Tamper-proof ePub Ebooks?!

[fargo]

ePub has made it very easy for end users to reach ebooks' source code and change as they like. Contents and copyright information are wide open for anyone to change!

So, the question is: how can I ensure end users would not tamper with ebooks published in DRM-free ePub format?

[deltop]

DRM-free epubs? Then you can't. Even if you add drm users can strip that. Trying to stop users manipulating data is futile.

It's not just epubs, mobi and eReader files can also be manipulated.

Can I ask why you would want to stop users tampering with your epub files?

[Jellby]

If you want to certify that a given ePUB has not been modified, you can use a PGP signature, or a hash like MD5 or SHA-2. This does not prevent someone to modify the file, but you can tell (and let other people do the same) whether or not it has been modified.

[fargo]

Why I need to protect my ebooks against tampering? A good question! Well, I know some people who wouldn't publish anything in any format other than password-restricted PDF format.

I've thought of using digest, but the problem is where to put it? I mean, anyone can open the .epub and remove the hash value. Readers wouldn't notice that since message digest is not part of the standard after all!

[Jellby]

Originally Posted by fargo

I've thought of using digest, but the problem is where to put it? I mean, anyone can open the .epub and remove the hash value. Readers wouldn't notice that since message digest is not part of the standard after all!

No, the only way is posting the right hash somewhere, like in your homepage, so that readers can check whether they have the correct and certified version. It won't warn readers of a modified version, but anyone can check if they have the original version or a modified one.

(PDFs can be modified too, password-protected or not )

[rhadin]

Originally Posted by deltop

Can I ask why you would want to stop users tampering with your epub files?

If I was an author, I would want to prevent tampering because it is the only way I can assure consumers that they are getting the authentic product.

On another forum there was a discussion about ebooks vs. pbooks, and I was one of the few, if perhaps the only one, who believed that ebooks will come to dominate fiction but not scholarly work, at least for the foreseeable future, precisely because of the problems of vetting of authors and authenticity/accuracy of the text. Although I don't rely on fiction for anything more than entertainment, I do rely on scholarly works to expand my knowledge. It is in this ara that there is a need for the vetting process that scholarly publishers provide and for the pbook's (at least in today's world) assurance that I am getting what the author wrote and not what some unknown file manipulator wrote.

I suspect that fiction authors also take pride in their authorship and would be distressed to learn that their labor has been thwarted by some viral reader who manipulated their text and changed the story.

[Rootman]

Yes, you can't have your cake and eat it too. No DRM means changeable - even DRM's can be cracked to allow change and most are.

Perhaps put the copyright info in a cover image on a noisy background? Someone would have to take a lot of effort to change it and if you would have to therefore warn your readers to look for the image to ensure they have a genuine article. It may help, just help mind you because there is nothing keeping someone from simply DELETING the image.

Also put your info at the FRONT and BACK of the book. Most pirates are lazy louts and may not look at the end.

[fargo]

Thank you for the great post Richard.

Originally Posted by Jellby

(PDFs can be modified too, password-protected or not )

Could you please direct me to a source or a tutorial explaining how to modify password-protect PDFs while preserving their certificates?

[HarryT]

Originally Posted by rhadin

If I was an author, I would want to prevent tampering because it is the only way I can assure consumers that they are getting the authentic product.

Sounds like paranoia to me, I'm afraid. If you publish a paper book, what's to stop someone from "tampering" with that? Cutting out a page and replacing it with a different one?

There are lots of more important things in life to worry about, IMHO .

[fargo]

Originally Posted by HarryT

Sounds like paranoia to me, I'm afraid. If you publish a paper book, what's to stop someone from "tampering" with that? Cutting out a page and replacing it with a different one?

Nothing would stop someone to do that to a pbook. I'm sure, though, that the tamperer would not find a publisher to publish 'hiz' new book. He and his grandson may be the only ones reading the counterfeit book

It is totally different with ebooks. A counterfeited book can spread as the authentic one, if not even wider.

[Jellby]

Originally Posted by fargo

Could you please direct me to a source or a tutorial explaining how to modify password-protect PDFs while preserving their certificates?

I have removed passwords from PDFs with some windows program (whose name I don't remember). I have removed print/copy restrictions from PDFs with pdftk (I had to modify the source code, but it was very, very easy).

Why do you need to preserve the certificates? Someone willing to alter the text would remove any certificate too, and the recipients of the modified file will have no way to know it has been modified (other than going to the original source and realizing that "hey! why doesn't my file have a password?", which is basically equivalent to providing a hash/signature/digest).

[Valloric]

Originally Posted by rhadin

If I was an author, I would want to prevent tampering because it is the only way I can assure consumers that they are getting the authentic product.

On another forum there was a discussion about ebooks vs. pbooks, and I was one of the few, if perhaps the only one, who believed that ebooks will come to dominate fiction but not scholarly work, at least for the foreseeable future, precisely because of the problems of vetting of authors and authenticity/accuracy of the text. Although I don't rely on fiction for anything more than entertainment, I do rely on scholarly works to expand my knowledge. It is in this ara that there is a need for the vetting process that scholarly publishers provide and for the pbook's (at least in today's world) assurance that I am getting what the author wrote and not what some unknown file manipulator wrote.

I suspect that fiction authors also take pride in their authorship and would be distressed to learn that their labor has been thwarted by some viral reader who manipulated their text and changed the story.

We've had file checksums for a very, very long time. In fact, knowing that you can produce the checksum and compare it to the publisher provided one (which could in turn be explicitly authenticated with public key cryptography) makes electronic publishing much more secure than p-books if needed.

Anyone can replace a page in a p-book, as Harry said. Or even the whole book. You'd be none the wiser.

[Jellby]

Originally Posted by Valloric

Anyone can replace a page in a p-book, as Harry said. Or even the whole book. You'd be none the wiser.

Hey! You can even change the author of a p-book!

[HarryT]

I'm afraid that it strikes me as a rather odd thing to worry about. You have the protection of copyright law, should someone be silly enough to actually do it.

[clarknova]

Originally Posted by fargo

It is totally different with ebooks. A counterfeited book can spread as the authentic one, if not even wider.

How? By hijacking the distribution site of the eBook? A counterfeited book can be spread to people who are infringing on copyrights. I don't see why an author or publisher should really care whether or not people who didn't buy the book get the real one or not?

Even if the ebook is freely redistributable, why would someone bother downloading it from anywhere besides the original source?

You're inventing problems that don't exist.