-
Notifications
You must be signed in to change notification settings - Fork 164
Problem
Some subscription providers implement two layers of access control on the client side:
image
1. User-Agent filtering
Providers block requests where User-Agent does not match their approved client list. Most mature clients already support overriding the UA, so this is a minor inconvenience at worst.
2. Device metadata headers
A more serious issue: providers require proprietary headers carrying device-specific metadata to be present in subscription fetch requests. Based on observed traffic, these typically include fields like:
x-hwid: <hardware id>
x-device-os: <os name>
x-ver-os: <os version>
x-device-model: <device model>
Without these headers, the server returns an error or empty config instead
All reactions
Replies: 1 comment 2 replies
The so-called "HWID" is a kind of DRM mechanism. I don't want to introduce or promote DRM or any other private HTTP authentication methods. It is better to refuse to use service providers that use DRM to restrict users.
All reactions
-
👍 1
As far as I know, hwid isn't used as DRM, but rather to limit the number of devices on a single subscription. There are actually more user-friendly methods for limiting this, but some providers don't use them, forcing them to install other proxy clients.
I like exclave, but I wouldn't want to share my device metadata.
All reactions
limit the number of devices on a single subscription
Yeah, I think this is DRM. It is also nonsense because the restriction can be easily bypassed. And supporting proprietary authentication methods is not a good idea.
All reactions
-
👍 1