Adobe DE 4 spies on users

[jackie_w]

Originally Posted by jhempel24

Why would it be pulling things from Calibre as in this example?? Or am I reading this wrong?? Especially if it's coming from Baen, which I didn't think used ADE or any sort of DRM.

It's possible you could be reading it wrong. I can't comment on ADE because I don't use it, but I did download a free BAEN book from Kobo last week. Its opf file already contained these 2 lines:

<meta name="calibre:timestamp" content="2010-05-07T20:02:48.143000+00:00"/>
<dc:contributor opf:role="bkp">calibre (0.6.51) [http://calibre.kovidgoyal.net]</dc:contributor>

which looks to me as if BAEN had used calibre to create the epub source in 2010. I certainly didn't use calibre to convert it nor had I put it in my calibre library at the time I spotted this. So I don't think seeing calibre traces in an opened epub necessarily means ADE had scanned the calibre library, but neither does it mean that it didn't.

[HarryT]

Originally Posted by jackie_w

which looks to me as if BAEN had used calibre to create the epub source in 2010. I certainly didn't use calibre to convert it nor had I put it in my calibre library at the time I spotted this. So I don't think seeing calibre traces in an opened epub necessarily means ADE had scanned the calibre library, but neither does it mean that it didn't.

An excellent point. Yes, Baen do indeed use Calibre.

[shalym]

Originally Posted by HarryT

An excellent point. Yes, Baen do indeed use Calibre.

Whether Baen uses Calibre or not, this still doesn't answer the question of why ADE would be looking at a book that never had DRM applied to it.

Shari

[HarryT]

Originally Posted by shalym

Whether Baen uses Calibre or not, this still doesn't answer the question of why ADE would be looking at a book that never had DRM applied to it.

Shari

A book doesn't have to have had DRM in order to be in the ADE library. It just has to have been opened by ADE at some point in the past.

[Prestidigitweeze]

Originally Posted by fjtorres

Nate explicitly states that several of the books logged were DRM-free and were never opened. Period. At least some of those title should have been invisible to ADE.

Yes, Nate said as much. The reason that some of us are questioning the idea is because no one else seems to have verified the activity. From your cited article in the Register:

"Hoffelder claimed Digital Editions 4 slurped and leaked the metadata of all the ebooks on his system – not just the ones read using the application. Adobe said this shouldn't [be] possible, but has its developers checking again to make sure this isn't a bug."

If you read the full list of items Adobe admits they log and why, in the Register article linked to in a post here, above, you'll find that they look for "certified app id" to fight DRM cracking. Nate has tested several Alf-ie tool plug-ins (most recently during the Kobo downloads discussions) and has confirmed his system has Calibre plugins installed. It has been speculated, and not just by me, that ADE 4 looks for Calibre plugins and/or DRM-free ebooks in its library to see if the user has removed DRM from commercial ebooks. It has also suggested that it might have scanned the calibre library because of some interaction with Calibre in server mode. Last I looked in the comments there, it was still an open question.

According to the nine bullet points in the two lists within the article, Adobe appears to be checking whether books that do have DRM are being read on certified devices and whether those books have been copied too many times. I seem to be missing the part of the list in which Adobe admits scanning de-DRM'd books to see whether they've been cracked.

If "[i]t has been speculated . . . that ADE 4 looks for Calibre plugins and/or DRM-free ebooks in its library to see if the user has removed DRM from commercial ebooks," then I haven't seen corroboration outside of Nate's article. Perhaps you'd be kind enough to link to an example or two.

It's a question not of an individual journalist's credibility but of being able to repeat the reported behavior to judge whether it is a problem for others.

That said, by siphoning and sending unencrypted data that surveys users' libraries and sums page turns within a single book, Adobe seems to be trespassing in ways in which other companies (cf. Amazon and Apple) do not.

[shalym]

Originally Posted by HarryT

A book doesn't have to have had DRM in order to be in the ADE library. It just has to have been opened by ADE at some point in the past.

I guess my point is more, why would information on a book that never had DRM need to be sent to Adobe? If they want to scan their library, fine...I get that. The program obviously needs to know what is in it's library in order to function. The program does NOT, however, need to send that information back to the mother ship if there is no Adobe DRM applied to the book. I wonder what I would find if I installed ADE 4 on my computer? Technically it shouldn't send ANY data back to Adobe since I have never purchased a book that used Adobe DRM.

Shari

[HarryT]

Originally Posted by shalym

I guess my point is more, why would information on a book that never had DRM need to be sent to Adobe? If they want to scan their library, fine...I get that. The program obviously needs to know what is in it's library in order to function. The program does NOT, however, need to send that information back to the mother ship if there is no Adobe DRM applied to the book. I wonder what I would find if I installed ADE 4 on my computer? Technically it shouldn't send ANY data back to Adobe since I have never purchased a book that used Adobe DRM.

Shari

I completely agree with you.

[fjtorres]

Originally Posted by Prestidigitweeze

If "[i]t has also [been] suggested that [ADE 4.0] might have scanned the calibre library because of some interaction with Calibre in server mode," then I haven't seen corroboration outside of Nate's article -- perhaps you'd be kind enough to link to an example or two.

It's a question not of an individual journalist's credibility but of being able to repeat the reported behavior to judge whether it is a problem for others.

Check the comments (discussion, really) at Nate's.
Folks are trying to replicate/explain the behavior.
But most are working with clean installs. Nate's experience was on a production system, not a testbed. Hence the speculation. And the cautions.

If it is a bug it is one that only shows up in (rare?) real world scenarios.

[JSWolf]

Originally Posted by HarryT

They don't, but ADE installs itself as the default ePub reader, so on many PCs (mine included) if you double click an ePub book in Windows Explorer, it will open in ADE, and that process of opening the book copies it to the ADE library.

Actually, that might be incorrect. When you open an ePub that is not in ADE's library, ADE will as you if you want to copy it to your ADE library when you exit ADE with that eBook open. You can click cancel and the ePub will not be added to ADE's library. This is how it works with ADE 2 unless it's changed with ADE 4.

[gbm]

Originally Posted by jhempel24

That's what I was thinking, but I didn't think Baen used ADE or any DRM for that matter, so that's why it jumped out at me.

Originally Posted by HarryT

They don't, but ADE installs itself as the default ePub reader, so on many PCs (mine included) if you double click an ePub book in Windows Explorer, it will open in ADE, and that process of opening the book copies it to the ADE library.

The only files that ADE is the default program on my pc is for *.acsm files.

bernie

[soondai]

Well Nate certainly got some attention. It would be nice to see (outside of his comment section) a follow up describing efforts to reproduce the phenomenon of data being sent on books stored outside ADE.

As fjtorres suggests, maybe it happens on "production systems" instead of clean installs, but maybe Nate just doesn't remember accidentally opening the books with ADE at some point long ago, presumably by accident (I know I have done this)

[fjtorres]

Originally Posted by soondai

Well Nate certainly got some attention. It would be nice to see (outside of his comment section) a follow up describing efforts to reproduce the phenomenon of data being sent on books stored outside ADE.

As fjtorres suggests, maybe it happens on "production systems" instead of clean installs, but maybe Nate just doesn't remember accidentally opening the books with ADE at some point long ago, presumably by accident (I know I have done this)

Could be.
But consider that the thing doesn't just send the data for the book being read (as Amazon and others do) but for every book ever read, every time. And if it was solely for sync and activation, why mention piracy at all?

Over at TechDirt they've been parsing the Adobe party line and not getting the warm and fuzzies:
https://www.techdirt.com/articles/20...r-ebooks.shtml

They are fairly certain they are violating several state laws, including California's, just with what they admit.

[ShellShock]

Originally Posted by shalym

I guess my point is more, why would information on a book that never had DRM need to be sent to Adobe? If they want to scan their library, fine...I get that. The program obviously needs to know what is in it's library in order to function. The program does NOT, however, need to send that information back to the mother ship if there is no Adobe DRM applied to the book.

Can ADE tell the difference between an ebook which has never had DRM, and the same ebook which has had the Adobe DRM stripped from it (and therefore possibly pirated)? If not, then this could explain why ADE is sending info back about all ebooks in its library, ebooks with and without DRM. They could be trying to check whether the no DRM ebooks have been "pirated", i.e., have had DRM removed, which could be for any number of morally justifiable reasons, e.g., in order to format shift, or back up, or fix typos, or adjust formatting. But to Adobe this may be viewed as piracy.

[TimW]

Originally Posted by fjtorres

Check the comments (discussion, really) at Nate's.
Folks are trying to replicate/explain the behavior.
But most are working with clean installs. Nate's experience was on a production system, not a testbed. Hence the speculation. And the cautions.

If it is a bug it is one that only shows up in (rare?) real world scenarios.

Maybe it's not so rare. Nate says the files that ADE hoovered were apparently on an ereader that happened to be connected to his computer when he performed the test. The ereader had NOT been authorized to ADE. He's working with EFF to document it and to understand it better before he makes a post. So did the program do a Max Headroom and say to itself, "Ooh, a cable! I wonder where it leads?"

[Froide]

Originally Posted by soondai

Well Nate certainly got some attention. It would be nice to see (outside of his comment section) a follow up describing efforts to reproduce the phenomenon of data being sent on books stored outside ADE.

As fjtorres suggests, maybe it happens on "production systems" instead of clean installs, but maybe Nate just doesn't remember accidentally opening the books with ADE at some point long ago, presumably by accident (I know I have done this)

Excerpted (boldface is mine) from:

Sean Gallagher. (Oct 7 2014, 7:00pm EST). "Adobe’s e-book reader sends your reading logs back to Adobe—in plain text [Updated]". Ars Technica.

Ars has independently verified the logging of e-reader activity with the use of a packet capture tool. The exposure of data was first discovered by Nate Hoffelder of The Digital Reader, who reported the issue to Adobe but received no reply.

Digital Editions (DE) has been used by many public libraries as a recommended application for patrons wanting to borrow electronic books (particularly with the Overdrive e-book lending system), because it can enforce digital rights management rules on how long a book may be read for. But DE also reports back data on e-books that have been purchased or self-published. Those logs are transmitted over an unencrypted HTTP connection back to a server at Adobe—a server with the Domain Name Service hostname “adelogs.adobe.com”—as an unencrypted file (the data format of which appears to be JSON).

The behavior is part of Adobe's way of managing access to e-books borrowed from a library or "lent" by other users through online bookstores supporting the EPUB book format, such as Barnes & Noble. If you've "activated" Digital Editions with an Adobe ID, it uses that information to determine whether a book has been "locked" on another device using the same ID to read it or if the loan has expired. If the reader isn't activated, it uses an anonymous unique ID code generated for each DE installation.

Question:

Are B&N LendMe ebooks stored in My Digital Editions?