Adobe DE 4 spies on users

[Xanthe]

With all of the previous problems with Adobe, I never even bothered to put ADE/Reader on this computer. It's Win 8.1 anyway, so I can use the Overdrive app if need be. I also strip the DRM off my purchased ebooks so I can use them on all of my devices.

My library uses Overdrive but when I tried to take out desired ebooks on my previous computer, they'd only have only one or two copies (if they had the ebook at all) and the waiting list would be 20+ people. It wasn't/isn't worth the bother. I think the last time I actually used ADE in order to take out a library books was back when I was regularly using my Aluratek Libre, which is several computers ago.

[Froide]

Originally Posted by FizzyWater

I believe what he was saying that by bringing it to Adobe's attention, they will not stop the activity, they'll only encrypt it to make it less obvious what they're doing.

[Ripplinger]

I always use Sony Reader Library to download my library books and it's worked perfectly. I haven't run into any epub3 books yet though. Wonder if I can uninstall Adobe ADE completely and get rid of all things Adobe.

[Froide]

Anyone remember this?

"RealNetworks Breached Privacy, 3 Suits Contend. (Consumers: Firm admitted collecting data on users of its Internet software, provoking the first class actions in such a case.)" LA Times.
November 11, 1999|GREG MILLER | TIMES STAFF WRITER

Or this?

"Sony digital boss - rootkit ignorance is bliss. (But IT Depts beg to differ.)" The Register.
By Andrew Orlowski, 9 Nov 2005

[Froide]

Adobe's response:

Source -
The Register: "Adobe spies on readers: 'EVERY page you turn, EVERY book you own' leaked back to base (App sends data over the net unencrypted)".
By Iain Thomson, 7 Oct 2014

We've asked Adobe for an explanation of what exactly is going on and the firm has said that it's looking into the matter. With a lot of staff currently attending the AdobeMAX conference in Los Angeles this may take some time. ®

Updated to add

Adobe says it simply has to log every page you turn to tackle piracy.

Here's the article that "to tackle piracy" link takes you to:

The Register: "Adobe spies on reading habits over unencrypted web because your 'privacy is important' (Is Adobe facing its Sony rootkit moment?)"
By Iain Thomson, 8 Oct 2014

[Rizla]

Book 'em, Danno.

[Lynx-lynx]

@froide thanks for posting that info.

I don't get it - why does adobe need to view the pages one selects to determine the DRM status. Unless of course every page has DRM embedded in it.

And it seems to me that Adobe is stealing my books and book information if it is accessing Calibre on my PC. Does it also read the now converted Amazon ebooks and send that info back to it's base as well?

[j.p.s]

Originally Posted by dmck

Poor man's solution? Ignorant? Hardly. Outgoing firewall's are useless for most people. On the other hand, the hosts file is a low cost, no software installation method which already exists on your PC to route (or block) ip addresses or hostnames.

It doesn't scale, and if you run any services it can cause problems. I also wrote that in proactice it works OK. I stand by my entire post.

[FizzyWater]

Originally Posted by Lynx-lynx

@froide thanks for posting that info.

I don't get it - why does adobe need to view the pages one selects to determine the DRM status. Unless of course every page has DRM embedded in it.

And it seems to me that Adobe is stealing my books and book information if it is accessing Calibre on my PC. Does it also read the now converted Amazon ebooks and send that info back to it's base as well?

In the Republic article, it mentioned that Adobe said some of these will allow business to offer varying types of products (read 2000 pages a month for $$). Fine, and if I choose to subscribe to such a deal, then turn on the feature. But this is definitely something we should be opting into by choice.

[Marcy]

I just checked my version of ADE and I'm still using 1.7.2. It works fine and I'm glad I don't upgrade stuff without a pressing need.

I did an online search and you can still find the 1.7.2 installer which I downloaded and saved, just in case.

[dmck]

Originally Posted by j.p.s

It doesn't scale, and if you run any services it can cause problems. I also wrote that in proactice it works OK. I stand by my entire post.

When you say "doesn't scale" does that mean it doesn't work in an enterprise or just at home with multiple devices/PCs. Perhaps stating an alternative solution would be beneficial to some: "Instead of editing the hosts file, those owning routers with website/IP address blocking, for example, could add the IP address and hostname to the blocked list."

FYI, blocking those IPs doesn't impact other aspects of ADE from what I can tell.

What is your recommended method to block adobe from phoning home?

[mandy314]

The german it-news site heise.de (http://www.heise.de/newsticker/meldu...s-2412910.html) reports they have reproduced ADE 4's sending home of plain text usage data, but not (yet) the scanning of local storage for ebook files.

Ok - the net isn't an extension of our homes but a very public place (which I think we enter more or less naked). With all the media use over the net we do enter this public place for our convenience mostly. Think about all the data needed only for syncing reading positions between devices/apps:
- book a opened at pos x at time 123 on device abc
- book a closed at pos y at time 234 on device abc
- book a opened at pos y at time 345 on device def
...
And the book has to be identified (meta-data), logs have to be kept update if the devices/apps are used offline. So with that alone there is a good database of our reading habits on external servers (your ebook provider, drm service) which may be used for data mining.
We can still trade in convenience for more privacy not buying DRMed books, not using syncing services etc. and still enjoy our ebooks offline.

Iirc the early Kindles where rumored to send a good deal of usage data home. Early iTunes versions scanned our hard drives for music files, didn't they? The rationale was the data being used for market research aiming at improving the services for the consumer. But why needs Adobe - not being a publisher or retailer afaik - data about our reading habits?
I see some big players in the industry pushing towards an always online, streaming only distribution of ebooks with books- or even pages-based flatrates as the coming business model. They are testing the waters with various offers and collect user data. If they see it working they will do it.
For me at least "ereading/ebooks" could be a short episode of my reading history.

[Froide]

Originally Posted by Lynx-lynx

@froide thanks for posting that info.

I don't get it - why does adobe need to view the pages one selects to determine the DRM status. Unless of course every page has DRM embedded in it.

And it seems to me that Adobe is stealing my books and book information if it is accessing Calibre on my PC. Does it also read the now converted Amazon ebooks and send that info back to it's base as well?

Iain Thomson's article of 8 October 2014 - The Register: "Adobe spies on reading habits over unencrypted web because your 'privacy is important' (Is Adobe facing its Sony rootkit moment?)" - breaks it down, based on what Adobe published:

Adobe explained that the data it collects is for digital rights management (DRM) mechanisms that may be demanded by publishers to combat piracy, and gave a detailed list of what and why it needs such specific information:

• User ID: The user ID is collected to authenticate the user.
• Device ID: The device ID is collected for digital right management (DRM) purposes since publishers typically restrict the number of devices an eBook or digital publication can be read on.
• Certified app ID: The Certified App ID is collected as part of the DRM workflow to ensure that only certified apps can render a book, reducing DRM hacks and compromised DRM implementations.
• Device IP: The device IP is collected to determine the broad geo-location, since publishers have different pricing models in place depending on the location of the reader purchasing a given eBook or digital publication.
• Duration for which the book was read: This information is collected to facilitate limited or metered pricing models where publishers or distributors charge readers based on the duration a book is read. For example, a reader may borrow a book for a period of 30 days. While some publishers/distributers charge for 30-days from the date of the download, others follow a metered pricing model and charge for the actual time the book is read.
• Percentage of the book read: This information is collected to allow publishers to implement subscription models where they can charge based on the percentage of the book read. For example, some publishers charge only a percentage of the full price if only a certain percentage of the book is read.

Additionally, the following data is provided by the publisher as part of the actual license and DRM for the ebook:

• Date of purchase or download
• Distributor ID and Adobe content server operator URL
• Metadata of the book provided by publisher (including title, author, publisher list price, ISBN number)

[ShellShock]

How does this logging "combat piracy" as Adobe claim? One could argue that the existing Adobe DRM attempts to combat piracy, but the logging could only ever be used to demonstrate that piracy exists, which we know already, and how widespread it is. It is just a bogeyman which Adobe can use to scare the publishers with and to justify the money Adobe charge for their DRM. Adobe NEEDS piracy so it can make money out of its DRM. The logging is just a scam and the publishers and we the consumers are being taken for a ride.

[HarryT]

Originally Posted by ShellShock

Adobe NEEDS piracy so it can make money out of its DRM. It is just a scam and the publishers and we the consumers are being taken for a ride.

Can you explain in what way the time-limiting DRM provided by Adobe and used by libraries is a "scam", and in what way we are being "taken for a ride" by it? Do you honestly think that any mainstream publisher would be willing to provide ebooks to libraries without some form of expiry for loans? Libraries need DRM, and Adobe provides it.