Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.
Sign up to join this community
I am curious as to how this works as I see tiny GET requests every so often when watching videos (I am using youtube and big bang theory on cbs.com as examples) and the HTML and javascript seem obfuscated and thus difficult to understand.
I would just like to understand the general mechanism of how these videos are played back in the browser as opposed to a flash file to whose URI is easily found and could be downloaded?
Most of the time, they aren't - the Flash player simply requests parts of the publicly available file to play, most likely via RTMP, Real Time Messaging Protocol. Some providers will use encryption for some (Youtube, for example) or all of their files, most often RTMPS (RTMP over SSL, computationally expensive and secure) or RTMPE (RTMP using proprietary Adobe encryption, inexpensive and woefully insecure). Flash Media Server can also you client verification in an attempt to limit access only to clients that will not simply store the decrypted data, however the secret is widely known and this protection is therefore useless.
Regarding protecting the actual URL of the file, any number of techniques can be used - the server could, for example, give the client a key that is used to request the URL, but is valid only from a particular machine (as identified by, say, its IP address), a key that's only valid for a short time or one use, et cetera. Alternatively, the URL itself could be the key - linking not to the actual file, but to a fake location that is used to determine the target file and whether the connection is legitimate or not. Of course, if the actual transfer takes places over an insecure connection (RTMP, RTMPE, etc), it is still trivial to sniff the video in transit.
