Argument in favor of DRM

[ApK]

Originally Posted by pdurrant

There is a basic problem with DRM. You have to give the encryption key to the end user.

Originally Posted by eschwartz

You might also like to consider the difference between hacking someone else's machine and hacking your own machine. You may be unaware -- DeDRM is the latter.

Also might be worth clarifying, for those who don't know, that stripping DRM is not "breaking" or "cracking" the encryption in the cryptological sense.

We cannot access a DRMed file that we do not have the key for.*

All stripping does is find and apply the key we already legitimately have.

ApK

*As far as is known to the public, anyway. Lucky brute force attacks aside....

[ApK]

Originally Posted by MikeB1972

Oh, I'm not arguing in favor of DRM, just wondering why the pro DRM crowd don't use film/tv as the counter every time someone says DRM has to fail because of music.

I was giving some of the reasons why the comparison might not hold up.

To watch DVD's on a system with no DVD's (netbook, tablet etc) I just rip the iso and play it with a Virtual drive, chews up more space than converting to mp4 but keeps quality intact and is as simple as ripping a cd.

Totally off topic, but I did the same thing with my entire DVD collection, and I'm finding it rather cumbersome now. Aside from taking up a terabyte of space, it requires a lot of bandwidth to stream or copy, and not many consumer media devices (like Smart TVs or set-top boxes) can play ISOs directly.

I'd like to convert most of them to mp4, probably in an MKV wrapper, but it's a lot of work if I want to preserve special features and subtitles, and I just don't want to make another hobby out of it. I just want to watch the movies.

I don't have an ideal solution.

I am sensing an entrepreneurial opportunity here.

ApK

[pdurrant]

Originally Posted by ApK

I am sensing an entrepreneurial opportunity here.

Which won't happen until the DMCA in the US gets repealed or amended to allow it. A massive restriction on innovation and user convenience for an industry that all the evidence says wouldn't be harmed by such a repeal.

Wouldn't it be good to have the equivalent of iTunes for DVDs? But under the current laws it's impossible.

[rkomar]

Originally Posted by pdurrant

There is a basic problem with DRM. You have to give the encryption key to the end user.

If the key is obtained over the net in a secure manner each time the book is opened, then it gets harder for the user to get their hands on it. It also makes the key book-specific and possibly random (rather than having the same, guessable key for the entire library). That seems to be the way that Adobe was going with their latest ADE encryption scheme. I think that they, like webroot, were seeing ebooks as something that you read on a connected computer using an app (that can be updated at any time). They didn't seem to be considering connectionless devices with fixed firmwares, like e-ink readers often are.

[dgatwood]

Originally Posted by rkomar

If the key is obtained over the net in a secure manner each time the book is opened, then it gets harder for the user to get their hands on it. It also makes the key book-specific and possibly random (rather than having the same, guessable key for the entire library).

There's no such thing as transmitting data in a secure manner when the code is running on a general-purpose computer. The way most folks attack DRM is to first run the app in a debugger, then at such a point as you believe the key exists in memory, dump the contents of the app's address space, throw away everything of known origin (the app binary itself, libraries, frameworks, and the contents of the book), and then go through the remaining data looking for a blob of data large enough to be a key.

With the scheme you propose, however, it is even easier to obtain the key data. If you know that the key is coming in over a network, you can trivially patch the operating system's crypto routines to write a copy of the unencrypted data to a file on disk. Or if the app just uses stock HTTPS encryption, you could use the Charles Web Debugging Proxy, and skip all the hacking entirely.

Besides, your readers will march on your HQ with torches and pitchforks if you actually implement always-on DRM; just look at what happened when the game industry tried it.

Basically, the DRM problem is the same as the "How do I securely communicate with a server using a public terminal that might have a keylogger installed" problem. The answer is, "You can't." If you can't trust the endpoint, then security is fundamentally compromised, and there's nothing that anyone can do to change that reality. Anything you might implement to work around such a compromised terminal can be defeated by a sufficiently clever attacker, resulting in an infinite cat-and-mouse game that just costs a lot of money for no useful benefit in the long run.

[DiapDealer]

Originally Posted by rkomar

If the key is obtained over the net in a secure manner each time the book is opened, then it gets harder for the user to get their hands on it. It also makes the key book-specific and possibly random (rather than having the same, guessable key for the entire library). That seems to be the way that Adobe was going with their latest ADE encryption scheme. I think that they, like webroot, were seeing ebooks as something that you read on a connected computer using an app (that can be updated at any time). They didn't seem to be considering connectionless devices with fixed firmwares, like e-ink readers often are.

I have no doubt that something along these lines will be tried with ebooks at some point. But it will have to be by someone who is willing to sell less ebooks than they otherwise could. I don't really see such an experiment succeeding long-term either--unless the goal is to slow the spread of ebooks, of course. A required internet connection to read a book simply won't fly (for many people). I would be a bit sad if I was no longer able to make use of ebooks, but in the event that such a situation become the "norm," it wouldn't be difficult for me to transition back to physical books.

Current ebook DRM isn't noticed by a lot of people because it can stay out of the way of a lot of readers' habits. They can go for years without getting "burnt" by DRM's inconveniences. But when readers enjoyment of their books start routinely being interrupted/prevented by a draconian, always on, phone-home process; the uproar and negative attention drawn to DRM will get bigger/louder quicker than ever. "Most people don't even know about DRM" will become a thing of the past. And that will cut both ways.

[Kirtai]

Originally Posted by dgatwood

The way most folks attack DRM is to first run the app in a debugger, then at such a point as you believe the key exists in memory, dump the contents of the app's address space, throw away everything of known origin (the app binary itself, libraries, frameworks, and the contents of the book), and then go through the remaining data looking for a blob of data large enough to be a key.

I believe that the very high entropy of encryption keys makes them even easier to spot.

[rkomar]

@dgatwood: The upshot of all that work is that you have the key for _one_ ebook of yours. You will have to repeat the procedure for all the rest. It is not uncrackable, but it raises the amount of effort required. For many, it will be too much.

[Kirtai]

Automating stuff like that is what scripts, plugins and other tools are for. See the current situation for examples.

[Froide]

Originally Posted by Canuck_in_Japan

Didn't we just have a thread dedicated to discussing DRM?

+1.....

[ApK]

Originally Posted by Froide

+1.....

Even more of them than that.

[j.p.s]

Originally Posted by DiapDealer

I have no doubt that something along these lines will be tried with ebooks at some point. But it will have to be by someone who is willing to sell less ebooks than they otherwise could.

Don't you mean willing to sell less books than they do now?

According to Amazon, they could not only sell more books, but make more profit if they would lower the price. So they are already willing to sell less ebooks than they otherwise could.

[EowynCarter]

Originally Posted by rkomar

@dgatwood: The upshot of all that work is that you have the key for _one_ ebook of yours. You will have to repeat the procedure for all the rest. It is not uncrackable, but it raises the amount of effort required. For many, it will be too much.

And the reader would need all these key to read the book. Too much of a pain to bother with.

[pdurrant]

Originally Posted by rkomar

@dgatwood: The upshot of all that work is that you have the key for _one_ ebook of yours. You will have to repeat the procedure for all the rest. It is not uncrackable, but it raises the amount of effort required. For many, it will be too much.

Oddly enough, both Amazon and Kobo have per-book encryption keys. Amazon's scheme is based off a device-level key, so isn't exactly what you describe, but Kobo's scheme is precisely one key per book, key provided to the Kobo desktop reading software over the internet.

But all the keys must be stored by the reading software, to allow off-line reading. So it's just a question of getting access to the app's key store and reverse engineering the encryption scheme. [software name deleted].

[rcentros]

Originally Posted by rkomar

If the key is obtained over the net in a secure manner each time the book is opened, then it gets harder for the user to get their hands on it. It also makes the key book-specific and possibly random (rather than having the same, guessable key for the entire library).

Didn't Microsoft basically hamstring their new XBox by announcing such a scheme for game playing? They soon backed down on that plan. I'm guessing much the same will happen when/if eBook publishers try to use such a scheme on eReaders. The whole point of an eReader is portability of your library. There are still wide open spaces where there is no Internet connection. Can you imagine how happy an eBook customer would be if he couldn't read any of the thousand books on his eReader during a camping trip?