Password-based DRM has a dim future

[elcreative]

Just make sure you use the cup and not your eReader...

Originally Posted by JSWolf

You also have to pee in a cup and take a drug test too to get your eBooks.

[anamardoll]

Originally Posted by Elfwreck

Some people would buy it if it were pitched right. "New: Harry Potter ebooks on the ThumbReader 2012!" And the sales pitch would imply that you just go online & buy books, and not mention that it works about like the RocketBook system: plug *device* online, and buy *through it*, instead of the standard "go online, download to hard drive" system.

One hopes that even the Engadget folks would manage to warn the public in time.

[Barty]

Originally Posted by Penforhire

I thought the answer to brute force methods was to limit the number of tries, at least in terms of tries per hour, if not completely locking access after three consecutive failures?

No half wsy decent security system is going to let you try 3B passwords per sec until you get the right one. This basically works only when the hacker has your password hash file, as is allegedly the case with the Sony hack. (If it gets to that point, you have serious problems.) And the hash algorithm mentioned in the article is an old and deprecated one anyway.

Removing ebook DRM is trivial computationally.

[GreenMonkey]

Originally Posted by mr ploppy

Or just download a pirate copy instead that doesn't need fingerprints, blood samples or any of the other nonsense publishers decide to inflict on their paying customers.

Pirated product is always better. It's ironic.

You can defeat a fingerprint scan numerous ways. Not any different than any other DRM.

Redirect server requests to your own server that spoofs a positive response (used for online-required-DRM-games). Proceed to strip content out.

Get into code and modify it so that it ways returns a 1 and approves access. Proceed to strip content out for piracy.

Flash firmware to circumvent hardware DRM, which gets you into the firmware enough to destroy the DRM entirely (kind of like the Nintendo DS).

Fingerprint scans are no different than any other hardware-based security. You still need two things - content with encryption and hardware allowed to decode it. It's that second part that always ends up creating the problem. Until you can inject data into people's brains directly you can't skip the second part.

[queentess]

Originally Posted by Steven Lyle Jordan

Fingerprint scanners are already here, small enough to include in the smallest digital hardware, relatively inexpensive and easy to use. Not that retina scans don't work, but fingerprint scanners are more efficient for verifying security on a portable device, and the tech is ready now.

Yeah, except I have a finger print scanner at work and I have issues with it. I knit so much that I wear down my finger prints over time. Then I'll take a break from knitting and they come back. The constant changing means I have constant problems, and the software apparently isn't smart enough to keep up.

Originally Posted by mr ploppy

Or just download a pirate copy instead that doesn't need fingerprints, blood samples or any of the other nonsense publishers decide to inflict on their paying customers.

Precisely

[avantman42]

Originally Posted by queentess

Yeah, except I have a finger print scanner at work and I have issues with it. I knit so much that I wear down my finger prints over time. Then I'll take a break from knitting and they come back. The constant changing means I have constant problems, and the software apparently isn't smart enough to keep up.

Biometrics have advantages and disadvantages, like everything else. They're not a panacea. Steven's blog entry that he linked to suggests that he thinks fingerprint scanners will solve all the problems that passwords have, without introducing new problems. It's far more likely that they'll solve some problems, but also introduce new ones.

[Steven Lyle Jordan]

Originally Posted by Elfwreck

I think some hardware can be pushed on the public, and some can't, and this is one of the "can't" variety. Like those little "cat" scanners that read advertising barcodes... too obviously a case of "let's inflict annoying extra complicated steps onto the end user for corporate convenience!"

I don't agree. Look at how inferior Internet Explorer proliferated, thanks to the companies pushing it onto PCs, and websites offering things that only IE could access. Look at how Windows and PDFs proliferated, thanks to more and more businesses using the software and sharing documents between them. Look at how PCs flooded offices, based on great licensing deals and, again, the potential of data sharing.

People had no trouble accepting the need for memorizing passwords for bank cards, voicemail, desktops, online accounts, etc. In the case of desktops and online accounts, they let the PCs keep track of them... at the moment, I have dozens.

Even the cat scanners you mention would be used everywhere, if they were tied with something people wanted, like "5% off every item in the store... just scan the barcode to get your discount at the cashier." Or, even better: "Scan at the shelf, and bypass the cashier!"

You just need the right incentive to get everyone on-board.

[Steven Lyle Jordan]

Originally Posted by mr ploppy

Or just download a pirate copy instead that doesn't need fingerprints, blood samples or any of the other nonsense publishers decide to inflict on their paying customers.

Originally Posted by JSWolf

You also have to pee in a cup and take a drug test too to get your eBooks.

Originally Posted by GreenMonkey

Pirated product is always better. It's ironic.

Originally Posted by queentess

Precisely

And everyone wonders why I haven't been writing...

[anamardoll]

Originally Posted by Steven Lyle Jordan

And everyone wonders why I haven't been writing...

Yes, because downloading a pirated copy in order to bypass an incredibly invasive biometric DRM is exactly the same thing as stealing food from an author's mouth.

I know the view is bad from your high horse, but some people who download DRM-free copies to avoid malware do so AFTER purchasing a legal copy so that they can still support the author. But if you want to spend time complaining about Jack Sparrow instead of writing, don't let me stop you.

[mr ploppy]

Originally Posted by Steven Lyle Jordan

And everyone wonders why I haven't been writing...

Cut your finger and can't login to your laptop?

[anamardoll]

Originally Posted by mr ploppy

Cut your finger and can't login to your laptop?

I hate when I cut my finger -- I can't read my biometric DRM books until it heals.

[cfrizz]

Sorry, but an authors need to protect their copyright will not take precedence over my need/desire for not allowing invasive or restrictive BS just to buy their books.

Get the *uck over yourselves. If I can't put your books on any/all readers that I might have at any given time, you can kiss my money goodbye!

[ardeegee]

Originally Posted by Steven Lyle Jordan

And everyone wonders why I haven't been writing...

No, I think it is pretty safe to say that NOBODY that has been around her long wonders why you haven't been writing, since you take every possible opportunity to tell everyone that piracy is the reason your brilliant "I know! I'll write books, become instantly famous, and become a millionaire!" retirement plan didn't survive facing the real world.

I'm reminded of a section I always remember from Harlan Ellison's introduction to Dan Simmons' collection "Prayers to Broken Stones" ever since I first read it nearly 20 years ago:

"Understand: I do not believe "anyone can write." That is to say, anyone can slap together words in some coherent sequence if s/he had done even a modicum of reading, and has at least a bare grasp of how to use language. Which is talent enough for writing letters, or doctoral theses, or amusing oneself with "creative endeavors." But to be a writer—not an "author" like such ongoing tragedies as Judith Krantz, Eric Segal, V.C. Andrews, Sidney Sheldon, and hordes of others I leave to you to name—one must hear the music. I cannot explicate it better than that. One need only hear the music. The syntax may be spavined, the spelling dyslectic, the subject matter dyspeptic. But you can tell there has been a writer at work. It fills the page, that music, however halting and rife with improper choices. And only amateurs or the counterproductively soft-hearted think it should be otherwise.

When I am hired to ramrod a workshop, I take it as my bond to be absolutely honest about the work. I may personally feel compassion for someone struggling toward the dream of being a writer, who doesn't hear the music, but if I were to take the easy way out, merely to avoid "hurting someone's feelings"—not the least of which are my own, because nobody likes to be thought of as an insensitive monster—I would be betraying my craft, as well as my employers. As well as the best interests of the students themselves. Lying to someone who, in my opinion (which can certainly be wrong, even as yours), doesn't have the stuff, is mendacious in the extreme. It is cowardly, not merely dishonest. Flannery O'Connor once said, "Everywhere I go I'm asked if I think the university stifles writers. My opinion is that they don't stifle enough of them. There's many a bestseller that could have been prevented by a good teacher."

Similarly, I take it as my chore to discourage as many "aspiring authors" as I possibly can.
Because you cannot discourage a real writer. I've said it a hundred times in print. Break a real writer's hands, and s/he will tap out a story with feet or nose."

[Steven Lyle Jordan]

Actually, when I said "everyone," I wasn't referring to the members of MR.

I was referring to everyone else; family, friends, co-workers, who don't hang around this site; and therefore don't understand how hostile and unappetizing the ebook atmosphere is for the average profit-driven writer, without the prospect of some sort of protection for their work.

But we were discussing password-based DRM, and it wasn't me who brought up (or espoused) piracy...

[ardeegee]

Originally Posted by Steven Lyle Jordan

I was referring to everyone else; family, friends, co-workers, who don't hang around this site; and therefore don't understand how hostile and unappetizing the ebook atmosphere is for the average profit-driven writer, without the prospect of some sort of protection for their work.

You mean "how hostile and unappetizing the real world is for the tiny fish in a huge ocean chock-full of other "pedestrian writing at the very best" superstar-wannabes with profoundly unrealistic expectations."