Hello, Martin,

thank you (and the Foliovision team) very much for offering an FV Player addon extra for the security of Vimeo videos. It’s true: Vimeo offers enormous advantages as a video hoster – but shows weaknesses in the security of videos.

I got the FV-Player extension and already did first tests. As far as I could test it, the videos can no longer be downloaded via the DownLoadHelper. You wanted to check the security of the videos kindly once. Here is a link to a page where I added the videos with the extended security setting for Vimeo videos for testing: (redacted)

Unfortunately, I currently only allow my site to be accessed via Chrome browser. Because my videos were less secure with Firefox. After your tests I’d like to run the page over all browsers again. Maybe you can also test other download possibilities beside the DownLoadHelper. For me the security of the videos is very important and crucial for my service.

I have some questions about the settings:

1. In my settings for Vimeo-Pro (see image_1), there are no “Enable Quality Switching” and “Disable Video Caption” items, as shown in the Folivision Guide (see image_2). The first point is not so bad, because I always want to have the quality button on anyway. But I would like to remove the names of the videos (as they are called on Vimeo). How do I do that?

2. do I always have to use the “Alternative Referer”? Is this an additional security besides the “Enhance Security” option? I also used that in this case, like you said. The alternative referer is also not shown in the page source code.

3. At the bottom of the settings there is a “Convert Vimeo embed codes” button. Do I have to use it and always click up? What is this for?

4. In the page source you can access the Vimeo video link (e.g. https://vimeo.com/310411362 . Is that bad for video security? I saved the videos on private and not downloadable on Vimeo. Is that enough for the security of the links?

Thank you very much for the great support! I appreciate it.

Best Regards,
Hoshang

• This reply was modified 5 years, 5 months ago by Martin.

Thanks,

the setting would help me enormously if it prevents downloading via VideoDownloadHelper. When exactly will this be available (so that I can plan it a little better for my customer and the next steps)? I would try this out before I switch to the complex encryption of the videos.

Another question: as I see in your guide to Vimeo, there are already many setting options below Vimeo (Pro) area (see image 2 below). This is not shown, as you can see in image 1 above in my previous post. Why is that?

Best regards and many thanks for the great support and work on your side!
Hoshang

Hello Martin and Juraj,

thanks for the reply.

1. I have now already put in an crossdomain.xml -file in the bucket where my videos are with this content:
<?xml version=”1.0″?>
<!DOCTYPE cross-domain-policy SYSTEM
“http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd”&gt;
<cross-domain-policy>
<allow-access-from domain=”*” />
</cross-domain-policy>

2. I went through the step “ENABLING CORS IN AMAZON S3” (I am using S3) by putting in the CORS-Configuration part of the buckt this content:
<?xml version=”1.0″ encoding=”UTF-8″?>
<CORSConfiguration xmlns=”http://s3.amazonaws.com/doc/2006-03-01/”&gt;
<CORSRule>
<AllowedOrigin>*</AllowedOrigin>
<AllowedMethod>GET</AllowedMethod>
<MaxAgeSeconds>3000</MaxAgeSeconds>
<AllowedHeader>*</AllowedHeader>
</CORSRule>
</CORSConfiguration>

But I didnt figure out where exactly i have to put this line: Access-Control-Allow-Origin: *. What is meant by server – is it Amazon s3, where my videos are in? Can you please help me with this.

I get the following in the comnsole right now – see image1.

Thanks for your help,
Hoshang

Hey Martin,

i have enabled the HLS.js in the settings.

And then it is not clear what to do. Should I put the given Row (Access-Control-Allow-Origin: *) (see image1) somewhere? If yes where and how?

And also, do i need to go through the step “ENABLING CORS IN AMAZON S3” (I am using S3) and therefore put the given content (see image2) in the CORS Configuration of my usen amazon s3 bucket?

Do I also need a .xml file in the bucket? If yes, with which content?

Thanks,
Hoshang

Hello Martin,

the HTML source doesnt contains “fv_wp_flowplayer_hlskey_decoder”.
I also installed the FV Player Pro plugin as you recommended, but still the field fo the “Encryption key” doenst show off.

The Console shows that, what you mentioned (see image).
What does it mean – how can i can fix this issue?
Should i try to paste the hlskey with “hlskey=…” directy in a shortcode?
Is there a setting that i have to enable to get shown the HLS Key Field by using a .m3u8 file?

Thanks,
Hoshang

Hey Juraj,

i filled already the field with an .m3u8 ending Url, but still it doesnt show off a field for the encryption key. See the image below. What du you mean with : “It’s basically the same as with the documentation I mentioned in my previous response.”?

Thanks,
Hoshang

Hey Juraj,

as i understood, the guide tells: you need “either” cloudfornt or fix the file permission. So that both ways should workt. Also the step 24 of this guide tells that it ist also working wihtout cloudfront – see the image below. Is it wrong in the guide?

Thanks for reply,
Hoshang