Chrome Version       : 62.0.3202.62 (Official Build) (64-bit)
OS version               :windows 7,8,10.

Audio/Video format (if applicable):.mp4

This is the security issue of youtube which directly allows users(with minimal technical skills) to download videos from the youtube directly without any tool.



What steps will reproduce the problem?
(1)Open the youtube browser and acess the desired video with url. 
(2)Change the url extension to mobile version by adding m before url. 
(3)Open the developer tools and then Tap on devices and select device as any 
   mobile.
(4)Tap on video than download button appears and then click on download button. 
(5)Video will be saved in downloads with videoplayback.mp4 as file name and format will be automatic and depends on browser.
(6)open the video with any of the media player and can be played. 

What is the expected result?
Videos are encrypted using key and streaming occurs in form of discrete memory chunks which makes the video streaming secured and helps youtube from preventing copying or downloading

What is the actual result?
Videos can be downloaded if this technique is followed but at same time youtube security breaches.

Any additional information (anything else which may help us debug the
issue)?
This issue is due to the chrome video embedding tag in html and due to which all the necessary video controls for controls are exposed along with download option.
It can be rectified if the video controls are disabled and encryption method is preserved same as desktop version.


Please attach the HTML5/JavaScript code or audio/video files as well as
screenshot and/or videos (if applicable)
Attached is the document which describes how to reproduce issue.

 

Deleted: Way to download youtube video with out any external tool.pdf 820 KB

Way to download youtube video with out any external tool.pdf 820 KB Download