Slashdot Mirror
Security Analysis of My.MP3.com and Beam-It Protocol
Serg writes, "Potential ammo for the upcoming MP3.com trial? From a member of the Rice University CS Dept: "We found the protocol to provide strong protection against a user pretending to have a music CD without actually possessing it, however we found the protocol to be unnecessarily verbose and includes information that some users may prefer to keep private."
You can grab the report in either PS or PDF format. "
this whole issue is entirely corporate -- corpA trying to make money, corpB claiming that corpA's profit-making activities are causing corpB to lose money ... and yet it all comes back to something that, at one time, had huge potential for the little guy ... what happened?
I am, therefore you think.
It's good to hear that they didn't add more grease to the fire.
That's really what this all boils down to in my mind. Lots of people with vested interest are worried about something that they can't stop. And they'll make life obnoxious for all of us for a very long time.
--
Max V.
There should be a moratorium on the use of the apostrophe.
Max V.
NeXTMail/MIME Mail welcome
It WILL be cracked, it's just a matter of time.. client-side security doesn't mean much anymore.
Is that if you have the CD, and you're too lazy to rip it to your hard drive and would rather drag it across the net at some arbitrary speed, with errors, and without knowing if the song is actually there, you've got issues.
If you own it, you're going to end up with a much better sounding song in about the same amount of time (or less)...
If you don't own it, you shouldn't even be downloading the songs in the first place, so stop fighting for Napster, Beam It, et al...
The upcoming trial isn't about security, so this is rather irrelevant to that. However it certainly does make a rather nice front.....
When will the MPAA, RIAA, etc. realize that the days of closed-media are OVER!!! The other day, I wanted to listen to that new Marc Anthony tune -- I fired up Napster and downloaded it with the quarter-hour.
They are trying to protect an outmoded means of media distribution. But like dinosaurs, it may be a while before the brain realizes the rest of the body is dead.
End Rant Mode
This post encoded with ROT26. If you can read it, you've violated the DMCA. Handcuffs please, sergeant.
While I think that this this news about beam-it security is very good and will make things a bit more difficult for the RIAA, IIRC their main complaint is the fact that they are "broadcasting" the music. MP3.com is like a radio station where you get to play all your favorites (that you happen to own) without all the commerical and control the industry requires. I think this case is very similar to the MPAA: it's all about control.
--------
-------
"Every artist is a cannibal, every poet is a thief."
Any user who uses My.MP3.com is inherently giving up a remarkable amount of privacy. My.MP3.com knows every CD in a user's collection that they "beamed" to the server along with the user's e-mail address, network IP address and and Ethernet MAC address. An unscrupulous marketer could correlate musical preferences with other lifestyle choices and use this for targeted advertisement. MP3.com's pri-vacy policy 5 does not offer strong guarantees against this kind of behavior, and the ability to opt-out is at the bottom of the user-preferences page - something that most users will never do. And that is the reason for this sort of thing in a nutshell. While it sounds like a great idea for people who have a lot of CDs that they want to listen to both at home and at work, they will find themselves at the end of a barrage of "targetted" advertising. The spread of information from MP3.com will be exponential as more and more agencies sell your profile to interested parties. Oh joy, yet more spam. On the other hand, the lawsuit issue could be a good thing. MP3.com have a lot more money than the defendants in the other similar cases recently, and they are a company, able to organise their defence better than we've seen in the DeCSS trial so far. A victory in this case would have implications for the entire issue of people's right to use what they've bought, and for the digital media industry as a whole. Despite the privacy issues, which I don't like, I still hope MP3.com can win this case.
This is such a major flaw in the whole concept of the product. Understanding the reasoning behind the concept, but I would think they could have found a little better architecture. From a business model, how are they going to promote a product that fundamentally compromises the privacy of the user? Doesn't make sense to me.
More race stuff in one place,
than any one place on the net.
The paper just reports on the protocal. Its nice work but its nothing shocking. It might not even be entirely correct.
I just have a feeling that there is something more important/worthwhile in the submission box than this.
The surprise isn't how often we make bad choices; the surprise is how seldom they defeat us.
Any ideas why they would send the MAC address?
I would suppose mp3.com keeps an LRU list of the last 10 or so MACs to access a particular account, and denies access if multiple MACs try to access the site at the same time or if accesses occur from too many MACs in quick succcession.
-- Too lazy to get a lower UID.
I fail to understand how the Beam-It system compromises the user's privacy...although they certainly suffer from the Ralph's Club syndrome, it does not seem like this is something that would constitute a full-scale privacy breach, especially if there is an option to opt out...certainly not on the same scale as the doubleclick cookie issue.
Maybe I'm just missing something. But then I still use my Ralph's Club card too.
Not that I find Beam It to be the most useful thing in the world. I much prefer keeping everything on my 36GB HD =)
--"You can lead a man to knowledge, but you can't make him think."
I can't stop myself from wondering why the question on the message is "possible ammo ... " ... a user must have posession of the original CD (or a bit-for-bit perfetc copy ) ... The security of the system is not dependent on the mocule secrecy"
... So why do you post misleading questions ?
After having a brief look at the article two things were very clear :
1. the guys at Rice showed that the transaction language makes the protocol look a lot like ftp. And we all know that ftp servers are pretty well pretected
2. in the conclusion of the article said (and I quote) " our analysis has revealed no glaring security flaw
I guess it should be pretty obvious for anyone that this article doesn't say anything about the security of the mp3 format. Or of a CD
I have over 600 CDs in my collection, bought over the last 10 years. I like the idea of being able to satisfy the sudden need to listen to a song while I'm at the office, without having to lug around my CD container, or 60 mp3 CDs (which, as a matter of fact, I have). For the customer, there's much to win. Why do we have to put up with this kind of corporate bullshit then? Fight and win, mp3.com!
Potential ammo for the upcoming MP3.com trial?
I'm going to disagree. The movie editors that work with the movies off their hds are just as libable if they are on a network then. I could simply crack their machine and download their movies. Security holes will always be around, that is why security analyst have jobs.
Justen Stepka
...someone were to rip their CDs to their own drive (or rig up a CD jukebox, etc) and allowed themselves, and only themselves, to access their own private server for the same result?
The result, for that one person, is the same though the work involved is now significant. The difference is now it is 'narrow'casting rather than a broadcast.
MP3.com removes the upfront workload of ripping everything or rigging up the jukebox, and centralizes the servers -- which makes them accessable. While I (for example) could eventually get something like this set up privately at home, running a server isn't a real option for me. No, I don't use MP3.com, but I do see the utility of the enterprise.
Not saying which is best or who is right, just curious about this.
I don't subscribe to RMS's GNUtopian vision.
The portability issue is key. I use Beam-It, and it makes things soooo convenient when I want to listen to music in a computer lab. Just bring headphones. :) Oh, and Beam-It takes a *lot* less time per CD han ripping - I can "beam" a CD in under a minute, but my machine rips+encodes at just a shade over 1x, i.e. 40-60 minutes depending on CD length.
retrorocket.o not found, launch anyway?
It is possible to respect the intellectual properties of others while still offering new and innovative services. Rock on.
:-)
There was definite worry about whether or not MP3.com's Beam-It software was going to be sufficiently secure as to avoid lawsuits. Since the MP3.com software was closed-source, and the protocol wasn't specified, it was a definite possibility that MP3.com was relying on "security through obscurity", just as the MPAA did with DVD (gee, doesn't this all just tie together nicely?).
However, the Beam-It protocol was obviously written with security concerns in mind. Knowing the protocol does not make it easier to spoof MP3.com into thinking you have music you don't (well, not *reasonably* easier).
Contrast this with CSS. Once the algorithm is known, it's easy enough to distribute unencrypted copies of the software, if you are so inclined (note: this *wasn't* the original intent of DeCSS, and I certainly haven't seen any evidence to support the idea that people are now pirating DVDs with DeCSS. And, yes, it was possible *before* DeCSS came about. There's also the whole bit-for-bit copy thing, if you can find the media...).
Yes, it's comparing apples and oranges. But you'll notice that MP3.com has achieved a happy medium for consumers-- allowing them to listen to other people's music, but still respecting the intellectual property of others.
Funny, huh? That, in my mind, was the last legal hurdle-- proving that the Beam-It software took legitimate measures against piracy. The paper is well-written enough that MP3.com could probably submit it as evidence (both in the RIAA's lawsuit against MP3.com, and in the slander lawsuit, since the RIAA has said that MP3.com has a flagrant disregard for IP, and this proves otherwise).
I'm an AC because I don't want my real name moderated down for run-on sentences
Very nifty protocol. I wouldn't have thought of a random CD block check.
:-)
This potentially makes it much more difficult to fake the response to the server, tricking it into thinking you have the CD when you don't. Also the hash of the block is computed on the server side for verification, rather than on the client side. Good. They don't trust the client at all.
Now, of course, someone will just find a back door somewhere. Still, it shows that they didn't just whip the thing out, but put some thought into it.
It's still a stupid service without widespread broadband. But more of that is appearing every day.
---
- Give a man a fire and he's warm for a day, but set him on fire and he's warm for the rest of his life.
This would be to prevent the "cartel" discussed in the article. I think they will leave some leeway, in case there are legitimate reasons to be playing two or more mp3s from the same account simultaneously.
The easiest way to cheat would be to borrow and beam your friend's CDs. A good afternoon of beaming and you could double your collection.
-- Too lazy to get a lower UID.
OK, so this is completely OT. But I hate it when you see documents like this that are written in 2 column style. Sure that might work well on paper, but it really sucks in the Acrobat reader unless you've got a monitor with high enough rez to easily read the whole page at once. A single column layout is MUCH MUCH easier to read
Folks, instead of keeping your heads in the ass of "make all music free", realize that artists need to eat.
This internet thing, and the OSS mov't is new to most people...especally those that have lots of money invested in the "old" way of doing things. It takes time for ppl to get used to it..this is a good start.
The article itself is very useful in explaning how the system works, and it gives wannabe programmers (me), the ability to see how something is reverse engineered (it really took away a lot of the mysticism IMO).
Q: What do you think about American Culture?
A: I think it's a good idea.
(adapted from Gandhi)
Of course, if you borrow your buddy's CD, you can rip the MP3s yourself. Mind you, if you own a CD, you can do it as well.
What is this service good for again? :)
I suppose not *everyone* has free and easy access to a personal FTP site. But I'd expect that will change over the next couple of years, what with bandwidth and hard drive space being so darn cheap.
That's really what this thing comes down to. In most cases, to get the services that you want, you have to give up some privacy. You want the goverment to give you Social Security; then you have to have a number attached to you. You want a credit card company to loan you money; then you have let them know about every purchase you make. If you want to have MP3.com handle all your music, then you have to let them know what music you like. That's just the way things go. /. has a feature to remember your user name and password. It is pretty insecure but it makes getting access easier. In MP3.com's case, some of the information is needed, some of it may make improve the service, and a some of it may turn out to be nefarious. The consumers can dictate what they want by either using or not using the service. That is part of the beauty of a free market. Consumers can dictate the forms of new products and services with their buying power. Companies will not offer what people do not want.
Although there are often some insidious reasons for collecting user data, the biggest reason is usually because it is either integral to the service or it makes it work much better. For example,
-- soldack
While it may have not been the original intention, showing interest in security is showing responsibility. By showing that MP3.com is taking active interest in attempting to solve some of the problems over which they have been criticized they will get big brownie points.
it seems like the industry is trying to put a stop to "illegal" mp3 sites by coming up with a way to verify that you already own a physical disc. they will then be able to say that because they can verify you have this disc, there is no longer a reason that songs from label-controlled artists should be available freely on the web because it constitutes copyright infringement. the great thing about mp3s is that they're small, quick to download or create, and give you the option of listening to parts of a CD BEFORE you buy the album, listen to the rest of it and find out that the whole album sucks except for the one or 2 catchy songs that happen to make it onto MTV. it's hard enough to find a STORE that will let you listen to CDs before you buy them. (i know of one whole such store in my area). it will also be impossible to obtain ONE good song from an album of sh*tty ones because you don't want to go pay $15-$20 for a full album to obtain a single. i wonder what sort of revenue in sales is created for the music industry by consumers buying a full album to get that "neat song i heard on the radio". the target-related advertising part of this bothers me too, because if you sample the way target advertising works for companies like BMG, you'll find madonna and christina aguilera (sp?) and nine inch nails and metallica in the same "if you like this artist..." category...and the associated artists most certainly are nothing alike. basically, i think what is going to happen here comes down to people receiving a lot of email and promo offers for things they don't want/need/have time for, and it's going to empower the government and coprorate junkies to have a tighter grip on what citizens do with the things they own.
-rich henning -linux 2.2.x
I make a rational choice when I use services that demand information in exchange for a service... I opt out of systematic junk emailings and give them the info that they request in exchange for the service that they provide.
Take, for example, one of my favorite sites on the net, Moviecritic.com. This site has saved me lots of money and time by helping me to avoid movies that I wouldn't like. The site uses collaborative filtering to do so, but in the process also asks for some demographic information. Now, I'm sure that the demographic data which moviecritic collects is highly valuable. I'm also sure that its owner (the person who collected it from consenting moviegoers like me) sells it to movie studios, etc. I don't care. I like the service and just because there is capitalism and age/sex/zipcode information involved doesn't mean it's evil.
Amazing magic tricks
from the 'Terms and Conditions' on mp3.com
(my ephasis)
Does anyone with an mp3.com account have a copy of these or a link to them? I'm curious if any of these agreements (which you can't read before saying 'I Do') prohibits reverse engineering of the software, and/or attempts to circumvent it.
-Red
.sig Karma out the wazoo, better to spend points elsewhere if this is above 2 or below 0
If Alice (who happens to own a large cd collection) register her collection using Bobs MAC and IP address, Bob could listen to all the music that Alice owns. Then Alice could do this again, and again, giving all here friends access to her collection. Alice could automate this, she creates a web site, where you enter your MAC and IP address, and a beam-it account is created on your behalf. To do this Alice needs a big disc, or a lot of CD players in her computer.
Lets take this another step:
Create a distributed registration service (think Napster), where every user has a CD in his/her cd player and a common database of avable CD at the moment. When you want to listen to a particular CD, you register it on beam-it, and receives the challenge. Then you forward the challenge to the machine which has the original CD, and get a response back which you forward to the beam-it server. Viola, you receive your MPEG2-layer3 file, without owning the CD.
The weak spot in the protocol is that you don't want to transfer a lot of data (that's the whole point with beam-it), so you could easily send the data to another machine for validation.
QED
RFC1925
I read last week that Microsoft's next Windows Media Player will have pay-per-play (called "micropayments" when we like it and "obnoxious fees" when we don't).
The casualty in all this is going to be personal privacy. I think any kind of secure intellectual property scheme is going to have an "identify the user" component.
I can think of a few flaws in the system. here is a quick one fake/shared accounts. If you share accounts with peoplepretty soon you could get a VERY large library of "autorized" music. If enought people start using 1 acount aund updating it then the library will become huge. some sort of crack/link to the cdda. or special server. i.e. server set up to give beem-it whatever ID its looking for.
First post is a quick and zippy way of dumping off your mod points. If this wasn't the motivation, the moderator would have used his points to mod good threads up and not dump them on a post which was rated zero to start with. Zero remains at the bottom of the heap anyway, why move it further? It makes no sense. See this monkey?! It makes no sense, Why does Chubacka live on Endor? It makes not sense. . .
More race stuff in one place,
than any one place on the net.
I could get used to the idea of carrying an additional key on my keyring that simply contains an identity. I wouldn't even mind paying $10 to $100 *in cash* to buy the identity down at the local computer store.
In the fourth paragraph, that should be "unencrypted copies of the movies", not "unencrypted copies of the software". The UDF filesystem does not encrypt data as far as I know.
My apologies.
The AC that still uses run-on sentences.
How do you figure this is client-side security? MP3.com owns a copy of all the disks, they could change the data they ask from from the CD periodically. Your 'spoof database' of information that mp3.com asks for would only be good for a week or two.
I suppose that's good enough for you to set up your account and download the mp3s, but its likely that the spoof database is similar in size to just providing the pirated mp3s for download in the first place.
Its not like someone's going to set up an account that has EVERY disc mp3.com owns (yeah, they won't notice that) then publish the username on the net for thousands of people to use. Only one person can connect on a username at a time, so your account would be shut off pretty quickly if you tried that. Even if you had multiple accounts, you're going to be turned of pretty quickly, as well as investigated.
It seems to me that there are waaay easier ways to pirate music than hacking through mp3.com.
Zipwow
I don't know which is more depressing, that 2/3 didn't care enough to vote, or that 1/2 of those that did are crazy.
Sure, you could do what you've described, but is it really practical? If you're going to create a distributed database of illegally copywrighted works in the range of terabytes of data, would you want to provide the raw CD information, or just the damn mp3s themselves?
Additionally, this sort of 'service' would be clearly illegal, and anyone involved in it would be both detectable and prosecutable.
That's assuming they live where there's laws, but if they live in China they probably just have a big database of mp3s ANYWAY, which is really the easiest route.
This is akin to saying "The banks in the world are insecure because the vault could be broken into by freezing the lock and applying 40 tonnes of pressure" when you can just point a gun at the teller and ask nicely.
Zipwow
I don't know which is more depressing, that 2/3 didn't care enough to vote, or that 1/2 of those that did are crazy.
Imagine, for example, that your CD is scratched in such a way that certain tracks are unlistenable. If you were to use the Beam-it software, and the verification process wasn't hampered by the scratches, you could regain the ability to listen to those "lost" songs. I'm not sure how much of the CD is randomly checked in the verification process, but most likely after a few tries you would be able to have a scratched CD verified.
You are severly underestimating the convenience that a service like this provides. It allows you to turn your computer into the equivalent of a CD jukebox without eating up your hard drive space. Now that my Kenwood jukebox is constantly flaking out on me I'm seriously considering switching to something like BeamIt. I have a couple hundred CDs and I'm constantly getting more, so it would be very convenient for me if I could pop a new CD into my computer for 10 seconds and then put the physical CD into storage so that it's not cluttering my work area. I would also love to have access to all my CDs on the days that I'm not working from home and without the need to lug 200+ CDs into the office.
You are also grossly underestimating the effort that such a service can save in ripping as well. If I were to rip every new CD I got I would spend a good hour or so each week interfacing with the ripper (typing in the song title, etc). That may not seem like a lot, but that is essentially what keeps me from doing it. I was thinking of extending Gtcd so that with the push of a button it would automatically rip all of the tracks from a CD and label them based on their CDDB entries, but I may look into using BeamIt instead (if it's available for Linux) since it has the added bonus that I could access my music from anywhere.
It's amazing how big of an effect a little convenience can have. I bought a TiVo a few weeks ago and at first glance it doesn't look like it does anything too revolutionary (aside from time shifting live programs). The features that it provides are available elsewhere for the most part. You can use a VCR to record shows you want to watch and you can use a TV Guide to pick shows that you want to watch. But when you combine all the little things that you could do using some other method into one very convenient system the end result is incredible. BeamIt sounds like it could be to music what TiVo is to TV and I intend to check it out...
-----
Free P2P Backup, Windows & Linux
- How does it protect against borrowing friends CDs?
Besides which:
- It challenges you for random blocks from each CD? Well... so you have to put the CD in your CD drive... which means, why not just listen to it from the CD drive?
Its fair enough if you say "oh it means you dont have bother taking your CDs around", but eh? I'm confused. If it needs to grab info from teh CD, how does this mean you dont have to carry the CD around?
My linux box has never successflly run windows. It started life as a Novell 4.1 server and was loaned to me by my employer until such time as they needed it back ;-) I tried installing 95 and nt, but it crashed immediately and the harddrive would not remain formatted, at least in a way windows would recognize. I have installed windows on all sorts of machines and not seen similar problems. It hated my cd-rom drive( so what if it is a Plextor and you need to use a caddy, redhat liked it) I fdisked my hd and installed Red Hat. No prob, except netscape crashes way too often.
I tried to rip cds on my nt laptop, but the programs seemed not to work for my wierd laptop cd drive. I have several gigs free on my linux box, so ripping cds to it seems like a good use especially since my stereo stopped working.
--- If you don't want to know the answer, don't ask the question.
I can't believe that no one has mentioned this: the RIAA lawsuit has nothing to do with the Beam-It technology, its security, or MP3 encoding. Nothing.
To provide the music stream, MP3.com has to have ripped versions of every CD. They claim that they've got a database of 40,000 CDs available to be "beamed".
The RIAA claims that MP3.com didn't BUY these 40,000 CDs; that they made unauthorized copies to create their database.
Here is the relevant information from this CNN story:
This RIAA statement reiterates:
While all these discussions are fascinating and relevant to many outstanding legal issues, they somewhat miss the point of this particular lawsuit.
------
>As for privacy, this isn't that much different than buying CDs from a "club." They're not
>grabbing financial information, email, Netscape history, etc. Them knowing what CDs I have is
Exactly, you give up more privacy buying from a club. Let's compare what info they get about you:
CD club:
Real name, street address, credit history, and all the CDs you bought from them. All cross-referenced with whatever they bought from the direct marketing company that sold them your profile.
my.mp3.com:
Email address, MAC address, IP address, and all the CDs that you choose to beam in.
If you're paranoid about privacy, use a throwaway email account from a free mail provider. The IP is probably a dynamic dialup IP. The MAC address is troubling, but not that many things record and cross-reference your MAC address yet (Windows 98 and Office 97 do). If they do, it's easy enough to replace. I have a closet full of old ethernet cards.
Oh yeah, and block cookies from mp3.com and their banner ad providers.
Okay, consider the question of why MP3.com found it necessary to put most of this in a closed-source library.
I suspect that that is because there is no way for the MP3.com server to verify the ethernet MAC. An open-source implementation of this library (which I'm sure will be forthcoming real soon now) could forge the MAC.
Why does MP3.com want the MAC? I assume it's to prevent account sharing -- if three or more MACs use the same account, they'd probably start denying requests, or at least they want to be able to start doing that if it becomes a problem.
If the MAC is their _only_ security against account sharing in this protocol, a reverse-engineered reimplementation would allow wide-spread account sharing. Moreover, it is reasonable to assume that the MAC is the only security: To rely on IP would flag anyone with a dynamic IP as an account-sharer.
This suggests that their sharing-detection would be vulnerable to abuse by an open-source reimplementation of their closed-source library. It also I think explains why they found it necessary to close the library: They've got a security flaw that could be easily exploited here.
Using the MAC was a clever solution to the problem of account sharing. I'm afraid though that it wasn't clever enough. In the absence of any way for the server to verify the MAC, they're vulnerable.
--G
I have a large box of cassettes and a HUGE
collection of albums. (The large round black
vinyl things, for the youth impaired.)
Many MP3's I've acquired I own on these media.
The equipment to move the tracks to digital is
available to me here at work. However, it's
easier (to say the least) to acquire music I
wish to listen to (and have paid the fee to own)
over the internet.
While compromises like this service are nice,
they're not an absolute solution by a long shot.
The fact that they're grabbing an intrusive amount
of information, however, is offensive. (I suspect
I'm preaching to the choir here, though.) It's not
enough for an organization to ask if you want to
send information, they should disclose what's
being sent.
(A co-worker just mentioned his extensive eight
track collection to me...)
-- Chapman's Observation #1: Nothing is ever simple
It is reasonable that a user beams CDs from a very limited number of machines, since he must beam his CDs from home.
My guess is therefore, that an account gets blocked if CDs are beamed from several machines. In this way I can not go visit all my friends and beam their CD-collections to my account.
Another thing is accessing the same account from several machines at once. Although some say they don't block it now, it doesn't mean that they won't block it in the future.
-- A Mathematician is a machine for turning coffee into theorems. - Paul Erdös
Did you even read the post (how the hell did you get a 1, moderators smoking crack again?)? He quoted the price model he wanted not the actual cost breakdown.
Artists as is make about 7 cents on the dollar, usually less for new groups. I would not feel guilty getting mp3s. Even though cds should be much cheaper I would rather pay the whole $16.00 price to the musician rather than the RIAA/companies on general principle.
Not to mention that the medium (cds) are cheap and have been around for years so there is no R+D to pay for and the existing cd presses paid for themselves long ago.
It is extortion.
I know it doesn't sound very practical, because if a friend has a CD he could just as easily let you borrow it and "beam" it yourself, but what about on a larger scale? One could purchase CDRs on the black market and then beam them.. this would seem to hurt the industry more than even borrowing a friend's CD and beaming it.
Any ideas about whether CDRs would be authenticated?
and free, too.
--
--
"It is now safe to switch off your computer."
now scale this up to a whole company. I borrow a stack of cd's from all the folks in my company hallway. and they borrow each others (and mine).
yeah, lots of holes in this model. just because you have a cd in your drive does NOT give mp3.com the authorization to allow you to access it from their site repeated.
don't get me wrong - I hate the RIAA (who doesn't these days?) - but I have to admit that the reasoning behind my-mp3.com just isn't sound enough to stand up in court. IANAL, of course.
--
--
"It is now safe to switch off your computer."
The dongle would not carry any data that represented money. Instead, it would contain a unique number, probably cryptographically signed by a company like Verisign. The only thing on the dongle is an identity.
I could buy such a dongle for cash at my local computer shop. Then I could plug it into any USB-equipped computer I find myself at and talk to an Internet Media Provider. I could initiate a secure connection and say "charge this dongle to this Visa card / anonymous e-cash account". Then the Internet media provider can send me my streaming media and bill me for it.
Throw in some simple public key encryption (the dongle now contains a private key and a public key) and you've got something immune to replay attacks.
Now the real question is economic: will people pay, say, $0.10 an hour for an Internet jukebox? I wonder how much my.mp3.com pays for the bandwidth to send an hour of Real Audio?
1. Username/password authentication is a standard authentication scheme. Just dont let 400 people use the account at once.
2. Server side security.. The only thing you can do on a hacked account is add CDs.
3. Privacy concerns... So you send a few things to MP3.com. IPv6 will use MAC addresses, your IP address IS logged, and your email is not private.
I wish the RIAA would let MP3.com come out with new technologies. But then, Evil megacorps are everywhere.
Later RIAA, gonna go beam-it over my dsl...
The strange thing I see in all this is that everybody is making a big deal over the possibility of "faking" ownership of a CD so that you can download it illegally from my.mp3.com, but nobody (except several IRC channels who are doing this) seems to realize a much easier method - just share an account with lots of people. Each person legitimately "beams" the CDs they own, and all the people sharing the account can then access all the CDs. Sure, you could do this sort of piracy before by ripping your CDs and sending them to people, but here you're saved the trouble of ripping, and the bandwidth usage is all my.mp3.com's, rather than your modem/DSL/cablemodem/T1 connection.
10 PRINT CHR$(205.5+RND(1)); : GOTO 10
What stops me from getting an account at MP3.com, uploading some CDs then sharing this account with ALL my friends?
Won't this lead to the same kind of pseudo-piracy that exists today with downloading MP3s of people's computers via Napster? After all most sites allow you to log in from multiple computers, so what stops me from uploading a few CDs and posting my account info on my webpage so everyone can share my taste in music?
Now if they could just get it to work with CDs I actually own. Damn that Error 29!
MP3.com prevents you from downloading more than one track in your catalog at a time. I tried it and got a message, "We are detecting multiple downloads to the same IP... bla bla" It's cool, it can be faster than ripping, I've used it mostly just to get back the tracks of some scratched cd's I own.
I'd like to make the point that it actually isn't at all secure. A napster style configuration of people interested in listening to a wide variety of music could, by distribution, make the security method pretty much redundant.
:/
As noted, in order to sign up a CD, you need to be able to verify a particular random track. If the client machine, rather than checking its own CD drive, made a request out to a collaborative network for a given CD before attempting authentication, it could, apon reception of the request for a particular random block, forward this request to another machine who claimed to have the relevant CD, and get the data from that machine, then forwarding it on. once this has happened, its in your account, you don't have to repeat this, so a system where CDs are in drives only on occasion is perfectly acceptable.
Take 20 or 30 people, and an application that requires that they have a CD, any CD, in their drive on load, and they can Beam register any of the 20 or 30 CDs online at the time, and as time goes by, they would rapidly build up a massive collection without a huge number of resources being tied up.
The Beam It method is perhaps, because of this, even less secure, and more convenient than Napster, no long download times, no scratched, damaged or badly made recordings, all available for free on the condition that you have at least on CD you can share with everyone else.
I have no doubt this concept has been picked up already by others. Game over mp3.com
You can't win a fight.
That's unlikely, unless the player software reports the MAC address back. AFAIK, only the submission client does that.
I imagine the purpose is to build up a database of MAC addresses to lifestyle data. MAC addresses (being both unique and relatively immutable) are good keys for a database of things such as musical tastes, ad responses and such. That it can be correlated with an IP and an email address is a bonus.
A lot of Windows websurfers have a tendency to blindly download "cool" software, such as that web cursor changing plug-in that was discovered to send personal data back to its maker. It is in this way that the MAC may be accessed, and may become more useful than a DoubleClick cookie.
She needs a smaller disk or less CD players if she just rips and encodes the CDs she wants to make available as mp3 files.
As for the rest, that's a lot of work to go through to get MP3s streamed to you. In fact, you could reduce the amount of work involved and the amount of online storage required by simply ripping all the CDs in question, keeping the mp3s online, and sending them to whoever requests them, leaving mp3.com out of the picture altogether!
So, in other words, you've really proven how mp3.com can't be effectively used for piracy. The same task can be accomplished much more cheaply and easily by NOT using mp3.com, so why would you go through all the extra effort?
--
"Convictions are more dangerous enemies of truth than lies."
Bandwidth.
RFC1925