang theory on as examples) and the HTML and javascript seem obfuscated and thus difficult to understand.

I would just like to understand the general mechanism of how these videos are played back in the browser as opposed to a flash file to whose URI is easily found and could be downloaded?

share|improve this question

closed as not constructive by Ƭᴇcʜιᴇ007, TFM, Tog, HackToHell, Dennis Feb 25 '13 at 13:11

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

Most of the time, they aren't - the Flash player simply requests parts of the publicly available file to play, most likely via RTMP, Real Time Messaging Protocol. Some providers will use encryption for some (Youtube, for example) or all of their files, most often RTMPS (RTMP over SSL, computationally expensive and secure) or RTMPE (RTMP using proprietary Adobe encryption, inexpensive and woefully insecure). Flash Media Server can also you client verification in an attempt to limit access only to clients that will not simply store the decrypted data, however the secret is widely known and this protection is therefore useless.

Regarding protecting the actual URL of the file, any number of techniques can be used - the server could, for example, give the client a key that is used to request the URL, but is valid only from a particular machine (as identified by, say, its IP address), a key that's only valid for a short time or one use, et cetera. Alternatively, the URL itself could be the key - linking not to the actual file, but to a fake location that is used to determine the target file and whether the connection is legitimate or not. Of course, if the actual transfer takes places over an insecure connection (RTMP, RTMPE, etc), it is still trivial to sniff the video in transit.

share|improve this answer
I think the question is about how the file URLs are protected/hidden, rather than the file contents. "as opposed to a flash file to whose URI is easily found and could be downloaded"- – TFM Feb 25 '13 at 3:59
Yes @TMF this is what I meant. I should have worded the question better. I will try to reword and reopen it. – Fred Thomsen Feb 25 '13 at 18:32

Not the answer you're looking for? Browse other questions tagged or ask your own question.