Slashdot Mirror
HDCP Encryption Cracked, Details Unreleased Due To DMCA
Lord_Pall writes: "There's a very good article on SecurityFocus about a Dutch cryptographer. He apparently has cracked the HDCP video encryption standard, but won't release the research for fear of reprisals under the DMCA."
Update: 08/15 06:10 PM by J : Meanwhile, see
Keith Irwin's paper
which has been released despite the DMCA.
Update: 08/15 07:00 PM by J :
And someone else points out
this old thing.
Everyone who hasn't written a paper on cracking HDCP raise your hand.
Is it also possible that double ROT13 (presumably more secure than single ROT13, right?) will also be illegal under the DMCA? Just wait till someone tries to make the act of reading illegal.
For those of you who don't know, double ROT13 (AKA ROT26) will bring you right back to where you started, unencrypted.
--MonMotha
China is our "most favored nation" ... they didn't do anything after Tienneman, why would they do something over something as trivial as copying discs
Because the RIAA and MPAA members are stuffing senators' pockets? This may be just the thing to get the United States to officially recognize Taiwan as not being part of the "People's Republic" of China.
Will I retire or break 10K?
Look, these guys aren't after The Ultimate Unbreakable Encryption Mechanism. They're after something that will prevent the average person from gaining "unauthorized access" to their content. And as you note yourself, they aren't after the guys generating bootleg copies. They want to prevent the average person from being able to make useful copies of their content.
Why?
Simple: their goal is pay-per-view/use. They want to be able to rent their content out to people, and prevent said people from ever having a permanent copy. Because a permanent copy obviously defeats their ability to rent that same content to whoever has that permanent copy.
The reason this will work is that most people (obviously) aren't technically inclined and aren't capable or even interested in cracking copy protection schemes, nor are they interested in going through the trouble of "going around" the problem (e.g., by recording to analog media). They just want to view the content.
The Big Corporations know this. They're counting on it. But they need something like the DMCA to pull it off. Why?
Because they know that it's fundamentally impossible to create a crackproof system. So instead of directing their energies towards that goal, they directed it towards creating the DMCA. If people are prevented by law from creating or distributing the means to crack content control systems, then companies can successfully force pay-per-view content down the throats of the people.
The corporations also know that eventually a content control cracking mechanism will become available to the general public anyway. So when it does, they know that it can't do anybody any good if the general public can't easily get its hands on it. Why do you think they're working so hard to shut down P2P distribution mechanisms? By doing so, they successfully remove the means for the average person to get their hands on content-control cracking mechanisms and the content that would result from the use of said mechanisms.
The corporations don't care about the rights of the people. They only care about their money. They will do everything in their power to get it. The only difference I see between them and the mafia is that the corporations use law enforcement itself as their strong arm.
Use 'slashdot stuff' in the subject line in any email you send me if you want to get past the spam filter.
"What is it with people today, they all act like a fearful bunch of wussies. With folks like that we don't need any DMCA enforcement."
One day he may need to come to the USA for work, like Torvalds did, only to have the feds bust him.
Of course I'm not talking about reality, I'm talking about Swordfish.
actuallly, I've been able to go through safeweb. might need to enable cookies during /that/ session though. (cookies remain on safeweb's side).
OK, what you need to do is come up with the crack yourself and publish it so we can all see how it's done. I think Phil Zimmerman did a great service for his country by standing up to the thugs (over PGP). But I don't expect anyone to willingly expose himself to litigation, imprisonment, and possible bankruptcy so some slackers can quietly cheer in the background. What I do hope is for people to speak up about truly despicable laws like DMCA and boycott companies like Adobe that invoke it.
the drunk on the bus who claimed to have solved the problem of Middle East peace, but vomited and passed out before he could tell me...
Niels Ferguson (who is probably as vain as the rest of us) chose the only option available to him:
Leak the crack anonymously and miss out on the fame.
Release the crack and suffer the consequences.
Anounce the fact that he had cracked it but not disclose it.
It's great to see the fear and lothing that the Sklyarov case has caused. Still, information will out. These paranoia inducements will untilately be us useless as the encryption systems they are protecting. Eventually we'll get a suicide cracker...
- - Sha la la la . . .
You mean like how Niels was arrested in his native country? So much for that idea.
Ok, so here's what I'm thinking...
Under the DMCA, it is against the law to circumvent content protection schemes? Or is it against the law to disseminate such information?
In either case, the HDCP crack isn't being released, but 'a pretty good hint' has been given. Now, how 'good' must a 'hint' be before it violates the DMCA?
Say the 64 bit backdoor key to some encryption scheme is found to be 83A2FA8F.. Is it a 'good hint' to tell the word that the key is probably somewhere between 83A2FA80 and 83A2FA90? How about 83A20000 and 83A2FFFF?
We've seen DeCSS implemented in so many ways, not only machine executable but transcribable, artistic, and as a frigging Haiku even...
What makes the publication of a crack into a 'hint'? Could I just rattle off the source code, prefixed with a 'something like' and followed by a 'maybe', and be safe from persecution? Could I draw a few easily understood diagrams? Invent my own words for 'array', 'pointer', etc..
What if, as a 'hint', I tell only part of the implementation to one person, and part to another, and part to another?
Remember high-school? Did your teachers ever give 'hints'? Isn't that cheating? What if an employee of a company issued and unofficial 'hint', when they depart the payroll?
The REAL jabber has the user id: 13196
What you do today will cost you a day of your life
If only HDCP would be allowed to run its course and find its way into the system in hardcode. CSS in DVD players was perfect - let it become commonplace, THEN crack it and distribute the solution. You can't change the encryption without obsoleting the huge installed base of players.
Then they'll be stuck with a cracked encryption until the next generation format comes out. Of course they'll have to make that generation much better (DVD vs VHS, for example or CD vs cassette, or HD-DVD vs DVD) or nobody will convert. It's ten-plus more years of freedom, IMHO.
Long live the cycle!
Is it just my observation, or are there way too many stupid people in the world?
>companies can successfully force pay-per-view >content down the throats of the people. I'm not making this leap with you. Americans never seem to appreciate just how easy it is to do without mainstream media, pay-per-view movies or otherwise. What's this "force?" It's very easy, and a rather inexpensive option, not to even have a televison, not to subscribe to cable, not to order pay-per-view movies, not to listen to music with a label, not to buy dvd's. This whole "media companies forcing their content down our throat" argument makes no sense to me, as long as it's optional to buy entertainment, optional to buy cd's, players, tv's, and pretty much anything else. As far as I know it's never been compulsory to watch pay-per-view tv or listen to any particular music format. So this whole question of "force" is really without basis or merit. I'm no DMCA fan, and I curse Sony for SCMS (literally stopping me from copying music I write and record). Still I acknowledge that Sony didn't force me to buy DAT's, and that I opted not to spend the bucks on pro DAT. Americans bring it on themselves, by insisting that they be provided with mundane, standard content. We consume it with passion.
It was last time I heard..
I think a fairly straight forward explanation such as "Would you want to drive a car that hadn't been independently crash tested?" or something. The ability to test encryption schemes would be easier for the lay person to understand.
-- Who is the bigger fool? The fool or the fool who follows him? --
When will we see the light, that there is no point in inventing new Encryption techniques.
We are one race, we should share and care for each other, why try to hide everything anyways ?
We want to know and we will know in the end!
*endless rambeling*
If you give him "full credit for the discovery", he'll end up in jail too. Of course, I agree that he should have just shut up and posted the info to freenet anonymously. What he did was very foolish. He already violated the DMCA. All he did was publicly confess to a crime. Maybe the US attorney general will believe him. I mean, what if he were dragged into US court from the airport and was forced (under oath) to confess to the crime again. He could go to prison for 5 years.
All he has to do is announce to the world is that his research documents is securely kept on his NT server running IIS webservice
...and then nature will take its usual course :-)
* DMCA law seems to be extende to other countries (now I'm gonna question politicians about this)
* Belgium has a law that anyone who commited a (Belgian law) crime, independent of *where* it was commited, you can start a legal process. Currently being sued: Arafat and Saddam
* The "The Hague Treaty", not yet signed by the European Union, kills any European democracy, perhaps me might become a fascist state like the US
Fortunately, the Skylarov case, AFAIK, is a legal test whether the DMCA actually *does* extend beyond US law.
If it is really true what Fuergisson says in his paper, then it might be a good thing the Euro takes its entrance in 2002, this could be the fundamental base of Europower and independency. My opinion is definately the US leaders need to be put back onto their feet.
Bizar technology?
hey, cold you please check if the code or whatever it is can be described as a prime number somehow ? (maybe with gzip ;)
so long
Fry
We're already getting there. Remember Felten's SDMI research?
--
Promoting critical thinking since 1994.
Which is why it's a clever move, not a mistake.
Sure, let them sue him for saying that the technology is crackable. Then next time, they can sue for saying that the technology may have an exploitable weakness. After that, they can sue the guy who thought about potential weaknesses.
Eventually, some judge somewhere along the line and, perhaps more importantly, the public are going to realize how absurd this law is.
How about their joyful use of terms like 'digital crowbar' and 'digital lockpicks'? Last time I checked, it wasn't illegal to own a crowbar (nor, in more than a few locations, lockpicks). Why should this change because someone made it 'digital'? It's been said before, but I'll say it again - the DMCA legislates INTENT, not ACTION. You're not even guilty, having to prove your innocence - you're just guilty.
omigod, this is sooooooo original. did you just think of it? duuuuuuuuuuuuuuuude! yore awsum!
Haven't you ever heard of WIPO? Most of the world is rushing to adopt the same laws. The EU, in particular, practically loves this stuff.
What if he puts it on a t-shirt first?! Or what if he somehow uses the DMCA to protect himself (by making a violation of it the only means to view a release of the information)...
ROT-13???
Hell, publish it as an Adobe E-book
but rather has made the trafficking in devices using that knowledge illegal.
Devices or technology. And any scientific paper describing an attack can be considered technology to perform it, ergo...
-- Si hoc legere scis nimium eruditionis habes.
This situation is more like a victory to DMCA than a proof of DMCA free speech violations... The more researchers announce they fear it, the more strong and widespread the DMCA shall become... The more people break the DMCA law ANONYMOUSLY the more the government will see that the people do not agree with this STUPID law and, since it doesnt produce any results, they will probably switch it with something worst... Thats the reality, they certainly would never pass a numerous amount of laws IF they suffered their consequences... And anyways, we need REVISED LAWS, not new laws...
Hey! Come back here with my 2 cents!
Well, he could just publish it on paper and mail it to anyone who wants it... My understanding is that the DMCA only applies to the _electronic_ distribution of crypto stuff. Once he puts it in meatspace it isn't regulated by the DMCA.
Perhaps whoever types it back into the computer would be at risk, but then again that person didn't crack anything - he just typed in something from a book.
Travis
What use is doing anything once you take away honor and adventure? They are part of the whole.
That would not be difficult since he was one of the people that O.J. murdered.
But the basic principle that US juries may contain complete imbeciles and return a crackpot verdict is clearly valid.
Intel and the RIAA can certainly afford Johnnie Cochran, F Lee Bailey and co.
Bet you wish you thought of this nym first
Just give me the details and I'll release it. Hell, I'll even take the credit too if he wants me to.
What sorry person would like to go to the USA anyway?
I have noticed this as well. People pick a party pretty much arbitrarily, or because of their religious beliefs, ie. pro-lifers, etc... I refuse to vote for any of the republicrats or democracans... err, they're all the same anyway, the only difference is who's bankroll their on.
Also, people tend to only pay attention to who is president at the time, while almost completely ignoring the other 2 branches of the government. It disgusts me, and I would have voted Browne last year, but alas, I'm only 17 2/3 now. When I turn 18 I plan on voting heavily and becoming a registered libertarian most likely, although the constitutionalist party seems ok too, and not as extremist. I think a little bit of extremism is definately called for at the moment though.
Shit adds up at the bottom...
I think the whole "scene" will start reverting back to being 'underground' again for fear of reprisal
Yes. Freenet is the key.
Remember "Bring 'em on"? *sigh
Yes, this thought is dangerous to individual freedom everywhere, but in the end all the laws that don't work. Ancient Chinese laws forbade peasents from owning weapons. So what did the peasents do? Develop their body and farming implements into weapons, and those techniques out lasted the laws, and even used today in a society where weapons are a legal right.
Fine. Let's fix this right now.
*Ahem*
I declare that the encryption is breakable, but I won't tell you how. I'm sure somebody will think of it eventually and release it to the world.
Happy? Now I'm an accomplice. Come get me, you DMCA club-wielding, slope-browed thugs!
I swear, you freakin' Chicken Littles are giving me gas.
Tatsujin
Yes, this is informative. But this is helpful.
Very good stuff. Too bad you didn't link it in your post.
If all this should have a reason, we would be the last to know.
"Thoughtcrime does not entail death: thoughtcrime is death." --George Orwell
Putting people in jail for research is nighmarishly un American.
Friends don't help friends install M$ junk.
*Snicker*
The HDCP consortium has been put on notice that their copy protection scheme is broken. But, thanks to the DCMA, they don't know how! So they'll have to go to the expense of duplicating his research themselves.
Reminds me of an old SF story by, IIRC, Asimov: The "government" sets up an elaborate laboratory and a fake video to convince some scientists that a now dead, lone researcher had developed an antigravity machine. "Knowing" it had been done, said scientists then went on to develop self same device. Could Ferguson have read that story also?
One central issue here seems to be the "if he travells to USA". Appearantly, although the law of course only apply to USA, apperantly, if you publish something on the internet, it would (by USA, or states there or whatever) be considered to have been done in USA (as well as in every country in the world I presume), and thus, when you get there, you get cought.
Now, this of course means that if more countries adopt similar laws and applies the laws in similar ways, soon, anything you do on the net will make you a criminal in a bunch of countries even if it is perfectly legal in your own country, and each time, you get more and more restricted in how you can travell in the world. I would't be surprised if it would be extended to non copyrigth issues in the future.
But why stop there? What would happen if you publish it in some newspaper or magazine? Perhaps one that happens to be sold in news stands all over the world? Even though legal in the country of origin, you suddenly can't go to other countries where it would be illegal. Soon one wouldn't be able to do anything of fear that one day you may want to travell to a country where that specific action is illegal, and due to various curcumstances, what you presented (or perhaps even told, people may retell it in that country, yeah stretching it here, but you get the idea) coule be reached, seen, heared or whatever in that country.
Imagine the example someone metioned in anpther thread, about porn being illeal in Soudi Arabia, imagine you releasing some magazine with porn, it happens that it is sold arround the world, and some copies end up in Saudi Arabie, next time you go there for whatever reason, whack, arresetd as you arrive and punished (whatever the punishment may be, I have no idea, but I bet it is probably not nice).
Soon people would be unable to travell anywhere. I certainly hope we never get there but the trend is obvious and scary.
This has the nice side-effect that all Unix vendors can be arrested because they ship with /usr/bin/tr, which CAN be used to circumvent ROT-13 protection technology:
tr N-ZA-Mn-za-m A-Za-z
Just because a few of us can read write and do a little math, doesn't mean we deserve to conquer the universe
I don't know about that particular story, but a good one along the same lines was written by Robert Heinlein: "Let There Be Light", published along with others in "The Man Who Sold the Moon".
In "Let There Be Light", a scientist discovers a method for building nearly 100% efficient solar panels. At first keeps it secret, and manufactures them himself. However, the oil companies file frivolous lawsuits against him, hire thugs to burn down his factory, torch his demonstration solar car, and threaten violence against his person. So finally he patents it, goes to the big papers, and gives them a big juicy story, on the condition that they also publish all of the technical details. Oh, and openly licenses it for pennies a square yard.
It is a shame that we may have to take the same route, but getting technical details published in a big publication like the New York Times, the Washingon Post, or the Chicago Tribune would be a good way to go. Especially the New York Times. What judge would censor the "Grey Lady"? She's nearly as sacrosant as the Statue of Liberty. Joe Sixpack might not care if some IEEE or ACM publication is censored, but the New York Times is one of the most respected papers in the nation, if not worldwide.
There's no need to hide your publication, but just make it painfully obvious that censoring the publication of these ideas is a direct affront to First Amendment rights.
In that case he hasn't committed a crime - the person who brought the info back to the US did. It should be safe for him to share the information outside of the US in a non-public way, as long as he takes reasonable steps to avoid making it available to people in the US. Posting it on the internet (or any other form of publication) will almost cerainly violate the DMCA. But if he provides the details to other people under an NDA that restrict others from making the info available in the US, he should be OK.
He ould distribute it within freenet itself. It is currently possible to send secure messages to the owners of freesites without revealing your identity. Once it got around, anyone coul post a message to slashdot saying that it is in there...
-- Give me ambiguity or give me something else!
I know this guy, though I haven't talked with him for about six months. He does come to the USA periodically. His girlfriend is American and while they're both living in the Netherlands now, they do come over here once in a while. After the Sklyarov thing I'm not terribly surprised about his reluctance to come forth.
Last I knew, he was working with Bruce Schneier and Counterpane. It's possible that his connection to a US corporation also enters into the decision.
Chelloveck
I give up on debugging. From now on, SIGSEGV is a feature.
This message is encrypted with the English(tm) encryption algorithm. Any attempt to defeat this security will be prosecuted under the DMCA.
Me too, and here's where you can get it:4 f1 6ad2ec7296a7a9fb3.dat
http://russnelson.com/pads/pad-md5-10bd774315b8
It's encrypted. It's also copyrighted. If you decrypt it, you bring down the wrath of the DMCA on yourself. So don't decrypt it.
-russ
Don't piss off The Angry Economist
You're blaming Bush for stupid legislation enacted while "No tort reform" Clinton and "I didn't know taking foreign contributions was illegal" Gore were in power? Why not blame him for the Hindenburg and Titanic too? Too many people here think the Republicans are the only corrupt party in America. There are just as many racists, crooks, idiots, and bought politicians in the Democrat party, but noone wants to admit it. Did you vote for Brown last year?
I have to stop wasting so much time reading Slashdot. It's interfering with my crystal meth addiction.
asdifoulkjfasyuyasdsdfljkasdyyriuyerwkjajsfdbva
a sdfasduiyiuyerwqeroiuvuiyerlkhfydioasdyrlkweay
Hmmm...
[CUT]
[PASTE]
asdifoulkjfasyuyasdsdfljkasdyyriuyerwkjajsfdbva
a sdfasduiyiuyerwqeroiuvuiyerlkhfydioasdyrlkweay
Dangit!
I guess that you can copy stuff without knowing a thing about the encryption.
Charming. Now foreign nationals who visit the US are afraid to release details of weaknesses.
Good, I say. Serves 'em right. Once something people want to steal is released with the format, then the details will come out, and people will steal it. By not quashing discussion, they might have been able to fix it while still in R&D, but by taking the I'm-putting-my-head-in-the-sand approach, they're shooting themselves in the foot.
The truth about Scientology, Xenu, and you: Operation Clambake
Tell that to Sklyarov.
However, even by claiming to have broken the encryption, he's placing himself at risk of being investigated, and possibly detained and questioned should he ever visit the US. (If I were to publicly announce that I had commited a crime, I would expect the authorities to take interest in me.)
Cheers,
Tim
It's official. Most of you are morons.
Section 8 of article I (not to be confused with the first amendment) of the constitution which outlines the powers of Congress includes "To promote the Progress of Science and useful Arts, by securing for limited Times to Authors and Inventors the exclusive Right to their
respective Writings and Discoveries;"
Copyright by its very nature is an exception to the free speech clause of the first amendment. It says that rather than being free to write anything that I want, I mustn't right something that someone else has already written recently. The power to decide the specifics of copyright is in the hands of Congress. However, that does not mean that they cannot go too far. In this case, I firmly believe that they have far exceeded the purpose and intent of the powers granted them and that the DMCA crosses the line into unconstitutionality. We'll see whether or not the Supreme Court agrees.
Keith
Or, he could just go on vacation in France, and pop into an internet coffee shop, and read the news. While reading the news, he could randomly type a post with an alias. Amazingly, like a trained monkey gens Shakespeare, it would happen to be the hack method.
...
Oops.
Of course, he would also randomly type in all the email addresses of world newspapers and magazines while he was at it.
Oops.
Bye, bye
--- Will in Seattle - What are you doing to fight the War?
Example:
*Amendment XVIII - Prohibition of the sale of alcohol.
*Amendment XXI - Repeal of Amendment XVIII
Where in the DMCA does it state that Amendment I, my right to freedom of speech, has been repealed?
Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances.
I thought the Constitution trumped congressional bills, executive orders, and court precedents...
Because people don't trust clickable links around here anymore.
Mainstream news sources wouldn't publish it, and I don't think the courts would protect online news sources because they would not be considered to have the same legal protections, would lack precedents, and would not have the same kind of money or influence as the big guys. Either way, this guy would go to prison. Remember he already broke the (US) law. Publishing it is just proof that he really did it.
HDCP won't last one year if nobody buys it. Remember Digital Video Express (DIVX)? That's the death they richly deserve. The more money they lose on stupid ideas that nobody will buy, the less likely they'll try it again.
If all this should have a reason, we would be the last to know.
I can just see an FBI spokseman now:
"He threatened to to remember the information, and besides, we already got approval from a panel of judge. He's not on U.S. soil, we can do whatever the hell we want with him."
WhiteWolf666 an exBush supporter. All you new-school,compassionate,save the children Republicans can rot in hell
We start to see some of the indirect effects of the DMCA. The choices for secur ity experts and developers will be to A) not publish their works, leaving them f or a more malicious hacker to discover, or B) publish, just NEVER enter the US a gain. Either way research and development as well as security and technical con ferences will start to leave US locations, favoring those countries that won't a rrest their participants.
Other countries will leap ahead in encryption abilities, while the US rests on i ts DMCA laurels. Brings back memories of the smaller, more efficient, more reli able cars from Japan and Europe in the 60's and 70's that caught Detroit by surp rise. Took them 10 or 15 years to catch up.
Unfortunately, as long as there is money to be had from lobbyists, there will al ways be legislative sand for our politicians to stick their heads in.
"Those who forget history are doomed to repeat it."
The world is a cold, demon-haunted place nowadays. It sickens me to be a citizen of this country that so hypocritically prides itself on being free.
Yet it would sicken you more to be a citizen of a country that did not even attempt to claim free speech and jailed you for discussing the very things you are talking about. It would sicken you to the point of not being able to eat their jail food or deal with the goons from the cell next door that beat the crap out of you every day. You are freer here than anywhere else; this is just a minor setback that will correct over time.
His mistake was using his real name at this time, but no one should ever be afraid of using their real name in the face of these companies. They may yet be his masters, but in the long run they will not succeed so long as people like Ferguson and Skylarov cnotinue their efforts no matter what the consequences. So much for the huddled masses, though. That this one thing could for a moment make people think that coming to the US from another country is a frightening thing ranks right up there with Prohibition and the Red Scares.
"Beware of he who would deny you access to information, for in his heart, he dreams himself your master."
SHHHHHH!!!! Don't give them any ideas. The current administration needs just such an excuse to stamp out sin and smut in this country (which they'd gladly do instead of just blocking stuff)
Intel spokesperson Daven Oswalt says the company has received several reports from people claiming that they have broken HDCP. But he says none have held up, and the company remains confident in the strength of the system.
...and yet all of these companies still think that the DMCA is good for them.
It's amazing how on how many levels the DMCA is a bad idea. It's squelching freedom of speech, and it's preventing the companies from producing technical systems that can effectively produce total control over their customers. Of course, the free-speech-squelching part is serving the total control purpose, and since it's the executive and legal divisions of the companies that decide what the companies "want," they probably are happier that way. And that is the real tragedy-- that and the fact that they can US legislation.
(To be fair, given the description of the attack, Intel is probably right that it still does prevent "casual copying." On the other hand, it angers me that they're trying to prevent casual (including fair use) copying, but don't mind that somebody willing to invest some money in hardware and a couple of weeks can start producing bootleg devices. Who's their real enemy here? Customers trying to exert fair use rights (and, yeah, maybe occasionally illegally copying content)? Or overseas customers producing and selling wholesale bootleg copies?)
-Rob
"It's not the size of the lock, it's the fact that it's locked."
b ing_norway_law_decl.html
1 26 _ny_lib_amicus.eps describes what the DMCA does to fair use.
One problem I have with this is that, generally, you won't be charged with breaking and entering if it's your own lock and your own property. That's what DMCA turns on its head.
That appears to be the reason the Norwegian kid was never charged in the original DeCSS hack. You can see a description of the state of Norwegian law at http://www.eff.org/IP/Video/DVDCCA_case/20000118_
You made a number of points that can be used effectively, but you never mentioned fair use. My own concern is that as a reader and a book owner, I will no longer be able to effectively purchase new books. There will be a license. I could well be reading on a pay per view basis.
http://www.eff.org/IP/DMCA/MPAA_DVD_cases/20010
Tom Hardy
er, so, do it anonymously, never tell a soul, attach it to the outlook-virus-of-the-week or IIS-worm-of-the-week and distribute it as a gift to the world's computers with notes on how it works.
Who are they going to sue? Widespread distribution and no one to sue but alas, since it magically appeared on my hard drive without my requesting it, I can apparently legally use it!
if he does that, he's still liable for prosecution. he's broken the encryption. he's proven that he's done it. he's manufactured a device for breaking the encryption. this device could be used to circumvent copy protection.
game over.
odds are, that a criminal prosecution against him would still fail. however, it could be launched, and he might find himself unable to leave the United States on his next visit, at least until the trial.
my old sig used to be funny, but then slashcode ate it and now it's not funny anymore
It just seems stupid to persecute people for demonstrating insecurities/flaws/idiocy in DMCA products. Why aren't they being offered jobs to strengthen the product, rather than persecution for proving bad implementations?
but we are freer here in the US than anywhere else, so we don't have to worry about your incredibly insightful tangential comment.
If I were this Dutch "hacker", I would have posted anonymously the technique to Slashdot, along with a digital signature that would have, at a later date, identified it as being mine if I wanted to reveal myself.
Information yearns to be free.
There's also a clause in there about allowing for research, but that didn't help Felton much, did it? The clause about non-infringing uses certainly isn't helping DeCSS. The only way that the licensors have to make sure that an implementation conforms to their restrictions is to license it. In fact, they probably have it arranged so the only way to know what all of the restrictions actually are is to get a license. Anything else would be branded a circumvention device, since non-exact compliance to a set of restrictions an unlicensed manufacturer wouldn't even know would be considered circumvention. I don't agree with any of that but that's certainly the pattern of logic-twisting that they've demonstrated in other areas.
Taiwan is not signed to either the Berne nor WIPO treaties. So copyright does not apply. No law is universal. And where it does not apply is where information will flow freely.
Very good stuff, indeed. With the permission of the author, a copy of this will be printed and sent to my local members of Congress. It explains very clearly the blatent problems of the DCMA without being too technical or philisophical. A good read for anybody.
Forget for the moment that the DMCA is "bad", it is a reality and Dmitri S. is in prison because of it.
So anyone who develops e method for breaking an encryption system has to think carefully about their motivations.
Telling the world you've cracked it and then defintively stating that you will not release the results seems to show that this guy wants the reputation and would like to work in the industry.
The most interesting alternative to the route he chose, publishing the results anonymously and as rapidly as possible, shows a different motivation.
Both motivations can be respectable.
AC
One more reason the right to post anonymously is a good thing.
Learning HOW to think is more important than learning WHAT to think.
There was a time when encryption was done to ensure it couldn't be broken. Now it seems like organziations are using the DMCA as a way to prop up bogus standrads that are dangerous due to their flaws (*cough*ebook*cough*)
Its hard enough trying to explain why Dimitry should be freed. But how can you convince a legislator or govt official that the DMCA is bad for encryption without risking prosecution? Its a scary catch 22.
Even though the Dimitry case is getting some press (Time Mag had a 2 page article - well written), I still only see proposals to slightly change the law. Not enough to allow full reverse engineering for research and the ability to expose flaws in products. Seriously - an encryption standard used to say encrypt some copyrighted work gets hacked, the victims sue showing why its such a bad encryption std and the lawyers for teh company using the bad encryption get it disqualified because its illegal to bypass encryption or copyright schemes.
Far fetched, maybe, but I really fear we will continue to see substandard encryption schemes passed off as workable because folks are less likely to publicize flaws in them if they are tied to teh DMCA.
Sure this may help open encryption standards, but we all know where the commerical money goes, so goes the world. Bad encryption standards used for IP materials and protected by the DMCA would soon be sold to businesses for privacy and such - exposing those businesses to serious exposure since the encryption std is probably less secure due to less folks trying to find flaws for fear of prosecution.
Maybe we need a contest - free tshirt to the person who manages to come up with the Chicken Little 'the sky is falling' explanation for why the DMCA is bad that'll get Joe six-pack up in arms :)
Top Most Bizarre/Disturbing Error Messages
HDCP is used to encrypt video.
The only stuff I stream is videos of music concerts and raves. So sue me if I think most other video is a total waste of time.
The future may be televised, but I'll be out making news, not watching it. Except for public access, that is.
--- Will in Seattle - What are you doing to fight the War?
Hi! How are you?
I send you this file in order to "steal" your HDCP crack.
See you later. Thanks
"And like that
Can you bring one link with evidence telling Sklyarov personally sold Elcomsoft products on the conference? Which titles? Anyone who saw anyone buying it?
... designed or produced for the purpose of circumvention a technological measure". Note here that almost any cryptoanalyst work is such "technology", and as such bringing it in the US and publicising is now illegal. Q.E.D. - DMCA outlaws cryptographics research.
Also, as you stated by yourself, Adobe and FBI could not know before the conference that Sklyarov is going or not going to sell anything, so obviously they were planning to arrest them for something other. The "other", as you generously quoted, is "imported and offered to the public" (via bringing in and reading his conference speach) "technology
-- Si hoc legere scis nimium eruditionis habes.
First of all, you'd probably need to change "people" to "certain people", like computer security experts and researchers. That this doesn't matter to majority of all people isn't quite as relevant as how big portion of Slashdot readers this potentially might affect. And that's significantly higher percentage than for normal population.
In some ways it may sound overblown, but think about it for a moment. Many chinese dissidents living outside China (in USA for example) are afraid to visit China for pretty similar reasons as researchers after Skylarov. Criticizing companies (by showing the problems with their systems) vs. critizing the ruling party/government (by showing the problem with their system).
Many people avoid going to Colombia or South Africa (not to mention countries that have full-blown civil war) because of the potential risks. Right now probability of being abducted by US govt (based on flaky DMCA-based claims) is still reasonably small, but the trend is what is alarming. It may become standard procedure in future for FBI to keep a list of 'known DMCA-violators'. I don't want to sound like another overly paranoid geek, but really, the road ahead looks bit too slippery...
I like paying taxes. With them I buy civilization -- Oliver Wendell Holmes
This means that reverse engineering in the form that Compaq used to create an IBM compatible BIOS is legal, while reverse engineering to create something like DeCSS is not legal.
What exactly do you think the difference is? I want to use IBM's BIOS in a non IBM machine; I want to play DVD's on by non Windows machine.
I don't believe that anybody would consider a straightforward attack against a known encryption technique for the purposes of key discovery to be "good faith" research.
What Felten did was a straightforward attack against a known encryption technique, but you said it was legal. Would you risk having a judge determine how straightforward your technique is?
What probably would have been the best way to handle this was to have anonymously written a detailed description of the encryption and then posted it to FreeNet, or any number of semi-anonymous bulletin boards, and not sign it. He couldn't take credit for it, but that's not what this is about, is it?
---- "A programmer is a person who solves a problem you didn't know you had in a way you don't understand."
Intel spokesperson Daven Oswalt says the company has received several reports from people claiming that they have broken HDCP. But he says none have held up, and the company remains confident in the strength of the system.
Oswalt went on to say, "If anyone DOES substantiate their claims, we'll sue the pants off 'em."
In other news, Intel will be holding a decryption contest. The winner will be presented with a fine of up to $150,000!
https://www.eff.org/https-everywhere
how can you blame gwb when this was passed during the clinton administration?
Off-topic? You're just pissy because you were conceived to that song.
"You mention prison conditions - the US has some of the worst of industrialized democracies..."
Yes, including officials who condone the rape and sexual assault of prisoners by prisoners.
I have found a truly remarkable crack of HDCP encryption, but unfortunately it is too large to fit in this post (margin of this post?)
Fascism starts when the efficiency of the government becomes more important than the rights of the people.
This is a very good essay. It does an excellent job of explaining the problem with the DMCA succinctly, and in a manner than anyone can understand. I'm going to keep this link and use it whenever I want to explain the problem with the DMCA to someone non-technical.
Free Hans!
But apparently, you can legislate human emotions. Fear comes to mind here.
Easy does it!
This comment has been submitted already, 276865 hours , 59 minutes ago. No need to try again.
If somebody had cracked CSS and made a non-licensed Linux DVD player available without providing source code or algorithms of the DeCSS part, it would have been legal under the reverse engineering clause of the DMCA.
If only they had time out of the courts to even start working on such a player, you know... In fact, as we see, one has pretty good chances to get jailed very fast after The Man knows about your research, not allowing you to produce evidence of "good faith". And, as you stated by yourself, nobody is going to believe a cryptoanalyst punk of yours that you can do this for something good.
On the other hand, one could work on such a software on the prison library computer. If one doesn't get Mitnick-like "not to come within a mile radius of any computer" judgement from his DMCA trial, of course. Then you probably could have you sentence cut or your fine to get lower, maybe?
-- Si hoc legere scis nimium eruditionis habes.
seriously? I think the whole "scene" will start reverting back to being 'underground' again for fear of reprisal. I am a majorly anti-'security through obscurity', but now it seems like only a select few will be able to secure their stuff now. it's sad that ingenuity is being hampered. This sort of stuff really makes me wonder why i didn't go into landscaping or something......
I lost my concept of community when my community lost all concept of me.
But your honour, I didnt decrypt it. I encrypted it again!
Buying a Dell computer is equivalent to dropping the soap in a prison shower.
However, fearing retribution/elimination from Big Oil/Energy Corporations and Governments With Vested Interests, he did not attempt to publish or patent his discovery, although it would be for the common good of humanity.
Instead, he incorporated obfuscated and watered-down versions of the technology into consumer products where they would result in some respectable but unobtrusive energy savings.
He then worked to ensure that, over the years, these products became commodity items throughout the world, knowing that, with time, they would be reverse-engineered by various people, and eventually improved on until the original mechanism emerged into common knowledge and the public domain, throughout the developed and developing countries.
Do researchers need to resort to such tactics of stealth and obfuscation in order to indirectly "publish" their results - hide bits and pieces of the solution in various unconnected publications, until someone is able to piece the fragments together ?!
The only things that he fears is to be arrested when he travels to the US, which he does frequently, as it said in the article.
Sentry23
and the land of the freeeee
play ball!
What makes this "fun" and very scary is, that this is propably exactly how the majority of people think.
I mean, if you start what is happening you'll loose credibility really fast. You'd sound just like a cheap copy of Fox Mulder. The tale you'd be telling would sound just *too* Orwellian too unbeliviable.
And you wonder why the mainstream press isn't (or hardly is) picking up on these stories?
It's legal for him to break it since the act did not take place in the US. But if he distributes it to anybody in the US, then it falls under the DMCA. Remember that Sklyarov was NOT arrested for creating the eBook cracker - he was arrested for selling it to the US and in the US.
You've hit the nail on the head for the other really bad thing about the DMCA. In order to participate, a hardware manufacturer has to license the technology, and can be held to make sure their device behaves exactly as specified through that license. If a third party implementation existed, there's nothing to stop it from allowing copying or region-free nonsense. So now instead of keeping other manufacturers in check with patent licensing, they can control them with the back up of a new type of "secret" intellectual property made possible bythe DMCA, like a trade secret only without the allowance for clean room reverse engineering.
If you want to get rid of the DMCA, just break it. Wire your CD-Player up to your tape deck and then go to your local police station saying you've broken SafeAudio. Or claim that it was you who was responsible for ebook, not demitry. If everyone gets together wearing decss or 'how to crack rot-13' t-shirts you can demand that the fbi arrests you and gives you the minimum 5 years.
-tfga
This comment does not represent the views or opinions of the user.
To my knowledge, Dmitry was the only Elcomsoft employee there. Do you have a source indicating otherwise?
If the charge was distribution (trafficking), then that's what he was arrested for, right? The official complaint filed in court when he was arraigned specifically excluded the "manufacture" wording referring to the act of writing it. Even the EFF will tell you that he wasn't arrested for writing it.
I believe they can get away with baseless threats unless you can show that some damages resulted from them.
I was only trying to point out that just because the RIAA threatened to sue him doesn't mean that he did anything remotely wrong under the DMCA.
Agreed. Of course, this problem is a lot bigger than just the DMCA. Until there is some reform of the tort system, these strong arm tactics will continue regardless of laws like the DMCA.
It depends on whether you are being sued (a civil action) or being prosecuted (a criminal action). If the latter, the burden of proof falls on the prosecution.
Unfortunately, this is true. It's already happening. For instance, Macrovision free DVD players (which should be legal under the DMCA) were pulled off the market this year. I'm afraid this will continue until the bounds of the DMCA have been thoroughly tested in court.
All I'm saying is that a lot of people's impressions of the DMCA have been shaped by FUD. The actual wording of the law is not nearly as bad as the average slashdotter makes it out to be. The people who wrote it tried to protect legitimate activities like reverse engineering, research, journalism, and fair use copying while putting some teeth into efforts to prevent piracy. They were trying to achieve a reasonable balance, but of course the movie, music, and software industries are jockeying around trying to influence early precedents as much in their favor as possible.
Replace "Dutch" with "Russian," and the same could be said for Sklyarov. But he's in jail just the same.
- Non-conforming countries & territories: Sealand, China, Iraq, North Korea, Denmark. This is possibly the path of least resistance, at least initially.
- Gateways to PPTP or 802.X linked networks. This would be OK for a while, until the ISPs start blocking these "hacker" protocols.
- New, "stealthy" replacements for PPTP, perhaps something that builds upon the P2P protocols -- this would be difficult to trace or firewall.
- The Freenet project (http://www.freenetproject.org) The fact that people are working on a project like this means the "underground internet" concept is closer than you think.
- I think it's only a matter of time before one of the biggie ISPs decides to resurrect the "on-line service model", similar to pre-Internet CompuServe or Prodigy. They would create an "alternate internet universe", absent any rules whatsoever, loaded with disclaimers. Anonymity & encryption by design, using proprietary protocols that essentially shield the ISP from knowing whery anything is going -- therefore no real responsibility. "Have your modem dial this number, and whatever happens is your problem." Even before the Internet, online service providers have continuously searched for services where the customers would pay non-commodity prices for something that was "added value". If privacy is going to be in short supply, then we will surely have people trying to sell privacy as a product!
IMHO: The limitation of law is that it depends on voluntary compliance from the majority. A law that is widely disregarded is not useful, and probably unenforceable. Hardly anyone disagrees with the fundamental concept of privacy, so I think laws that limit privacy will be met with technical countermeasures, not voluntary compliance.You're 100% correct! Go back to the Jack Valenti deposition transcripts. Did he know of a single verifiable instance where DeCSS was used to 'break' the copy protection on a DVD? Nope. Did Adobe ever present a single instance where protected ebook content was compromised and redistributed? Nope (the copies they themselves purchased don't count since it could not be proven that they didn't simply manufacture that evidence, much like Microsoft's video presentation in court). Yet on the other side of the coin, there are at a minimum three well documented instances where the DMCA has DIRECTLY been used to violate either someone's First Amendment or (maybe)Berne Convention rights (Felten, Sklyarov, and now Ferguson). AARRGGH! This is infuriating!
If Ferguson says that he has broken a protocol you can be sure he has done so. The expected outcome of the DMCA case is for the censorship provisions of the act to be struck down. So Ferguson has to expect to be able to publish soon.
The DMCA does have some interesting side effects however. Nobody can ever be sure the DRM technology they buy works, the lack of peer review and discussion means that there is a level playing field between the many peddlers of snake oil and the legit players.
Another effect is that anybody can mount a reputation attack against any scheme.
Bet you wish you thought of this nym first
The sad thing is that all of the DMCA publicity recently actually got me to bring up my "circumvention device" (aka "rot13") to try to "decrypt" your post.
That's really scaring me...
--MonMotha
He was arrested for selling it to customers in the US over the internet and for selling in person while in the US at the conference.
That's bull. Sklyarov didn't sell anything. Elcomsoft (which Sklyarov neither owns nor manages) sells the program. Sklyarov was arrested because his copyright was on the program (i.e., for writing the program). Also, this is the first time I hear Sklyarov sold anything on the DEFCON. Did he go and sell diskettes? Or did he have Visa card device in his pockets? How exactly did he sell this program?
Also, how do you imagine some company in Russia be liable for what their clients did - importing the DMCA-prohibited wares into the USA? Elcomsoft itself is in Russia, and whatever it sells in Russia to US citizen is under Russian law, not under US law.
Also, if Some Big US Company has problem with Some Another Big US Company does, do we see employees of either company arrested by the FBI agents and rotting behind the bars? No, we see their lawyers talking. Somehow, the civilized way of settling (i.e., bringing the suit against Elcomsoft, winning it and prohibiting Elcomsoft to sell the wares) was seen unfit by Adobe and US State. They chose just to jail the first person they could lay their hands on. Very, very stupid. And very, very disgusting.
The fact that the RIAA threatened a lawsuit against Felten doesn't mean he did anything wrong.
If I threaten to kill somebody, is it wrong? Even if I do not actually do it? A lawsuit from RIAA would basically kill Felten as a researcher and maybe would also kill him economically, depending on how much money can he shell out to protect himself from frivolous lawsuits of RIAA. And you definitely know that, that being engaged in the lawsuit is a gross problem even if you win. So why you pretend like it's nothing?
I don't believe that anybody would consider a straightforward attack against a known encryption technique for the purposes of key discovery to be "good faith" research.
So what is "good faith"? Writing positive reviews in Byte? One doesn't need cryptoanalysts for this, trained monkey is enough. Cryptoanalysts work is to break the codes. Claiming otherwise would be like holding QA people liable for "breaking" the code when they find bugs. I guess if programmers were on the same dumbness and greed and power level as the RIAA, finding bugs in products or telling anyone about how some program crashed for you would be as illegal as telling someone how some encryption algorithm sucks is now.
To my knowledge, Dmitry was the only Elcomsoft employee there.
Oh. "We cannot arrest the right person, so we better arrest the innocent - at least thus we get something to report to big boys up there".
-- Si hoc legere scis nimium eruditionis habes.
Apparently a number of people have already figured out how to do this and have published the details.
See my other post that has some links to the details...
(#192)
I've uncovered the secret ingredients in the Colonel's spices and McDonald's Special Sauce. I figured out where Amelia Earhart has been all these years. I know whether or not the moon landings were faked, who shot Kennedy, and how many stones there are in the Washington Monument.
I have decrypted the secret code in the Bible, correlated it with the secret codes of the Baghavad Ghita, Talmud and Qur'an and now now the inner thoughts of all gods. I have unified field theory and quantum theory and will soon have a device that will bend all matter to my will.
I know the secrets of teleportation, telekinesis, telepathy, and how to get women to want me. I know the secrets of every three-letter agency in government, the Psychic Friends network, and the US Postal Service.
Unfortunately, due to the nature of the DMCA, I am unable to share my findings with others. I suppose I'll have to get on my FTL spaceship and find a more genial planet. Ta-ta!
A guy named Keith Irwin published a high level process for attacking HDCP a few weeks back and it sounds much the same (i.e. number of required devices, etc.)
a cks.html t ml
See the links below for his whitepaper as well as a previous discussion regarding this on a popular HDTV forum...
http://www.angelfire.com/realm/keithirwin/HDCPAtt
http://www.avsforum.com/ubb/Forum11/HTML/015261.h
>I don't see the problem
When it's YOU the FBI may be targeting, come back and tell us if you still think it's not a problem.
-S
--- What parts of "shall make no law", "shall not be infringed", and "shall not be violated" don't you understand?
I don't think so. The matter at hand is "reasonable doubt" and I think it would be easy to produce reasonable doubt that Ferguson was the source of the master keys, especially if the protection is trivial.
We here in the US have a stupid law that says if I flip the bits in my content then it is "encrypted" and it is illegal for you to distribute a decryption device (a bit flipper).
However, if I find a "decrypted" copy of my content floating around the internet, all you have to do is say "look, it's just bit flipping, anyone with a basic knowledge of math could have decrypted it" and then at that point it is up to me to find something that conclusively pins it to you...like a copy of "BiTFLiPPER 1.2 by rkn0p" floating around.
- JoeShmoe
-- I wonder which will go down in history as the bigger failure: the War on Drugs or the War on Filesharing
Because we're the United States, the 800lb gorilla of the world. We can do whatever we want and the rest of the world can't do a thing about it. I mean, we could invade pretty much any country we wanted to and who's going to stop us? Canada? Hahaha! Canada can't even keep its own country together. Russia? Please, they're like our drunken brother-in-law. We just put up with them to keep their filthy drunken fingers off the button. China? Go make me some fried rice!
C - A language that combines the speed of assembly with the ease of use of assembly.
It will be interesting to see if once it does get out, if companies will seek to hold him responsible, even if e doesn't release it himself. I winder if the DMCA covers the eventuality of having done research which facilitates bypassing encryption. It really isn't that far to go from doing research (and finding the solution) to writing the software that actually performs the operation. Will it become a crime to do research?
--CTH
--Got Lists? | Top 95 Star Wars Line
sigh... things like this should be allowed to be published... people will always find bugs in software, crack encryption algorithms, and exploits in security of nearly everything. when documented properly, published, the developers are identified of the problem after which they can make the necessary ammendments. also, properly documented bug reports notify users and system admins of the problems, outlining the need to upgrade or patch as instructed by the software vendor (taken as an example). no doubt sooner or later another tech savvy 'user' will accomplish the same as the first. a bug may become relatively well known, and allow exploits by malicious 'users', while it has not been called to the software vendor's attention. occasionally, the 'user' who discovers a bug, workaround, or cracks an encryption algorithm, may not be of the right ethical nature to bring it forward, contact the relevant parties to have it resolved, or make it public domain--and instead may be of a malicious nature, as per Code Red. no doubt it was a new undocumented exploit--had some user found it 2 months ago and documented it properly, well, this could have been prevented, somewhat. had some user found it 2 months ago and left it silent, well, just look at what has happened.
I'd say it DID help him. Was Felten ever charged with violating the DMCA? No. Did the RIAA ever carry through with their threat to sue? No.
Think about the situation. The only non-infringing use they offered was to provide DVD playback on operating systems where no player was offered. Unfortunately, there was a licensed player available for Linux, and at the time there were no players available using DeCSS. Meanwhile, lots of people were using DeCSS to rip DVDs to DiVX/MPEG-4 format for trading over the net. So it was pretty safe to say that (at the time) the only people using DeCSS were using it for infringing purposes.
I can't argue with conspiracy theories. All I can tell you is that the writers of the DMCA explicitly intended to allow circumvention as part of the standard reverse engineering methods used to design devices & programs that are compatible with a competitor's proprietary interface.
It ought to be fairly obvious whether the result of this reverse engineering is legal or not. If it provides a way for people to access a protected work without having been granted the right to do so by the copyright holder - it's illegal. If it's merely used to make one product compatible with another without providing any additional mechanism for unauthorized access - it's legal.
Yeah he finished the proof in '93 or '94 can't remember offhand. Andrew Wiles was his name I think. For a good book about Fermat's Last Theorem, try Fermat's Enigma, by Simon Singh.
----
Striving to put right what once went wrong, and hoping each time that his next leap, will be the leap ho
Got threatened for != illegal
The DMCA is part of the criminal code, yet nobody in law enforcement threatened Felten. Want to know why? Because what he did was not illegal. The fact that somebody threatened him with a lawsuit doesn't mean anything.
on top of that, yankee law should not apply to dutchmen
You are absolutely wrong. The DMCA does permit circumvention for the purpose of clean room reverse engineering. Just read the text, it's there plain as day. As long as the reverse engineering is for the purpose of making a compatible product and not for making a device that permits unauthorized access, it is totally legal.
Yeah, who cares if you can be thrown in jail for talking about doing your job? That's not important. Jeez.
Hint: Its called "reading the article before posting".
What for? Nobody else does unless there's cool pictures or video.
Actually he can do whatever he wants in Holland without fearing the DMCA, but he can *not* even talk about it in the USA. Sklyarov isn't charged with breaking the encryption while in Russia, but standing on US soil telling people what he had discovered. Unless his work to break the encryption has partly been done in the USA, I don't see the problem.
Kjella
Live today, because you never know what tomorrow brings
That's the great about assymetric key encryption.
That's great, though.
... these companies are all fucked.
:D
X months from now when this scheme is in wide use, and all of a sudden come hundreds of anonymous Usenet or maillist postings screaming "Hey, the master key ix XYZZY"
And then Niels will be able to say "Well, see? If it weren't for your stupid DMCA, I would have told y'all this BEFORE you released it."
I'm getting that feeling in my stomach. I've got plenty of processing power at home...anyone have those screens?
Just because a few of us can read write and do a little math, doesn't mean we deserve to conquer the universe
It shows how little faith the copyright community has in the ability of commercial software developers to create hacker-proof encryption standards. Surely, the bright people at NSA & CIA have all kinds of encryption that [I hope] works. By comparison, the developers of Adobe e-books and CSS must be some really dim bulbs.
I know the NSA/CIA guys are spending lots of time & money on testing the security of their algorithms. I wonder just how much effort the copyright gods put into testing CSS or e-books before the hackers defeated the encryption.
As we have seen with Sklyarov and countless others, the people who do encryption research are not deterred by US law. They might be annoyed and inconvenienced, but nothing more. The real threat comes from quiet people who are not going to tell anyone about what they do. If you depend on encryption, you have to assume that people are going to attack it on a 24/7 basis. Making it technically difficult is not the best defense, it is the ONLY defense!
Entrapment only applies to law enforcement personel. Last I checked, we're not messed up enough in the US to the point where private companies have legal jurisdiction (with the exception of a few areas like San Fransisco, where law enforcement is contracted out by the city to security companies). But who knows what the future holds? It's a well established legal principle in the US that politicians can be bought.
science is a religion
How would he then tell people how to look up the information on Freenet? If he already has an anonymous communication channel with which to distribute a Freenet key, then he could use that directly to distribute the information. If no such channel is available, then posting the key in a traceable manner will still expose him.
Someone could just try guessing random related names, of course, but I (or Intel) could just as easily guess what people would try and preemptively put information under those names as well...
Yes, it was broken 4 *days* after being released. See: http://cryptome.org/hdcp-weakness.htm
With the origional spec leaked at: http://cryptome.org/hdcp-v1.htm
The attack has been rediscovered many times since. If anyone is aware of a earlier publicly available paper on the flaws, please give a reference.
So, I'd say that Niels Ferguson and Keith Irwin rediscovered that attack.
It's spooky to read a document while someone is editing it. I loaded a copy of Nils's position paper. Got halfway down and found an unterminated URL. Rather than reporting it to Nils, I reloaded the document. Yup. Between the time I started reading it, and the time I got halfway through it, he'd already fixed the problem. Imagine reading a book and seeing a typo but by the time you re-read the sentence to get the real meaning, the author had found and fixed it.
-russ
Don't piss off The Angry Economist
Lots of us said that for the SDMI contest we should say "yeah, I can crack that" but not release any details (even if we really could crack it). Let them sweat it out.
Now the industry is starting to get this treatment because of its own heavy-handedness. If some FUDster claims he can crack $ANTIPIRACYTECHNOLOGY but won't prove it, no one will will be able to call his bluff effectively.
Meanwhile, full-quality bootlegs continue to pour out of Taiwan. Society has nothing but reduced rights and privileges to show for all this.
Sheesh, evil *and* a jerk. -- Jade
So you think he'll not get arrested for just breaking it without releasing it? We'll see...
Someone ELSE could emerge, under a pseudonym, and demostrate that he too has cracked the scheme. Then he could encode the something with the master key for everyone else to verify that this claim is true. Next he will use the master key to encode something symmetrically. Ferguson could decrypt this message and show it to all using the same master key and show that he too has the same damn key.
We thus have public proof that the scheme has been cracked. Ferguson could argue that he has made no device for decryptioni, has not published his results, so how is he liable in any way under the DMCA? All he did was to verify that that anonymous cracker was is not bullshitting. He can continue his great campaign. Meanwhile the anonymous guy can go into hiding and nobvody would be the wiser for it.
The DMCA just make the whole situation a good deal more complicated than it needs to be. IT IS BAD LAW.
You people are overlooking the upside of all this.
Now we can FUD any copy restriction technology top death by claiming that we broke it, and refusing to give any details due to the threat of prosecution under DMCA!
The question is, would this be effective enough to get the media companies to stop using it?
As he said, he travels to the U.S. a lot.
Thanks to DMCA and rabid lawyers, we're creating an "underground internet" that generally ignores the law.
This may not be completely true now, but I can see it coming. Look how easily the loose network of home based BBS systems sprouted up in the 80's. At its hieght I think there were 30,000 BBS operating in the US alone. Today of course a network of single line, modem based BBS's sounds silly, but what about the wireless networks people are setting up in some of the larger cities and giving free access to anyone passing by. Is it possible using 802.* to relay from network to network ? If it is possible I can see an underground internet developing, free from government control and commercial exploitation.
"Our products just aren't engineered for security,"
-Brian Valentine,VP in charge of MS Windows Development
And BTW - biggest US client of ElcomSoft is FBI. Did not you know that? Or, it does not fit into your PR compain.. Well, sucks to your logic then..
<^>_<(ô ô)>_<^>
Yes, but most of the time the courts don't rule against the person who wrote the manual on how to pick the lock, created the skeleton key, or sold the lockpicks to the crook.
It's the act of breaking the lock, not information, tools or ability that allow one to bypass the lock, that should be, and already was illegal.
The argument addresses the use of the term "effective" in the language of the DMCA. You might consider reading it sometime, fuckfist.
Or as Bill Hicks said, "Every word that comes out of your mouth is like a turd falling into my drink."
Don't you have a band waiting for you to screw them on their record contract?
A mathmatician announces a lecture about the solving of some age old problem (I forget the exact theorm). He gets a large crowd for the lecture. But he discusses something completely different. Afterwards, a friend asks him why he didn't talk about solving the problem like he said he did. "Did you find something wrong in your proof?" was one question that was asked. The scientist answers, "That's my backup in case I die during my tripto the lecture. This way I'll go down in history as solving the problem and taking it to my grave."
a lame joke yes, but applicable to this Dutch scientist
The One Rule Of Chess You'll Ever Need: Don't play someone who carries a kit in their bookbag.
Can you say "chilling effect", boys and girls? I knew you could...
Deven
"Simple things should be simple, and complex things should be possible." - Alan Kay
It was a lame excuse to stretch the limits of juristiction then, and they'll come up with an even lamer excuse for this. They would do everything they can to harras this guy, even if the can't make anything stick, including have Jack Valenti call him a child molestor or some other far more vile name for copyright infringer like they did with "pirate".
I don't think I've seen it mentioned here, but
It seems that the FBI and other crime fighting organizations are opposed to encription as a rule (as long as they can use it). They encourage the use of weak encryption by members of the public (which they can crack in a reasonable time.
What if.. What if.. The legislators put up the DMCA to make people feel they can use dodgy encryption and nobody could break them.
Is the FBI covered by DMCA??
--
I write this from the saftey of australia.. I'll throw a few Koala BEARS at them if they come and get me
The DMCA is crystal clear about this. What you just described is 100% LEGAL under the DMCA as long as the specs, algorithms, and source code are not made publicly available. The reverse engineering clause was designed specifically to permit this sort of thing. And as long as the reverse engineering is done "clean room" style, it can even take place within the US without worrying about trade secret protection.
But as you mentioned, the device could not provide access to the raw unencrypted data stream. But in addition to that, publishing the specs, source code, or other information that would help other people circumvent the encryption would also be illegal.
It appears to me that if somebody produced a closed source, binary only DVD player for Linux that doesn't use an official CSS key, there would be no DMCA violation. But that wouldn't make DeCSS legal.
It is NOT illegal to but the Stars and Stripes in the US!
Learn the difference between a "law" and an "organization".
Scott A. Crosby wrote this short paper over on cryptome.org, which seems to cover an attack that is very much like the one in the post. Especially the number of devices required in the post (50) matches the number of keysets required by the attack described on cryptome.org (40-50). Coincidence?
Finally! A year of moderation! Ready for 2019?
Or reading a document that's being cencored as you read it. Ack! The Sky is Falling!!
Burn the land and boil the sea, you can't take the sky from me
Wasn't that cracked by some british mathematician a few years back?
"Oooh, what does this button do?" - DeeDee
In his address at HAL, Ferguson reviewed a well-known published attack on a reduced-round version of the Rijndael algorithm, which was discovered before Rijndael became the final AES. The cryptographer also presented an algebraic formula that describes the structure of Rijndael. If the formula is solved, Ferguson believes that the Rijndael block cipher could be broken.
This right here was kinda stuck in the middle of the article in an odd place, but seems worthy of more depth. Anyone in the know care to comment?
I don't know about you, but if it's my ass going to prison, I'm going to err on the side of caution. Sure, they might not go after you as long as you don't disseminate information in the US, but because of the fact Elcomsoft used a US server as part of the buying process, even though at no point did that server house any code, that was deemed sufficient to invoke jurisdiction.
The truth about Scientology, Xenu, and you: Operation Clambake
But the solution is too big to fit in the margins of /.
The age of consent in the Netherlands is 12. It is not uncommon to see singles ads by men looking for women with 12 year old children.
What does that say about this guy now?
Guys! This is GREAT news.
When the DCMA eventually is challenged in court, the good guys will need all the ammo they can get.
If you say the DCMA squelches free speech, you're going to need examples, proof, like this situation. I hope many more researchers announce that they fear to publish because of the DCMA.
Democrats or Republicans. They are both taking us to the same place and they are not afraid of us anymore.
Who modded this up?
The link is about RFC 2131 (DHCP),
while this article is about HDCP.
This is so much fun. Thanx to the DMCA you can FUD any encryption scheme by just saying that you've broken it but doesn't dare to reveal the details. Now nobody will trust HDCP, and they have no way of defending it. It's a fun way of getting back at "the man".
Another thing: Once some other expert claims that he also has cracked HDCP, but of course can't divulge the details, Ferguson or the other guy can leak the information to the net, and "they" will have no way of knowing which of the guys who leaked it.
I have been thinking this exact thought each time some new 'copy(right)-protection' scheme is announced. Joe User will be annoyed and frustrated, but Joe Pirate will always have resources to crack/circumwent the protection. This is what happens when you let laywers run amok.
J.
He saw what happened to DeCSS. What he needs to do is create a whole product/application that has real legal uses (along with possibly some infrenging uses). Then release that. The legal uses should make the application valid under DMCA, while the information can "leak" through code or specifications.
Not to say the powers that bee won't try to stop it anyway, but a valid application goes a long way towards sidesteping the DMCA.
Imagine if Livid had been released before DeCSS. Same code, real usefull application. It can't be labeled a pirate tool, but it still releases the information.
There is nothing so silly as other peoples traditions, and nothing so sacred as our own.
Politics aside:
A description of a fatal weakness in HDCP's was published by Scott A. Crosby a few days after the specs was published, and was independently discovered by many others. Crosby's attack appears to have the capabilities claimed by Ferguson and has negligible computational cost (inversion of a 40x40 matrix). It requires the built-in keys of any 40 HDCP devices, but this is presumably easy to achieve in the presence of software-based HDCP implementations).
Thus the new feature of Ferguson's attack is probably a way to extract the keys without actually hacking any device, but rather by talking to intact devices via the normal protocol. While this is interesting, HDCP should already be considered broken in light of known attacks.
HDCP is used to encrypt video.
Keith
Question - how much noise and pain until we feel the shift away from this awful law? Each time I read articles like the above I just feel worse about our country (USA). Sure I give my money to the EFF, but it takes SO DAMN long to fix something that was wrong to begin with!
Grumpy and mad
Evan - needs to hit preview before submitting
Consider this Tivo story.
Hacker A cracks the code, tells the world he won't release it, 6 months later Hacker B releases it. I see history repeating.
On the other hand, someone could make a device that included everything you needed except the key. By itself, it would not be a circumvention device, but if the user input the master key -- boom! Free access to everything. All the manufacturer would have to do is include a disclaimer that said, "You must have an authorized copy of the master key to use it with our device. We do not support unauthorized use of the master key." Of course, the device would probably also need to serve some useful function without the key. Kind of like DVD players that the manufacturer purposely makes easily-moddable to be region free. That might actually work. All that's needed is for someone to leak the master key, which is bound to happen sooner or later (as Ferguson points out).
Free Hans!
Obviously Freenet was designed for just this sort of thing. But because it's an issue of scientific research (cryptanalysis), Publius was also created expressly for this purpose. However, I get the impression that Publius intended to be protecting the speech of foreign citizens from their oppressive governments, not from our own. If he did publish his results anonymously to Freenet, say, 6 months to a year from now, it would be a good test for the anonymous nature of Freenet. If I were him I would not use Freenet until it has been tested by some other high profile case. Instead I would just go to some internet cafe and anonymously post (through multiple anonymizing proxies) the solution by hand typing it. No one could prove anything. It would be traced back to the internet cafe after getting multiple Anonymizing services to cough up their IP logs (assuming he uses ones that keep them at all). I wonder if the internet cafe (Starbucks perhaps?) could be sued for allowing anonymous internet use. Eventually I think true anonymous internet use will come down to only those few countries that continue to allow internet cafes without requiring that detailed logs be kept of every user's picture ID.
it is my opinion that the real problem here is consumer protection. until the music industry can redefine the value of music, an encryption scheme is needed to protect the livelyhood of media creators. the problem that the DMCA creates in it's present form is that an potential investor in a new encryption technology (ie a record label interested using HDCP to protect it's work) cannot hire a professional to deeply evaluate emerging schemes. if an independat expert performs a "Consumer Reports" style analisys of new software and discovers major flaws, he is in violation !! i realize i am preaching to the converted here, but i am truly alarmed that this point of view is not frequently expressed.
I refer you to US Code Title 17 section 1201, AKA the Digital Millennium Copyright Act:
Note the word manufacture. If he cracked the encryption, as opposed to just figuring out that it was possible, it's a crime under the DMCA even if he didn't distribute anything.Indeed. I'll bet those Germans who invented Enigma are kicking themselves (posthumously, natch) that they didn't legislate against the Allies cracking it : )
...for outlawing peer review in cryptography, and allowing all sorts of consumer electronics to be built with pathetically weak encryption. So long as this pattern stands, our fair use rights can still be exercised (albeit without that "rights" aspect).
Imho his goal is not getting his paper published, but getting people to think about the consequences of these laws. Unfortunately, this the only way we foreigners can protect our rights abroad.
Linked to this, in Europe a 'law' is being prepared (due Sept 3rd I believe) which forces a country to assist another country to eavesdrop (snif Internet traffic) on a user if he (she) did an illegal act in that OTHER country. To link this with a previous link (thanks for the thought), if China were to be part of such agreement, every couple with 2 or more kids could forget its privacy...
Joost
--Black holes are where God divided by zero--
I too have broken Intel Corp.'s HDCP ... and like Niels Ferguson, I must remain silent.
-- www.globaltics.net
Political discussion for a new world
This is a Good Thing(tm)! If the details aren't released, then it's just rumor, speculation and slander against the HDCP standard!
That means the HDCP consortium can continue on their merry way to rolling out their video solution...and then after we have all this great content available...THEN we can have someone release the information (I see Lawrence Lessig waving his hand there in the back).
Think about it. If the Crack SDMI has come back with nothing but failure...then maybe we would all have GB of juicy full-quality (minus watermarks, ahem) songs sitting on our harddrive awaiting a simple watermark snipper.
Thank you DMCA! Chilling research only delays the inevitable! It doesn't stop it!
- JoeShmoe
-- I wonder which will go down in history as the bigger failure: the War on Drugs or the War on Filesharing
It remains possible that they will send out ninja's to kill him, but its bloody unlikely.
What is it with people today, they all act like a fearful bunch of wussies. With folks like that we don't need any DMCA enforcement.
Yes, but if he ever gives a presentation in the United States, he could suffer the fate of Dimitri.
Jesus Christ. Aren't there more important crimes that deserve to be prosecuted?
"BSD is about people pissing each other.." (Moid Vallat)
I was packing up after his talk when he mentioned he had cracked something so I missed what he had cracked...
-------
Warning: Slashdot may contain traces of nuts.
Step 1) Violate the DMCA in some way to hurt the DMCA abusers
Step 2) Publish the violation in a manner such that retrieval of the information would require violation of the DMCA
AFAIK (IANAL), this appears to be a case of "in pari delicto" (see http://www.fifthdistrictcourt.com/dictionary/dict- p.htm) which basically says if both parties are committing a crime (i.e. we're both violating the DMCA), the judge may decide not to grant a remedy to either of us.
The catch is that this sort of behaviour runs squarely up against the "Unclean Hands Doctrine". In a nutshell, Unclean Hands protects the courst from assisting you in the commission of a crime. In other words, you cannot turn to the court and say "Well, I'm violating the DMCA, but if you'll agree that they're violating it to discover my violation then we can throw out their results".
BUT this then puts the onus on you to prove that Intel actually violated the DMCA, whereas there is a whole raft of ways that they can prove that you did. Intel can claim a third party provided them the document which means that they did not break the DMCA and thus you are screwed royally. As a civil suit, the evidence is admissible, even though the methods used to obtain the evidence may be in a legal grey area. Of course, you could go after the third party but at this point, you're over a barrel big time.
Of course, this takes lawyers (of which I am not one) and thus if you're even going to get into a situation where you attempt to raise this defense, you'd better have some deep pockets to hire lawyers go up against Intel. Even if you win, you're broke (a phyrric victory if I ever heard one).
Any real lawyers have a comment on this?
-- "I am disrespectful to dirt. Can you not see that I am serious!"
Say I blow a lot of coin and build the DES cracker explained in the EFF's little book. Am I not liable for circumventing the copyright regardless of the fact that I did not design the machine? Even more importantly, the necessary mechanism to prosecute him is already available... See post #21 on the same topic, titled "ferguson's mistake". I have a nasty feeling that he is more then likely screwed once the code is publicly cracked regardless of his statements here...
point: I would never release a "demonstration" either. It is too risky. how sad.
-----rhad
Slashdot needs to interview Natalie Portman.
How to do this is already public knowledge and it's being implemented on a wide scale. Even Windows can do it (though no one knows when it will be able to do it correctlye. Look here.
HDCP is not a public-key cryptosystem. Read the specs. Had the scheme been secure, you would not have been able to verify his knowledge of the master key unless YOU have access to an HDCP device.
Anyway, to run his attack he needs 50 different HDCP devices (to get sufficient data for analysis). He probably doesn't have these, so why do you expect him to have the master key?
Look up my other post to this article for hints about the structure of the attack.
If the prosecution could prove that Ferguson was directly involved in the "illegal" attack, thats true. Otherwise, he would probably be protected by the DMCA protections for people performing "encryption research". Even if their success does encourage similar "illegal" attacks, the researcher is (presumably) protected. There are several requirements for the research protection, one being that the researcher notifies the company, another being that they act in good faith. It's reasonable to say that Ferguson has done these things at this point.
PS Here's a pointer to the DMCA text (although a search on Findlaw will probably get you there as well. For those who haven't read it, it's quite a trip. Remember that this document might well be copyrighted as well!)
You can stand whereever you want, dumb anonymous, but if you find me where the heck it states that he sold program in person on the conference, as you, obviously a paid-for industry insider, stated - I will send you $5. It does state that they were able to buy it through a third aprty website from his employer. So, please, shut the fuck up - you did not do your homework.
<^>_<(ô ô)>_<^>
Arrogance and Pride is most probably the one thing that currently prevents the Open Source movement from ravaging corporate bullies like wild fire. Someday you people will have to accept the fact that innovation ISN'T AND NEVER WAS ABOUT CREDITS!
Ignorance and arrogance are the core of human hatred...
Porn is illegal in Saudia Arabia and most other Islamic nations. Yet we continue to be a "porn haven" and not blocking web traffic from these IPs.
The propagation of Nazi philosophy and artifacts is illegal in France, Austria, Germany, Italy, etc. Yet the US continues to make such materials available to these nations.
If the USA doesn't give a shit about other nations laws, why should they be expected to comply with ours?
I got that from several places:
1. It was in some of the early newspaper stories.
2. First hand reports from attendees at Def Con posted to the free Sklyarov mailing list said he did it.
3. It was on the EFF pages for a while.
4. About a hundred other posts on the various Slashdot articles said the same thing.
There is a simple reason why it doesn't appear in the DOJ filing and/or FBI agent's affait. The charges were filed on 7 July - BEFORE the conference even took place. That doesn't mean that the DOJ hasn't gathered evidence of it, and it doesn't mean that it isn't going to come up in his trial.
You would probably look a lot more intelligent and less juvenile if you actually started reading some primary sources instead of just screaming "liar" at anybody who posts something you aren't aware of. May I suggest you start by reading the text of the DMCA itself and then read the US vs. Sklyarov FAQ.
Also, unless you want to grow up like Noam Chomsky, you can't simply dismiss anybody who disagrees with you as being bought and paid for by industry.
If companies would invest one fourth of their legal budget in developing stronger encryption, we wouldn't need such strong laws to protect them.
As it is, companies are being taught that 'pretty strong encryption' and 'pretty strong laws' combine for a secure solution based on a mix of technical difficulty and fear of persecution. Maybe they should take a look at the AES and realize there are better, more community-oriented ways of creating secure solutions instead of creating half-assed systems and persecuting those who prove just how half-assed they are.
Also, isn't it interesting that when it's their encryption it's 'anti-piracy' and when it's your encryption it's 'privacy'?
Kevin Fox
Dumb Mega-Corporation Accomplishment?
For the 101th time: lie and bullshit. Read offical DOJ complaint.
Stupid anonymous moron.
<^>_<(ô ô)>_<^>
Coud something like SirCam or another virus/worm be used as a distribuition method for information like this? How practically?
Just wind it up and let it go..
Feel the fear and do it anyway.
The problem is that the crooks, in this case, are the general public. There are just too many of them to effectively prosecute. The corporations are mad, and the corporations own the politicians; they want someone to pay, so they go after the only people they can really effectively prosecute.
Just find a clever way for a politician or huge corporation to be found liable under the DMCA.
Or better yet, find a federal judge who is violating the DMCA in some way. Any miniscule technical violation of the DMCA will do.
The DMCA is fucking twisted and evil, there are enough contradictions and loopholes in the DMCA that something has to be applicable to someone high up.
We need to use DMCA as a weapon against those individuals who brought this abomination into existence.
You can bet the femtosecond a politician, corporate thug, or judge is indicted under the DMCA, the DMCA will be overturned.
Boy, am I GLAD he didn't release it. Think of the harm that he could have done to the movie industry. The DMCA DOES work people, see? Now, because of the DMCA, he won't release the specs on breaking the encryption and therefore nobody will be able to produce a product that uses this encryption standard, and the movie industry will be saved.
Of course, this won't stop people from pirating the movies. This will go on as normal, as people who are outright willing to break the law will do so anyways, and if he was able to break the encryption, so will others. But the good news is, it will be ILLEGAL according to the DMCA, so these pirates are officially BAD PEOPLE and therefore will have no effect on the Movie Industry, because they don't count. Only people who can compete count, because they actually have the opportunity of creating products legally without paying licensing fees. The world is a better place with the DMCA indeed.
-Restil
(This is sarcasm. moderate appropriately)
Play with my webcams and lights here
The Complete Document can be found here:
http://www.macfergus.com/niels/dmca/index.html
Very good stuff. Too bad they didn't link it in the story.
I didn't think that anybody in another country could be prosecuted under the DMCA unless the came to America and tried to publish the information. Wasn't that the whole issue with Dmitri? Or are they referring to this guy's nationality and he already lives in America?
"You can be sure that somehow, somewhere, someone will duplicate my results especially because I am telling them that I have results," says Ferguson. "Someone who is braver, who has less money, and who doesn't travel to the U.S."
This, right here, is his mistake. If, in the near future, those master keys are published, I bet a nickel that Ferguson gets hauled up for a lawsuit (or perhaps even criminal prosecution), for exactly the reasons that he states here himself. It's extremely stupid, but on the other hand, I can easiliy see an overpaid bunch of useless humanity (i.e. corporate lawyers) effectively convincing judges and law enforcement officials that Ferguson should be liable. They would be right that he probably helped along other efforts to crack the encryption doing nothing more letting people know that it was possible. Ferguson's mistake is in thinking that the dunderheads who thought that arresting Sklyarov was a good idea will let him slide after he's said this.
The world is a cold, demon-haunted place nowadays. It sickens me to be a citizen of this country that so hypocritically prides itself on being free.
-Rob
Imagine the people who design & use encryption standards as the occupants of a castle, and the hackers are trying to use a battering ram to enter the facility. Thanks to DMCA, the walls are padded, so the people inside don't hear the pounding of a battering ram on their door. The king overruled the castle engineers who wanted a thicker door. "No need for that", says the king. "My DMCA padded walls will take care of the noise, therefore I proclaim that the hacker problem is solved!" Of course, when the door gives way, it will be quite a suprise to the occupants!
Not only that they also expect the "walls" to protect long after battering rams have been superceded as front line weapons. The kind of "castle" they need is one of the Chyeanne mountain complex, but instead they have one built out of balsa wood.
So just fake an infection by Sircam, and have it release the info. :)
"I don't think I ain't" -Thompson's Corollary to Descartes
Many countries are cinsidering DMCA type legislation to bring them into compliance with the WIPO Intelectual Property Treaties. For more on the the legal constructs being cinsidered by the World Intellectual Property Organization, see their whitepaper "Technical Protection Measures: The Intersection of Technology, Law, and Commercial Licenses" (M$ Word or PDF). Take a good look at this stuff. It's important that people fully understand the actions being taken by WIPO and begin to realize that arguing about your rights or my rights isn't the critical issue. The critical issue is that if WIPO has their way, there will be no protection for citizens of any country, from potentially usurous and monopolistic IP practices.
--CTH
--Got Lists? | Top 95 Star Wars Line
Go not unto/. for advice, for you will be told both yea and nay (but have nothing to do with the question)
So, now no one can read about the crack, rather how it was done. No one can learn from the mistakes of others and no one can make a better encryption technique because of the stupid DMCA. Wasn't there something about everyone coming out better when there is discussion and people didn't have to re-make the same mistakes?
So, how long do you think it's going to take for this to make it to some server in Zanzabar where the DMCA doesn't cover?
DanH
Cav Pilot's Reference Page
UNIX - Not just for Vestal Virgins anymore
Taiwan is not signed to either the Berne nor WIPO treaties. So copyright does not apply.
That is, unless every WIPO member embargoes Taiwan.
And where [copyright] does not apply is where information will flow freely.
Not if all routers in all WIPO states drop all packets originating from Taiwan's IP blocks. Then Taiwan can't communicate with anybody.
Will I retire or break 10K?
Sure sounds to me like Elcomsoft was claiming that their product does more than just allow fair use. Besides, you don't actually believe that anybody purchased this program to exercise their fair use rights, do you? You can't possibly be that naive. If you look over their product line, you'll see that Elcomsoft has two markets for their products: pirates and spammers.
And no, I'm not on the payroll of anybody related to this case. Do you really think I'd be wasting my time arguing with somebody like you if I were paid to astroturf? You probably also think that anybody who says anything good about Windows must be paid by Microsoft. And I'm not giving you my email address. The last thing I need is an inbox full of hate mail and/or spam. Grow up.
Man, you didn't even spell it right... What is the world coming to when people don't even know how to properly use profanities?
for showing weaknesses in systems will the creators be held responsible for those weaknesses? Nah
Now I may be hopelessly naive or idealistic, but wouldn't the goal of selling HDCP compatible devices permit the disclosure of the system? Or can "they" really, legally, absolutely, limit the entry of independent 3rd-party hardware manufacturers to the game?
What if Diamond wanted to start selling HDCP displays, but didn't want to pay the $$$$ that they're probably requiring for membership in the "club"? This research could allow them to create fully functional, compliant, standards based displays.
As long as they don't deliberately leave backdoors in their display to give end-users access to the raw digital stream (which would make the display itself a circumvention device), they should be in compliance with DMCA, right?
And, since they developed the system after someone outside of DMCA jurisdiction (if there is such a place, truly) reverse-engineered it, there's no trade-secret violation, they've signed no NDAs, etc., so they're free to publish their spec, right?
Or is this just a pipe dream?
How do we get a decent-sized player like Rio to start selling DeCSS-based DVD players, publishing their spec as they go "so that other manufacturers can do the same"? :)
Bravo. Sounds like Niels Furgeson really worked on it and come up with legitimate break. This kind of hard work and perseverance should be applauded. His craft is worth of respect.
However, Cryptology has never been something that you can partake in out in the open in full view of the world. I don't blame Niels for not wanting to publish.
Imagine Alan Turing announcing in 1940s "look guys, I figured out how to break those German enigma machines!" Whoops. Treason. You lose. Capital punishment, etc. And there wouldn't even have been a public trial.
In this case though, we're just dealing with commercial video appliances rather than military comms. We're only dealing with Intel and their DMCA-buddies, not the Axis. Niels Furgeson isn't at risk of becoming an unperson if he publishes a a break against HDCP, but there are real-life risks involved. The corporations involved do not play nice. There are many parties involved, vested interests, many millions of dollars at stake. I wish we lived in a world where Niels could publish and not have to worry.
Why are you linking to a crappy article on Securityfocus.com ? Please go read the original document:
http://www.macfergus.com/niels/dmca/index.html
He talks about why DMCA sucks. The Copyright issues, Jurisdiction, Freedom of Speech etc.
A must read !
--sn0w
1. Then why weren't the Elcomsoft SALES personnel at that conference arrested as well? The charge may have been distribution, but actually he WAS arrested for writing it.
2. Actually, you can't. Threatening legal action you don't intend to follow through on is illegal. That's part of the Felten/EFF countersuit against the RIAA.
3&4. However, these exceptions do not prevent the media conglomerates from threatening anyone with extremely expensive legal action. Even if the defendant is able to prove that the product was reverse-engineered, or that the research was conducted in "good faith" (and the burden of proof would be on the defendant), the legal costs of fighting the action would be prohibitive. This means that the DMCA has the effect of preventing even research and reverse engineering that is legal under it.
The media conglomerates bought and easily abuseable law, and have proceeded to abuse it.
The fact of the matter is that the DMCA is indefensible.
The RIAA threatened a lawsuit, but there were never any criminal charges against Felten and his colleagues under the DMCA, which is part of the criminal code.
You can sue somebody for any reason you want, regardless of what current law says. Given that Felten's work was NOT illegal under the DMCA, and the fact that the RIAA endorsed & supported the SDMI challenge, the RIAA had no hope of winning any lawsuit. But that doesn't mean they can't try.
Just post it AC from a free wireless network
"This is a country that tells others they should protect human rights, but they have trampled on mine," says Ferguson. "The U.S. Congress is telling me what I can or cannot say in my own country."
Don't you smell the hipocracy Mr.G.W.B?
keep it simple.
true, prison probably wouldn't be all that great (even though I'd be chilling in a minimum security country club) but I'm pretty sure that they can't even put you in a minimum security prison until your convicted, I might be wrong but I think people awaiting trial are held somewhere a little more agreeable. If I did have some problems with a fellow prisoners, I'm sure my 250+ pounds and martial arts training would come in handy :). Worse comes to worse, smack a gaurd and get thrown in solitary for a few weeks (I like being by myself) then when your found innocent claim Post-Traumatic Stress Syndrome from the confinement (provable by the feces you rubbed on the wall of solitary while singing "I'm a Little Teapot") and get a nice fat check from the government. The real reason prisons are no fun is because people aren't creative enough, my father had some experience with prisons too (goes with his "profession"), he acted like a loon (not too far from the truth) and he was pretty much left alone.
"
It's pretty hard to "go after the medium" when there's no centralised authority.
I have broken RSA encryption, but I can't release the details because I fear I will be prosecuted under DMCA.
I agree with your p.s. I've had the same thing, even worse a couple of times, and it is extremely frustrating. I've sent a message about it to malda@slashdot.org. Maybe if enough folks do the same, things will change....
Did anybody else catch this little bit?
"An experienced IT person could recover the master key in two weeks
given four standard PCs and fifty HDCP displays,"
I'm sure there are a couple of experienced IT people around here, and most of them probably have four PCs sitting around their homes... now we just need to scratch up FIFTY FREAKING HDCP DISPLAYS. That's a lot of hardware!
Ferguson of course declined.
-------
Warning: Slashdot may contain traces of nuts.
Not releasing the details just means he didn't really break the HDCP encryption. He just wanted some publicity and blaming the DMCA is trendy...
And the really great thing about the DMCA is that he can't do anything to refute my trolling because it would expose him to civil or criminal liability (remember the DMCA even outlaws acts of circumvention, and given past experience I'd guess that that provision can be streched to apply outside US border as well).
I think the point is that a researcher shouldn't have to resort to submitting his work anonymously. Whatever happened to freedom of speech?
Plus anonymously, the researcher would be unable to get any credit for his work, and it would be impossible to discuss the work with peers. Also, it would probably become illegal to host the document.
So maybe posting anonymously could be a last resort, but not e very desirable one.
Sounds like he should pick up a good hacker-type alias (no one ever figures out who these folks are), and post to Freenet. That's sure to boost Freenet's usage if it is only centrally released there and the alias would protect him if he ever decides to transit through an American airport lest they pull a Skylarov on him. Surely there's enough anonymity tools out there to mask his identity?
"Beware of he who would deny you access to information, for in his heart, he dreams himself your master."
I added an addendum to the fourth attack and fixed some minor typos today. The addendum essentially demonstrates the fourth attack as practical in the real world and much quicker than previously though through the use of a birthday-paradox style attack.
Since I'm writing a reply, I'll also take a moment to mention Scott Crosby's short critique of HDCP. Roughly it's the same thing as the second part of my fourth attack. Essentially, it is correct, although he skips over the difficult issues such as the modulo 2^56 math without mentioning them. Myself and other did later show that one can do so with impunity, but it was a desire to hammer out these difficulties which was why my paper comes to the public after his rather than before. He has told me that he's now working on a more in depth paper with some other researchers. I suspect that it contains things not found in my own, although he hasn't explicitly told me as much.
I will also say that I view Ferguson's claims of being able to recover the whole of the master key (which I don't refer to by that name in my paper, but certainly agree that it exists in the form of some 1600 56-bit values) with some skepticism. In my attack, I describe how to get all but the left-most approximately 8 bits of each. To extract the whole thing as best I can tell requires solving sets of linear equations with no division by 2 at any point. Although there are certain sets of KSVs for which that could be done, I don't know how one would expect to reliably find such. My suspicion is that he has broken the fundamental cipher (which I do not do) but overlooked the same modulo 2^56 math gotcha that Crosby initially did. I am, of course, just speculating about that, however.
Keith
Time Mag had a 2 page article - well written
In an example of blatant karma whoring, here it is.
Fascism starts when the efficiency of the government becomes more important than the rights of the people.
Ah, so we have found the fatal flaw in the Open Source movement then.. Pride.
Information may want to be Free, but will only be freed if the one letting it loose gets to take credit for doing so? That's hardly the idealism we've come to expect from the Linux crowd - though I do agree to a degree about the peer review.
Peer review can still be had however, if the originator can argue for the implementation without disclosing that they are in fact the source of the information.
Whatever happenned to scientific idealism? Doing the work for the benefit of mankind?
A TRUE hero is one who makes the sacrifice without even thinking of the recognition - in fact, one who realizes that he might be branded a traitor, or never acknowledged for his deeds, is a bigger hearo than anyone who is welcomed home to a ticker-tape parade.
The REAL jabber has the user id: 13196
What you do today will cost you a day of your life
You forgot about the all the sex you can take part...
Seriously, those that are sitting around claiming that U.S. prisons are pieces of cake have obviously never been in one. My father, a minister, visits prisons all the times and it's not a nice place to be. Maybe if you're rich and in a fed prison for defrauding someone of 100 million bucks you're OK, but if you commit the more serious crime of holding up a 7-eleven for 20 bucks using the ole finger in the coat pocket trick, you get to do some hard time in a state pen...
p.s. slashdot can really suck at times. I try to be a nice @home customer and use their proxy servers to keep their inter-connect traffic down but whenever I try to post it says I can't cause my IP address has posted too many moded down posts recently. Well D'OH, that IP has a few million people behind it. Learn about how a proxy works guys. It just forces me to uncheck my proxy connection but then I can't post because I get an invalid key msg (probably cause my IP address changes). So I open up a new browser section, hit reply, copy/paste my reply over, and the bitch tells me I have to wait 20 seconds after hitting reply before I submit. Arrrgh...
Free Hans!
If he posted it to Freenet, under an anonymous nickname, he could have released it without fear of being arrested next time he goes to the USA.
Can anyone here think of a recent content protection scheme that has done anything to stop "actual" pirating (making thousands of bootlet copies)? So far every single one I've seen has only served to limit the abilities of the consumer to use the content they pay for in the ways they choose. The bootleggers are free to keep on bootlegging! If that doesn't show that the DMCA is just a way for the big content providers to squeeze a little more money out of the consumers I don't know what does.
Anonimous submissions to the papers, inside, unnamed sources and subsequent 'expert' analysis have taken down Presidents..
Why don't people anonimously submit this sort of thing (cracks, weaknesses, bug reports) to news sources?
Would the papers be liable for printing someone elses 'approach', without necessarily verifying it's correctness first? After all, Deep Throat wasn't named to be right, he only gave 'hints' about Watergate...
I could see The Register, the Motley Fool, the Washington Post, or maybe just some online news source (ahem, slashdot, ahem) printing 'suggestions' from anonimous sources... And as 'reputable' guardians of Liberty (*sigh*) they would be able to claim the need to protect the identities of the submitters in order to maintain their 'professionalism', or some such...
How about it slashdot? Set up a PO Box where people could send neat stuff without a return address..
The REAL jabber has the user id: 13196
What you do today will cost you a day of your life
Elcomsoft's tool is to eBooks what DeCSS is to DVDs. You can use it for fair use purposes, but its primary use is to unencrypt the work so that it can be distributed to people who don't legally own it. Elcomsoft even advertised it as such.
At the time of the DeCSS arrests, there was actually a licensed Linux DVD player already on the market, and there were ZERO working DVD players based on DeCSS. So at the time there were no actual non-infringing uses of DeCSS (only a potential one), meanwhile there were lots of people using DeCSS to rip DVDs to DiVX for trading.
If somebody had cracked CSS and made a non-licensed Linux DVD player available without providing source code or algorithms of the DeCSS part, it would have been legal under the reverse engineering clause of the DMCA.
Felten worked on a set of experimental, unknown (to the public) encryption methods whose vulnerabilities were not well understood. In other words, he was actually making a contribution to the field of encryption. Further, the challenge itself was often described by SDMI as research effort, and he was publishing his results in a crytographic research forum. Finally, since SDMI issued the challenge, there was no question that the research was performed in "good faith".
Although the details are not clear yet, the HDCP crack appears to be more akin to crunching a 40-bit DES key in that it didn't advance the field of cryptographic knowledge at all. You can't just brute force crack some well known encryption method and call it research.
As much as I'd like to mention how the DMCA probably means very little to those that live overseas, the DMCA has done a good job at doing exactly what it was meant to do. Intimidate people into fearing the release of anything. I can almost hear big brother jumping up and down in joy, planning another party for tonight!
"I have found a proof of this theorem which is too long to fit in this margin." Think it actuallly exists?
"that's not encryption - it's a new perl script that I'm working on..." - from some Matrix parody
To my knowledge, Dmitry was the only Elcomsoft employee there. Do you have a source indicating otherwise?
:( My understanding is that there were a couple salespeople there, but I could be wrong.
Had one, but I can't dig it up.
If the charge was distribution (trafficking), then that's what he was arrested for, right?
Only officially, if there were sales personnel there who weren't charged. I'd say sales has a more direct role in distribution than the programmer, so if sales wasn't charged while the programmer was, it's not distribution that was targeted. It's the creation of similar programs that the arrest was intented to deter, not simply sales. He was targeted because he authored the program, not because he sold it.
I believe they can get away with baseless threats unless you can show that some damages resulted from them.
Probably right. The question is whether you consider suppression of speech to be damages. I do, and given that the Felton countersuit hasn't been thrown out yet, I'd assume that the law does as well.
It depends on whether you are being sued (a civil action) or being prosecuted (a criminal action). If the latter, the burden of proof falls on the prosecution.
My understanding is that while the burden of proof is on the prosecution, when the defendant admits committing the crime but is pleading extenuating circumstances, or an exception under the law, it is their responsibility to prove that the circumstances under which they broke the law meet the exception. Of course, whether it's legally true or not, it's certainly true given the current condition of our legal system.
The actual wording of the law is not nearly as bad as the average slashdotter makes it out to be.
While that's true, the fact of the matter is that the wording of the law is less important than how it is used in practice. It was obvious from the day the DMCA was introduced in Congress that, regardless of the exceptions tacked on, it would be used by the media conglomerates in exactly the way it has been. It's not just tort reform we need, we need to start holding Congressmen responsible for passing easily-abuseable legislation.
Googling around, I turned up this interesting linkabout a possible HDCP weakness: http://web.elastic.org/~fche/mirrors/cryptome.org/ hdcp-weakness.htm
LIE. Elcomsoft advertised its product as means to make a copy for fair use, from legally purchased e-book.
I am really curious of your identity, anonymous (you can find out mine, if you e-mail me), but I bet you $5 that you are on a payroll for one of the inetereseted parties. Liar.
<^>_<(ô ô)>_<^>
...For this I have found a truly wonderful proof, but the DMCA prevents me from publishing it.
Could something like SirCam or another virus/worm be used as a distribuition method for information like this?
You could have a SirCam clone or a Code Red variant download and install the Freenet client and then request the hdcp crack.
Will I retire or break 10K?
...my Romanian friend has turned 18. He's never been to America, but still he's refusing to drink beer, for fear that he'll break some American law that says you have to be 21. (The legal drinking age in Romania is 18.)
(There is no Dutch DMCA)
Niels Ferguson should place the paper with the HDCP encryption crack on a machine infected with Sircam. That way he doesn't have to "publish" his results.
Probably differs depending on the state. In my state (Delaware) you get thrown into "Gander Hill" with the rest of the population. A lot of people who can't make bail spend quite a few months in there before their day in court. The place was designed with one-person cells to try to cut down on some of the prisoner-to-prisoner violence issues but due to the overcrowding because of all of the jail sentences given for drug USERS and such, they currently stick two and in some cases three people in one cell.
I guess you don't want the facts to get in the way of your rant.
1. For the 100th time, Sklyarov was NOT arrested for giving his talk, nor was he arrested for creating the eBook cracker when he was in Russia. He was arrested for selling it to customers in the US over the internet and for selling in person while in the US at the conference.
2. The fact that the RIAA threatened a lawsuit against Felten doesn't mean he did anything wrong. You can threaten to sue anybody for any damn reason you can think of. Since what he did was clearly NOT illegal, the RIAA wisely backed down. Note that violations of the DMCA are criminal offsenses, and no law enforcement agencies ever contacted Felten about it.
3. Reverse engineering is explicitly permitted under the DMCA, with the caveat that the purpose of the reverse engineering has to be make your product/device compatible with the protected product/device. This means that reverse engineering in the form that Compaq used to create an IBM compatible BIOS is legal, while reverse engineering to create something like DeCSS is not legal.
4. Cryptographic research is also legal under the DMCA, as long as it is done under "good faith". I don't believe that anybody would consider a straightforward attack against a known encryption technique for the purposes of key discovery to be "good faith" research. You probably have to be contributing new knowledge to the field of cryptography (or at least trying to) in order to claim you are doing research. Felten's work seems to count, but I'm not sure this does.
If he wrote the paper, then I would assume that he owns the copyright on it. If he's a cryptographer, then he can apply an encryption algorithm to it. If he does that, then nobody can read it w/out breaking the encryption, and, therefore, violating the dmca...correct? Granted, we'd all have to violate the dmca to read it, but how is Intel going to see you ROT-13 something in your cubicle?
Juiced? Or Not?
C'mon, they didn't do anything after Tienneman, why would they do something over something as trivial as copying discs.
Sklyarov isn't charged with breaking the encryption ... but standing on US soil telling people what he had discovered. ... I don't see the problem.
Go back and re-read that..
Then if you STILL don't see a problem, go read the US constitution (don't worry, you don't have to read the whole thing, just the first part.)
He was arrested for telling people what he had discovered.. now, correct me if I'm wrong, but doesn't the First Amendment allow freedom of speech?
Why does he not release a new version of Code Red and replace millions of IIS server's home page with his cracked algorithm?? What a idea...
Imagine the people who design & use encryption standards as the occupants of a castle, and the hackers are trying to use a battering ram to enter the facility. Thanks to DMCA, the walls are padded, so the people inside don't hear the pounding of a battering ram on their door. The king overruled the castle engineers who wanted a thicker door. "No need for that", says the king. "My DMCA padded walls will take care of the noise, therefore I proclaim that the hacker problem is solved!" Of course, when the door gives way, it will be quite a suprise to the occupants!
Although no criminal case was ever thrown out because of a weak lock, nobody (as far as I know) was also arrested and jailed for breaking the lock to their own home. When I "buy to own" a DVD or ebook, I consider it my property to do with as I please.
And exactly where did you get this information from? I do not remember anybody mentioned sales here, not does DOJ complaint on arrest mention it. I think you are full of it.
<^>_<(ô ô)>_<^>
In other words, he was actually making a contribution to the field of encryption.
Do you think FBI agents really evaluated if Sklyarov did contribute to the field of encryption or not before arresting him? Are there many cryptography experts in that division, how do you think?
Elcomsoft's tool is to eBooks what DeCSS is to DVDs.
If one has problem with Elcomsoft, one goes to court and sues Elcomsoft. I have little sympaty to Elcomsoft as a company. But I bet you don't want to be arrested if you go to, say, Brazil and your company sales policy has some problem with some obscure Brazilian law. You probably would be outraged if you would be arrested on this basis.
Elcomsoft even advertised it as such.
Elcomsoft web pages are public. Can you quote me the place where the do it (URL, place there)? If not, please look in the mirror and say to yourself "I just lied. I am a liar. God forgive me".
-- Si hoc legere scis nimium eruditionis habes.
The problem isn't HDCP, it's that it has been demonstratably defeated multiple times by multiple people, using multiple methods.
And even if it worked, which it does not, it would be a total and utter waste of time. Just send the audio out and record it. Filters can modulate any unneeded signals (encryption to hamper CD quality recording).
Information just wants to be free, and music should not profit the middleman, but the artists!
--- Will in Seattle - What are you doing to fight the War?
I'll proudly publicize the results of his work (giving him full credit for the discovery). After all I live in the U.S and personally wouldn't mind 3 meals and a cott plus an extension to my summer vacation. Not to mention the lawsuits to follow my arrest (yeah I know I'd have no legal grounds but when has that ever mattered?) should pay my way through college. Or better yet why doesn't he let a Dutch friend who doesn't plan on visiting the land of the oppressed anytime soon or just post it anonymously. There seems to be no point in keeping it secret now, after all he did openly admit violating the DMCA already (it's illegal to do it, not just to publish your work) and I have a feeling that if he comes to the U.S anytime soon he'll be sitting in a jail cell right next to Dmitry (well at least where Dmitry was before he made bail).
Whats worse than us having to wait a bit longer to find out how he cracked the encryption, is the fact that now the U.S will think that the DMCA is working and will fight for it much harder. I understand his fear, but the fact is he's already violated the DMCA (I won't bring jurisdiction into play, after all the U.S obviously doesn't understand the word, except when it comes to chasing after murderers and rapists...then it's strictly observed).
"
Ferguson said in his article: 'I simply cannot afford to be sued or prosecuted in the US. I would go bankrupt just paying for my lawyers.'
When someone is afraid of getting in a lawsuit because the lawyers fees alone would cost him his LIFE'S SAVINGS, then I say there is no justice in this country. The legal system has become so rotten that the average person cant afford the price of justice anymore.
The courts, especially the criminal courts, understand that no matter HOW well something is locked up, it's still breaking and entering. Never in the history of US law has their been a case where the judge ruled for the defendant because the lock was too weak. Would you people *PLEASE!* stop making that argument!!! It's utterly useless.
This argument is not utterly useless. These schemes are presented to keep people from copying whatever and the schemes are extremely weak. What if Masterlock were selling a "paper" padlock and it was illegal (read DMCA) to prove the lock is not secure?
I understand the idea of locking material from copying is unpopular but this is the mean reason for these encryption schemes. If they don't work then the owners of the copyrights need to know.
It's not the size of the lock, it's the fact that it's locked.
The courts, especially the criminal courts, understand that no matter HOW well something is locked up, it's still breaking and entering. Never in the history of US law has their been a case where the judge ruled for the defendant because the lock was too weak. Would you people *PLEASE!* stop making that argument!!! It's utterly useless.
What you should be arguing are the points that can be used effectively. These points include academic research and ability to share knowledge. (Knowledge and research without proof isn't knowledge so proof of concept code is virtually required in all cases.) Others could include reverse engineering; a topic related to academic research. How about "Public Safety" or "Public Interest" as an important point? Imagine "copyrighting food only to find later that they included some very tastey toxins? We're not allowed to know what we are eating? Yes, I know, but we aren't allowed to know what we are installing into our own PCs (regardless of whether we own the code or license or whatever.)? For me, that's a scary issue. I want to be able to "trust" the software industry but truthfully, we cannot trust ANY industry and we have butt-loads of other watchdog agencies "protecting the public" but we don't have one for software (yet). Ever wonder when that will happen?
So please, people, stop arguing the one point that continues to turn people AWAY from the validity of the arguments against the DMCA. It's a lock, effective or not, it's a lock. If it can be broken "accidentally" it's not a lock, but so far, I haven't seen one that can be broken accidentally.
And don't leave your key laying around on your system.
What are we designing this freespeech network for anyway?
somebody breaks into his house ,steals the pc
and spreads the crack ??....
who will be arrested ?
better yet...somebody should make a bunch of all these "cracks" and spread it as CodeRedIII ..
then what?
Feel free to concat me with all your troubles...
Ok how does our government think that anything will be secure with a Law like the DMCA in effect we need these programmers and hackers to divulge it so they can fix it. Our society has some real issues give into Business america having your valued info like CC#s and SSN ect... out to the public we joe smo can use it without it being secure .. we rather have it in plain text? DMCA needs to be kick out and I hope incidents like this and 2600 can stomp this law out before Security turnes to be Insecurity due to the DMCA
"Before God we are all equally wise - and equally foolish." -Albert Einstein
"An experienced IT person could recover the master key in two weeks given four standard PCs and fifty HDCP displays"
1
2 or 14
4
50
Therefore the key is:
12450 or
114450 or
12450 * 114450 = 1424902500 or
sqrt(12450^114450).
q.e.d.
keep it simple.
See: freenet
And yeah, my ego could use a boost ;)
This sig is intentionally left blank
I could see how the next stage would be to prosecute people who claim that they even know of a vulnerability in an encryption system.
Just think, if the laws were strong enough, you could just go back to ROT-13, because if anyone said 'Hey! That's ROT-13! That's easy to break!" then you could send them to jail.
Vs lbh'er ernqvat guvf, ynj rasbeprzrag jvyy neevir fubegyl. Erznva pnyz naq chg lbhe jrncba (vr, zbhfr) qbja.
Kevin Fox
Of course not. What, do you think some company is going to file charges and get the FBI to arrest someone from Russia just because they give a talk about their work in Vegas? Or that an industry trade group would threaten a lawsuit if a college professor tried to present a research paper? My god, people are paranoid around here! Next thing you know they'll be saying that the Big Corporations are trying to outlaw reverse engineering!
Best Slashdot Co
Of course, it is only a matter of time until someone does publish, probably anonymously, and DHCP dies the death it so richly deserves.
Whee, static IPs for everybody!
Promote proofreading. Don't mod up sloppy posts.