Do decrypted ePubs watermarked?

[apastuszak]

I buy books and remove the DRM. I store them all in Calibre and sync to my wife's nook and to my Kindle (hence why I remove the DRM. Need to convert to mobi).

I don't give these files out anywhere, but since the DRM has been removed, there is potential for someone to "borrow" them. Hacker gets into my system or my Dropbox. Son' friend comes over with a thumb drive while I am at work, etc.

If this were to happen, something may be out there with MY name on it that I didn't put out there, and because it's watermarked in some way, I don't think legally I'd have a lot of recourse against a publisher's lawyers.

So, I am curious, is there anything on these ePubs form B&N that can link back to me?

I do understand that chances are some teenager is going to borrow music before he borrows a book, but the potential is there. People have given me m4a files that clearly still have the purchaser's metadata in them, so I know it can happen.

[rdfry]

Originally Posted by apastuszak

I buy books and remove the DRM. I store them all in Calibre and sync to my wife's nook and to my Kindle (hence why I remove the DRM. Need to convert to mobi).

I don't give these files out anywhere, but since the DRM has been removed, there is potential for someone to "borrow" them. Hacker gets into my system or my Dropbox. Son' friend comes over with a thumb drive while I am at work, etc.

If this were to happen, something may be out there with MY name on it that I didn't put out there, and because it's watermarked in some way, I don't think legally I'd have a lot of recourse against a publisher's lawyers.

So, I am curious, is there anything on these ePubs form B&N that can link back to me?

I do understand that chances are some teenager is going to borrow music before he borrows a book, but the potential is there. People have given me m4a files that clearly still have the purchaser's metadata in them, so I know it can happen.

No there is not

[RAH]

That is a good question and I have wondered the same thing myself. I agree with rdfry that there is nothing remaining in the epub that identifies the purchaser.

One thing you could do to feel more comfortable is to examine the epub after DRM removal using Sigil (actually, Calibre itself has a tool which also allows you to look at the individual components of the epub/zip file. I can never remember how to find it, however). Or you could just rename the file to filename.zip and open it in a zip utility. Then go through the individual files and do searches on your name or whatever. I think you'll find that there is nothing to worry about.

[mikeayers]

Maybe find some else with the same book, from the same source. Both people remove the DRM, then compare all the files and see if there are differences.

[RAH]

Yes, I like that idea, Mike!

[wallcraft]

The original eReader DRM did optionally include a watermark (e.g. from the library of FIRST LASTNAME) inside the actual ebook - so it was displayed on the screen. I have not seen this with B&N ePubs. There could still be a watermark in the metadata, but I don't think there is one. Comparing the same ebook from two sources is worth trying, the result would be interesting either way (same or different).

[KevinH]

FYI,

I have no idea if any of this is currently being used but you can easily find scripts on the net that can encode data to bit patterns in graphical images (jpgs, pngs, etc) that can't be easily detected without the correct software (i.e you could easily encode owner name/owner data into the cover.png and no one would know it was there), as well as create/change comment sections inside most graphical image files that can be used to store data as well. Then of course, it would only take one unique string of data or a known pattern of bytes (any sequence of typos, mistakes, spelling variations, spacing, etc.) to uniquely identify a file. That combined with a database of unique byte sequences and original owner would be enough to identify the source.

My 2 cents ...

[taustin]

Originally Posted by KevinH

FYI,

I have no idea if any of this is currently being used but you can easily find scripts on the net that can encode data to bit patterns in graphical images (jpgs, pngs, etc) that can't be easily detected without the correct software

It can be very difficult to tell if there's something hidden there, and more so to extract it, but if there's info encoded in a photo and a direct, bit-by-bit comparison is done between two decrypted files, it must show differences. If the files are identical, any steganographic content is identical, i.e., not personal (if the original files were bought by different people).

[jocampo]

Really difficult to tell, almost impossible.

You can put watermarks as a comment on the JPG image or even on the CSS classes, or as part of the HTML tags, inside the name of the directories and files, direct alteration of the zip file, etc.

I would not remove the DRM, is illegal in USA and several other countries, but if you do, I would not expose those books at all, not even dropping or putting that on Dropbox folders.

The most secure way to protect an electronic document or device from hackers is just unplug the device from the network: not sharing at all. Even in your intranet, if someone breaks your firewall or get into your house's network, whatever is stolen and later reproduced or posted, the initial owner is 100% responsible for the copyright violation (assuming there was a watermark, of course)

By the way, the Dropbox transmission is encrypted, the communication itself, but not the folder or data. If the server is compromised, everything will be compromised too.

[taustin]

Originally Posted by jocampo

Really difficult to tell, almost impossible.

You can put watermarks as a comment on the JPG image or even on the CSS classes, or as part of the HTML tags, inside the name of the directories and files, direct alteration of the zip file, etc.

And if it's part of what you plan to distribute, it can be compared to a decrypted file/folder/whatever from another purchaser, and there will be differences.

If the two are identical, there cannot be any personally identifiable information in there.

[KevinH]

Hi,

if there's info encoded in a photo and a direct, bit-by-bit comparison is done between two decrypted files, it must show differences. If the files are identical, any steganographic content is identical, i.e., not personal (if the original files were bought by different people).

I agree, if you have the exact same edition of the ebook bought by different people that after DRM removal show up exactly bit for bit the same (the DRM can and will be tied to the user and so will some of the metadata so you will have to remove the DRM first), then there must be no user specific identifiable material remaining in the ebook.

That said, those are not easy conditions to actually meet. It would be interesting to test that by having two different people purposely run those tests on a variety of different ebooks and formats, bought from the major bookstores and vendors.

You would also have to rule out the DRM removal software itself which can actually add in user specific info (the original CMBDTC Topaz script does just that for example).

It is better to simply not pirate ebooks. You can still remove the DRM from your own ebooks and convert them for another reader you might own or archive them by burning the html to disk and arguably be consistent with fair-use in most countries, but posting them to the web is a very bad idea (IMO) and should be discouraged.

[taustin]

Originally Posted by KevinH

That said, those are not easy conditions to actually meet.

Do you have any real world examples of that?

Originally Posted by KevinH

It is better to simply not pirate ebooks.

No arguments with that.

[KevinH]

Originally Posted by taustin

Do you have any real world examples of that?

What? Having access to the exact same book bought buy two different people both with DRM removed on my machine to run a binary diff on?

I don't have two exact copies (both DRM removed) bought by different people from the same bookstore on my machine so I would guess that not many people do either!

Take care,

Kevin

[taustin]

Originally Posted by KevinH

What? Having access to the exact same book bought buy two different people both with DRM removed on my machine to run a binary diff on?

I don't have two exact copies (both DRM removed) bought by different people from the same bookstore on my machine so I would guess that not many people do either!

Take care,

Kevin

So you don't actually know how hard it is to meet those conditions?

[KevinH]

Originally Posted by taustin

So you don't actually know how hard it is to meet those conditions?

Huh? I am claiming they are hard to meet because typical users (like me) don't normally have two copies of the exact same book bought by two different people from the exact same store with the DRM removed by the same tool on both. I strongly doubt very many people would have! Especially if they are not pirates. Is this really what you are questioning!?!

If so ... good luck with that.