Is Interoperable DRM Really Less Secure? 189
Crouch and hold writes "Are closed DRM schemes like FairPlay more secure than interoperable ones? Based on the number of cracks, it doesn't look like it. 'When it comes to DRM, what history actually teaches us is that one approach is no more secure than the other in practice, as they relate to the keeping of secrets. Windows Media DRM has had fewer security breaches than Apple's FairPlay, yet WM DRM is licensed out the wazoo: there are more than a dozen companies with WM DRM licenses.'"
+5 informative (Score:5, Funny)
I had no idea that the MS licensing department was actually an orifice.
Re: (Score:3, Insightful)
Re: (Score:2)
Re: (Score:2)
Every department at MS is an orifice. What's more, they're all the same orifice. If somehow truth-in-advertising were enforced, just like Courtney Love's band, they would have to be named Hole. Or at least, something like that.
Re:+5 informative (Score:4, Informative)
Re:+5 informative (Score:4, Interesting)
Closed DRM == one set of eyes for the "good" guys (arguably the bad guys in this case but whatever) == pwned by the freedom fighters.
licensed DRM == several sets of eyes, eyes with different corporate mentalities, eyes with different outlooks, thus sorta like OSS == less breaches.
-nB
Re: (Score:3, Insightful)
Re: (Score:2)
Anything else and it's eventually screwed.
Re: (Score:2)
Which is one reason proprietary encryption tends to be not very good.
However actual security depends on a complete system. A good algorithm implimented badly can be worst than a poor one implimented well. There's also the problem that security is only as good as that of the weakest component.
Usually when you use encryption you trust the recipient with the plaintext. Whereas with DRM this just dosn't hold. Instead you rely on a c
Re: (Score:2)
licensed DRM == several sets of eyes, eyes with different corporate mentalities, eyes with different outlooks, thus sorta like OSS == less breaches.
I don't think this works for DRM. DRM is a deeply flawed concept -- in the long run, it can't work. Sooner or later, there will be a breach that's irreparable. Many eyes can't prevent this because it's a fundamental problem with
Re: (Score:3, Interesting)
DRM is currently trying to hide the fact that each customer have the key, by hiding it deep down some complicated software, but hiding the key, don't solve the problem, that anyone really looking for it, will find it. (And once a single user have found it, it(Or the content it decript) can be shared with anyone).
Re:+5 informative (Score:5, Informative)
Cryptography is used so that a message from A can be read by B but not by C. With DRM, B and C are the same person.
The message from A (the publisher) must be readable by B (the consumer) but not by C (the consumer).
I hope you understand now why DRM is a concept flawed in its fundament.
DRM would be useful. So would a perpetual motion machine. It is wishful thinking to believe that the sheer utility of a function means it is capable of being produced.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Because at some point you need to turn "sound" into something a human ear can hear. And "video" into something a human eye can see.
It is close to impossible to do this in a way no machine can record. Even if someone needs to build custom microphones and cameras which closely match the characteristics of human sense organs.
People are already working on open
Re:+5 informative (Score:5, Insightful)
MS PFS DRM = 100,000 songs sold?
MS Zune DRM = 250 songs sold?
Leave it to ArsTechnica to suggest that number of exploits or number of licensees somehow relates to the complexity of managing DRM across multiple vendors.
Microsoft is also better suited to handle multiple vendors, as it already licenses OEM Windows, WinCE and various other products. Apple has only ever tried to license the Mac OS and Newton, license FireWire, and franchise iPods though HP, and license ad campaigns like Made for iPod. Apple isn't set up to license FairPlay, nor is it within its core competency.
A riddle of warfare between Apple and Microsoft: Steve Jobs and the iTunes DRM Threat to Microsoft [roughlydrafted.com] presents DRM as a shot across the bow of Microsoft's flagship, but suggests that, beyond DRM, "Apple is targeting another Microsoft mainstay with a missile that may cause far more damage than the iPod and iTunes together." 2007 - Apple Strikes Back [roughlydrafted.com] chronicles the recovery of Apple over the last decade, and Apple's Open Source Assault [roughlydrafted.com] hints at how Apple will engage Microsoft. What is Apple up to?
Re: (Score:3, Interesting)
While FairPlay only deals with download purchases, WMDRM not only handles purchased downnloads, but subscription downloads as well.
And while it is true that the number of "purchases" by iTunes dwarfs that of any other music services, if you count the number of subscription downloads, the numbers are much much closer.
Not to mention than subscription DRM is much harder problem than the straight purchase download DRM.
There is only one reason Apple is not licensing FairPla
Re:+5 informative (Score:4, Interesting)
Surely you realize that Microsoft's PFS and Zune are not making money because of ultra low revenues? That's why all the stores are tanking, and none of them brag about how many subscribers they have or songs they are selling.
Subscription/Rental DRM is harder to manage; it makes the player a less attractive product. And it's far more onerous.
Apple had eaten up market share long before the iTunes Store opened. Most iPod users aren't even using the iTS to a great extent - 25 songs on average is not holding people to the iPod. Outside regions with a store, there are plenty of people still buying iPods.
fairplay vs. wm? (Score:4, Insightful)
funny (Score:5, Insightful)
Re:funny (Score:4, Interesting)
It could just be poor implementation (Score:5, Insightful)
Funny how Apple supporters dismiss this reason when it's applied to Windows security, but when it supports Job's reasons for keeping FairPlay closed it's accepted.
You're right to point out the contradiction. However, another way of interpreting it is just that FairPlay is simply not as well-iplemented as Windows Media DRM. That would be an interpretation consistent with the view that Windows gets cracked not just because of its market dominance, but also because of its flaws in implementation. Maybe Apple simply isn't as good at DRM as Microsoft, which isn't necessarily such a bad thing.
Re: (Score:2, Insightful)
Microsoft ? Good ? In the same sentece ? (Score:2)
You're implying that Microsoft is good and anything else appart leveraging a monopoly ?
In light of a long past of being able to suck in anything they managed to make ?
With a long history of making the most easily cracked OS and whose product are the most targeted on, even when Vista is still in Beta and has a lower market share than Linux, or when IIS couldn't ever dream about reaching Apache's widespread ?
You must be kidding.
Re: (Score:2)
You've seen nothing yet. They're prepping a Chewbacca defense post as well.
Re: (Score:3, Interesting)
Indeed, and let's also note that a sample size of 2 is rather small to support the conclusion that licensing a DRM system doesn't make it less secure. From a purely statistical standpoint, isn't it obvious that the more people who know about a secret, the less likely it is to stay a secret? You can
Re: (Score:3, Funny)
I find it ironic that Apple refuses to license fairplay out of fears of piracy.
Re: (Score:2)
Indeed, and let's also note that a sample size of 2 is rather small to support the conclusion that licensing a DRM system doesn't make it less secure. From a purely statistical standpoint, isn't it obvious that the more people who know about a secret, the less likely it is to stay a secret? You can't license a DRM system without telling more people exactly how it works.
And to get conspiratorial for a moment, what if a competitor of Apple's decided to sabotage iTunes by releasing its secrets? That would be easier if there were licensees to target for espionage. Or what if the major labels set up an iTunes competitor, licensed FairPlay, then "accidentally" leaked the secret? They could then pull their music from iTunes, leaving themselves as the only legal source for the music.
I don't think those scenarios are likely, but I tend to believe Jobs when he says he doesn't want to take the extra risk.
Security by obscurity hasn't worked that well through out history. for instance germany didn't fair so hot in WWII with their enigma encryption. When releasing any type of encryption you must assume yoru enemies will be aware of the method and to ensure the method is hard to crack despite this. DVD encryption made the assuption they wouldn't and it was cracked easily. With this in mind if Jobs had wanted a strong DRM I think they would have done a better job. They only made "good enough" drm. The whole sub
Re: (Score:2)
There is also another problem. Enigma (and Lorenz) only had to protect information for a period of time measured in hours or days. Even if c
Re: (Score:2)
Re: (Score:2)
There is a huge difference. An operating system is supposed to be uncrackable. Many eyes looking for improvements will find cracks and fix them, many eyes looking for cracks will find cracks and exploit them. Openness both helps and hinders.
DRM systems are crackable. What keeps people from cracking them is that the cracks are kept secret. There is no point looking for improvements, because the locations of the cracks are known (to a few people). Mor
Re:fairplay vs. wm? (Score:5, Funny)
You know, I once started thinking a lot and realized nothing ever means anything. It's all just a bunch of people arguing over unprovable hypotheses in a one-up-man-ship style and eventually spinning whatever facts they have in their disposal to reach a goal determined in advance before any analysis was done.
Wow. I'm boring.
Re: (Score:3, Funny)
Re: (Score:2)
Re: (Score:2)
Why would people do that? The best target, surely, is the easiest one to crack (assuming price and availability are equal)? Because you don't have to crack for everyone, you just crack the content you want to release and then let everyone copy the released content.
Re: (Score:3, Insightful)
You will find that the Fairplay cracks were published with the goal of allowing customers who _paid_ for their music use that music without the disadvantages of DRM, and _not_ in order to allow them to make illegal copies. Since there are ma
Re: (Score:3, Insightful)
The whole idea of a "goal" behind publishing or selling X or Y is just stupid. Sorry. How many gun manufacturers would there be today if they admitted publicly that ANY of their guns were manufactured to satisfy the needs of criminals? How many tobacco companies had the goal of killing the
Re: (Score:2)
The price to license Plays4Sure to a WMA/MP3 player: $0.10 a player.
The price to make Plays4sure WMAs, for sale or rent: one Windows OS. Making Plays4Sure WMAs is built into 2003 Server, and Windows Media Player can make Plays4Sure WMAs as well.
MS's specialty is, of course, Windows OSes. Their MediaPlayer is almost as critical to, and central to, their OS as Explorer is. When Europe made MS s
Hang on, you can't have it both ways... (Score:5, Interesting)
How does that work?
Re: (Score:3, Interesting)
The summary states both PlaysForSure and Apple's DRM has breach, not just the one or the other.
Re: (Score:2)
Re: (Score:2)
Not defending Apple's DRM, but give it a break. Apple/Linux have decent internet marketshare compared to Windows on the internet [...]
_Conservatively_, Windows would have 8x - 9x the "internet marketshare" of OS X or Linux.
Re: (Score:2)
Re: (Score:2)
Hmmm...? Last figures I saw suggest fairplay only had 54% market share (it's on the register, sometime in '06, I think). That's hardly absolute dominance. OK, so it's 5 times as much as the nearest competitor, but those competitors ALL use WMA.
Re: (Score:2)
Apple can have the more secure DRM, but it is attacked more, so there are more breaches.(whatever that means)
And Apple can have a more secure OS.
These two things have nothing to do with each other. I don't think that this is a complicated subject, but many people here seem confused. If you only judge these two things on how many breaches they have, then yes, that is a problem. But if you judge the value of the OS, or the DRM on how eas
Insecurity vs policy (Score:5, Insightful)
I know some very smart engineers at Microsoft, and I know some very smart engineers at Apple. Devising a hard-to-break DRM system wouldn't be beyond any of them, and iTunes really doesn't go to too much effort. I'll let you draw your own conclusions
Simon.
Re:Insecurity vs policy (Score:5, Insightful)
Bingo!
Apple is doing the minimum necessary in order to be allowed to sell content. Microsoft is trying to do the maximum possible in order to sell the security system to the content owners.
Their markets are entirely different, so their products are entirely different.
KFG
Re: (Score:2)
Re: (Score:2)
Jobs' argument against licensing is:
"Apple cannot license FairPlay to others, says Mr Jobs, because it would depend on them to produce security fixes promptly."
Insecurity of the DRM technique is a side issue. Whether or not the technique is robust, the requirement that any flaws be patched throughout the FairPlay world in two weeks precludes is a powerful argument against licensing.
Re: (Score:2)
Red Herring (Score:3, Informative)
Re:Red Herring -- binary, not source... (Score:2)
MS is licensing an entire platform, so having their DRM on every possible platform is already a goal. They only need to license binaries for the platforms they support already (Windows, mobile, etc...)
Apple if they want to license to non-Apple platforms has two un-palatable
Re: (Score:2)
Anyway, QTFairUse isn't a DRM crack, it's a player crack. Player cracks are almost impossible to prevent (not that DRM cracks are much harder...) without OS support. I bet Apple releas
Fewer security breaches? (Score:5, Insightful)
Re: (Score:2, Informative)
Re: (Score:2)
Re: (Score:2)
If you were using an iPod with FairPlay, however, you wouldn't have a lot of choice -- your only source of content would be iTMS, which would have forced you to upgrade by only offering content in the latest version.
Who has the best BAD IDEA? (Score:5, Insightful)
No Digital Restriction Management is good. NONE of it.
I am not anti-encryption.
I am not anti-artist.
But any scheme that involves someone "selling" or "giving" me something so provisionally that they can then just take it back is simply a BAD IDEA.
The next step down this road is the one where some Bad Actor gets to send people threatening letters and blackmail that is "unprintable", "read only once", "no screen shot", "read only for 1 minute", watermarked to prevent your camera from taking a picture of the screen. Leaving you, in turn, with no proof for a complaint and then leaving the police with no clues while they are pondering over your corpse.
Eh, so what, at least some music executive is *sure* to get to split the full 99-cents that he ripped off the consumer for, in the name of an artist who got a bill for overages in production.
Oh, wait... which kind of Illegal Prior Restraint (commonly misspelled DRM) was good again?
It is _NEVER_ helpful to repeat the artificially biased question as if it represents something worth answering.
The question, as stated, presumes facts not in evidence, namely that the DRM that is harder to break is in any possible way "Better".
What a silly question (Score:4, Insightful)
Re: (Score:2)
Right on. The DRM problem on a general-purpose computer is, from a security standpoint, completely [schneier.com] impossible [schneier.com]. If I have absolute control over my entire computer, and this is still possible today because systems like TCPA haven't been forced down everyone's throats, then any attempt by anyone to restrict what bits I can and cannot copy is doomed to failure. And once I have done it, I can publish my break to the world if I so desire. These people might as well go on rolling a huge boulder up a hill, only t
Re: (Score:2)
cracked and cracked
Re: (Score:2)
Even if someone were to build a video player which was entirely self contained (only connector being an IEC to supply power) which could not be examined in any way it still wouldn't stop people being able to pirate content played on it.
Were anyone to build such a device it would probably be more useful for screening EM radiation...
Re: (Score:2)
Re:What a silly question (Score:4, Informative)
Under Blair, there would just be a bit of polite tutting and moaning, followed by total passive acceptance. The Working Classes (who mostly think they aren't working class anymore just because [1] they have mobile phones and DVD players and [2] a whole new social class has grown up beneath Working) would even be saying things like "Well, it's probably a good thing. I mean, I've been looking for ages for a reason to cut down the amount of media I copy, or even give it up altogether; so I mean, this chip-in-the brain thing is a good idea really."
Talk about licking your arse and calling it chocolate
Security through obscurity never works, however... (Score:2)
Re:Security through obscurity never works, however (Score:2)
Re: (Score:2)
I'm going to go out on a limb and say enough people will object to autodestructing chips that hardware manufacturers will not produce them.
Re: (Score:2)
Hang on, get your terms right (Score:3, Informative)
Because WMV sucks (Score:3, Insightful)
Hmmmm.... could it because no one really cares about downloading wmv files? The point is that if the product sucks, no one will bother even to break into it.
Re: (Score:2)
Hmmmm.... could it because no one really cares about downloading wmv files? The point is that if the product sucks, no one will bother even to break into it.
Windows Media has certainly been hacked, but the hacks involve getting a legal license first and then removing the DRM. One of the alt groups on Usenet late in 2006 posted the WMV
Security through Obscurity (Score:5, Insightful)
Re: (Score:2)
Well, some obvious examples of licensed DRM schemes being cracked are DVD, Blu-Ray and HD-DVD.
It is my understanding that all three were cracked due to poorly implemented software players; for example DeCSS used code reverse-engineered from Xing, and HD-DVD was cracked by trying the entire contents of memory as the volume key, until the volume key was found.
Seems to me 'crap coding in third party players' has caused several DR
Does it really matter? (Score:2, Interesting)
somebody comes up with a scheme. Take the digital broadcast / subscriber card hacker arms
race. They are already light years ahead of whatever Apple or Microsoft are cranking out
and they will be well prepared if "trusted computing hardware" comes out.
These people have phisticated lab equipment and are capable of cutting the chips wide open,
manipulating chip fuses, patching rom masks etc. They will extract Disney's latest
To Be Fair... (Score:2)
What Jobs seemed to be claiming wasn't that having fewer implementations would make it harder to crack (he admitted that it can always be cracked), but rather that it made it easier and faster to release new versions when the old ones had been cracked.
Re: (Score:2)
So, if the record companies feel Apple should license FairPlay, they should be willing to adjust this timetable.
Jobs' statements seem contradictory (Score:2, Interesting)
Yeah I'm being trite, but I still find think it's a contridiction to campaign for DRM-free music while claiming that you're worried about your DRM being compromised.
My hunch is that Fairplay is less about iPod lock-in and more like Zune lock-out. iTunes is your classic loss-leader* as it really only exists to add value
You missed a bit (Score:5, Insightful)
Apple had to sign over the right for the record-labels to pull their entire catalogue from the iTunes store, if a breach happens and Apple don't fix it in a timely manner.
Jobs doesn't care about DRM, but (because he's sane) he doesn't want to lose the iTunes store either - here's his nightmare scenario:
Now Apple can try and pin liability on No-mark company, but at the end of the day, the iTunes store contract is between Apple and [insert record label], and if fairplay is compromised, [record-label] are fully entitled to pull their catalogue...
See it now ?
Simon
Re: (Score:3, Interesting)
Not really. First, they would be careful who they licensed in such a case - bonds posted and so on.
Second, if you imagine the size of this in the real world, the record companies might have the right to withdraw the catalogue, but that would increasingly seem self defeating. All that would happen is, Apple would have to fix it going forward. Maybe by withdrawing the license? Maybe by firmware updates for everyone else. Don't start arguing there are no technical solutions, there will be.
Whate
Re: (Score:2)
Not really. First, they would be careful who they licensed in such a case - bonds posted and so on.
If they were too careful, they would probably be targets of anti-trust litigation. Apple has already been targeted by European countries over their DRM. What if some country threatened legal action if they didn't license their DRM to everybody, or if they were deemed to charge too high a price for it?
Why should it even be Apple's business to get into some licensing mess if they don't want to? Your comment shows just how problematic licensing can be. Why waste time with all that crap, when you could focus
Re: (Score:2)
"We want music without DRM. But we can't license FairPlay, 'cus hackers would... remove the DRM. The DRM we claim we dont really want. Yeah."
Did you actually read what he said? What he said was more like, "if we license FairPlay, when hackers work out how to strip the DRM we won't be able to release a new version to stop them quickly enough, and the record companies will shut down iTMS."
Re: (Score:2)
It wouldn't shut down, the major labels would pull their music and iTMS would have the same music that eMusic currently has.
If Jobs hates DRM so much, and if iTMS really does "just barely break even" as mac users like to claim, then why not just drop the major la
Re: (Score:2)
Because they'd lose the market share that less them sell 5 times as many downloads as their nearest competitor, and drives the sale of iPods, which is where they make their real profit. Besides, they made $452 million in the last quarter due to iTMS. iPod sales (of which they'd lose about half if they stopped selling popular m
Re: (Score:2)
It wouldn't shut down, the major labels would pull their music and iTMS would have the same music that eMusic currently has.
If Jobs hates DRM so much, and if iTMS really does "just barely break even" as mac users like to claim, then why not just drop the major labels and go with eMusic's indie-only model?
I don't see the motivation of keeping the major label's music on the store.
Gee, maybe because he sees the iTS as a service to iPod customers and not as a means towards world domination? Nah, that can't be it.
Not to mention that there is pretty little point in doing exactly what eMusic does - not to mention that you would then complain that they were ripping of eMusic.
Digital Data = Copyable (Score:2, Insightful)
Now this digital data is encrypted, however if it can be decrypted (i.e. played!) then the encryption can be broken. It might prove to be difficult, but it will be broken.
There are two possible ways that the big content distributors can go:
(1) Get rid of DRM and change your marketing and pricing model so that it is convenient and cheap enough for most cons
Does licensng DRM lead to success? (Score:5, Insightful)
The operative word is "third party licensed."
Audible.com is licensed to multiple vendors. How have those vendors done? Besides the iPod, Audible.com's DRM is licensed to a number of other players. Has it been a major factor in anyone's purchase? Possibly, if they want to listen to audible.com content.
WMA/Plays for Sure is licensed to multiple vendors. How have those vendors done? The market has spoken.
Zune WMA isn't licensed. The market is in the process of working out how the Zune is doing, but the prognosis isn't good.
FairPlay isn't licensed. The iPod is doing great.
The iPod is reallly a good example of what's called a "Network Effect Monopoly." People buy iPods because it has the most accessories. The iPod has the most accessories because people buy iPods. Etc etc etc. eBay is the same: people sell on eBay because the buyers are there. The buyers are there because everyone sells on eBay. Ad infinitum.
Will licensing FairPlay change this? No. If Apple licenses FairPlay to hardware makers, it'll make the iTMS even more dominant. If Apple licenses FairPlay to other stores, it'll make the iPod even more dominant in hardware. If it licenses FairPlay to everyone, then Apple will sit on the dominant DRM system, period.
As I said before, there isn't one thing that makes the iPod successful. But of those things, DRM is definitely not one of them.
Re: (Score:2)
No user base for WMA cracks (Score:2)
Re: (Score:2)
Because:
(a) hardware players that support WMA are cheaper than those that support AAC. If all you care about is yourself, and you don't have an iPod, why would you pick FairPlay?
(b) if you want to release stuff, rather than just crack it for your own use, why does it matter what format it comes from... you'll want to transcode to MP3 (which is the
Neither are secure. (Score:2)
They both attempt to accomplish something that is impossible.
Security requires communication between two or more trusted parties, if any of the parties are not secure then the communication isn't secure. With all DRM schemes there is only one trusted party, the content producer. The other party being the consumer who can't be trusted.
Without 'Trusted Computing'(trusted by the content producer n
No, no no!... (Score:3, Informative)
DRM is bad bad bad, and is broken whether licensed or not. Don't use it, that's the answer
uh.. DRM is EVER secure? (Score:2)
a question (Score:2)
I'm confused, isn't DRM about protecting a copyright instead of "the keeping of secrets"? What is TFA trying to say here?
DRM is 'logically' infeasible. (Score:2, Insightful)
Security Through Obscurity (Score:4, Interesting)
The only reason that PlaysForSure isn't cracked all the time is because no one really uses it on a large scale. Since Apple dominates the DRM music field, and most DRM'd music sold is from Apple and includes FairPlay, then of course people are going to attack FairPlay more than PlaysForSure. If it were the other way around, PlaysForSure would be just as insecure as FairPlay.
I don't really believe that, of course - but it was nice to turn the whole security through obscurity argument around for once so Windows fanboys could see how freaking STUPID it is.
Closed, non-interoperable DRM isn't a DRM (Score:2)
It's CMM - Corporate Monopoly Management.
The ones pushing proprietary DRMs probably could actually care less about piracy.
I'm Tired of the DRM Articles (Score:3, Informative)
Secure? (Score:2)
Also, a DRM scheme being a little bit cracked is like being a little bit pregnant. Either it's cracked or not. CSS, for instance, is cracked (weaknesses in the scheme allow keys to be recovered through brute force).
Not a question of interoperability vs. security (Score:3, Interesting)
The point Jobs raised in his essay is that it's harder to propagate fixes to software that is broadly licensed across many vendors, which in turn means that vulnerabilities remain in the field longer. He also asserts that this could threaten the agreement between Apple and music companies, although you might want to add salt to that to suit your tastes.
There is no such thing as open interoperable DRM (Score:2)
And their only purpose is to hinder interoperability.
DRM systems are closed towards content creators and distributors.
DRM media are closed towards users.
I do not care if iPod and Zune Restrictions systems are "interoperable"
because there will be no interoperability with my Linux computer.