Slashdot Mirror
Is Interoperable DRM Really Less Secure?
Crouch and hold writes "Are closed DRM schemes like FairPlay more secure than interoperable ones? Based on the number of cracks, it doesn't look like it. 'When it comes to DRM, what history actually teaches us is that one approach is no more secure than the other in practice, as they relate to the keeping of secrets. Windows Media DRM has had fewer security breaches than Apple's FairPlay, yet WM DRM is licensed out the wazoo: there are more than a dozen companies with WM DRM licenses.'"
Windows Media DRM has had fewer security breaches than Apple's FairPlay, yet WM DRM is licensed out the wazoo
I had no idea that the MS licensing department was actually an orifice.
Push Button, Receive Bacon
Doesn't mean anything when you consider the market share of Apple vs. all of the Microsoft-licensed stores combined. Clearly people will be cracking the more-popular DRM, and that happens to be Apple's FairPlay.
How does that work?
I'm not suggesting this is official Apple policy, but just because something has been cracked more times than any other doesn't actually imply much. If Apple deliberately set the bar low, then they fulfill their obligation and allow the counter-culture to flourish as much as the "official" party line. Hmmm, who would that benefit ?
:-)
I know some very smart engineers at Microsoft, and I know some very smart engineers at Apple. Devising a hard-to-break DRM system wouldn't be beyond any of them, and iTunes really doesn't go to too much effort. I'll let you draw your own conclusions
Simon.
Physicists get Hadrons!
Funny how Apple supporters dismiss this reason when it's applied to Windows security, but when it supports Job's reasons for keeping FairPlay closed it's accepted.
I rarely criticize things I don't care about.
Not licensing Fair Play has nothing to do with making it more secure. It has to do with being able to roll out fixes to counter security breaches in a timely manner.
Avoid Missing Ball for High Score
It only takes one. Last I checked the FairUse4WM hole still hasn't been fixed.
This is my sig. There are many others like it, but this one is mine.
Funny how Apple supporters dismiss this reason when it's applied to Windows security, but when it supports Job's reasons for keeping FairPlay closed it's accepted.
You're right to point out the contradiction. However, another way of interpreting it is just that FairPlay is simply not as well-iplemented as Windows Media DRM. That would be an interpretation consistent with the view that Windows gets cracked not just because of its market dominance, but also because of its flaws in implementation. Maybe Apple simply isn't as good at DRM as Microsoft, which isn't necessarily such a bad thing.
Read the EFF's Fair Use FAQ
It's like that thing were people propose a truly horrific law because they know they will be "forced to settle" for a merely terrible law.
No Digital Restriction Management is good. NONE of it.
I am not anti-encryption.
I am not anti-artist.
But any scheme that involves someone "selling" or "giving" me something so provisionally that they can then just take it back is simply a BAD IDEA.
The next step down this road is the one where some Bad Actor gets to send people threatening letters and blackmail that is "unprintable", "read only once", "no screen shot", "read only for 1 minute", watermarked to prevent your camera from taking a picture of the screen. Leaving you, in turn, with no proof for a complaint and then leaving the police with no clues while they are pondering over your corpse.
Eh, so what, at least some music executive is *sure* to get to split the full 99-cents that he ripped off the consumer for, in the name of an artist who got a bill for overages in production.
Oh, wait... which kind of Illegal Prior Restraint (commonly misspelled DRM) was good again?
It is _NEVER_ helpful to repeat the artificially biased question as if it represents something worth answering.
The question, as stated, presumes facts not in evidence, namely that the DRM that is harder to break is in any possible way "Better".
Innocent people shouldn't be forced to pay for inferior software development.
--"Code Complete" Microsoft Press
Since there are no effective DRM schemes out it seems silly to evaluate which are 'more secure'. What do you do; count the ways available to bypass the DRM? There are easy cookie cutter utilities to crack them all.
The interoperability that Jobs said was less secure, the interoperability that Norway wants, isn't offered by Microsoft's WMV either. Norway is demanding that Apple allow fairplay encrypted files to be converted into files DRM'd under Microsoft's PlaysForSure(OrNot) DRM model or anyone else's, not that they start licensing FairPlay.
"Windows Media DRM has had fewer security breaches than Apple's FairPlay, yet WM DRM is licensed out the wazoo: there are more than a dozen companies with WM DRM licenses"
Hmmmm.... could it because no one really cares about downloading wmv files? The point is that if the product sucks, no one will bother even to break into it.
Does Swiss Cheese have more holes when its package is opened or when it is closed?
DRM is in of itself not secure because it will get cracked wide open each and every time
somebody comes up with a scheme. Take the digital broadcast / subscriber card hacker arms
race. They are already light years ahead of whatever Apple or Microsoft are cranking out
and they will be well prepared if "trusted computing hardware" comes out.
These people have phisticated lab equipment and are capable of cutting the chips wide open,
manipulating chip fuses, patching rom masks etc. They will extract Disney's latest singing
and dancing monkey mascot together with the accompanying mermaid from any and all DRM scheme.
It seems to me, when looking at the big picture, that digital data is being distributed to customers. Digital data is exactly copyable, due to its nature.
Now this digital data is encrypted, however if it can be decrypted (i.e. played!) then the encryption can be broken. It might prove to be difficult, but it will be broken.
There are two possible ways that the big content distributors can go:
(1) Get rid of DRM and change your marketing and pricing model so that it is convenient and cheap enough for most consumers to just by the media through the channels that they provide.
(2) Remove digital data distribution and instead distribute media in the form of a sealed, enclosed device (with speakers, no other outputs) that only plays the media that you have purchased.
Option (1) is the logical conclusion to most people and the neolithic companies will eventually (maybe in 10 years?) realise this and go with it. Option (2) is just not feasible, due to cost, space and sound quality issues.
Please don't send a Word document when a text file will do the job.
Apple had to sign over the right for the record-labels to pull their entire catalogue from the iTunes store, if a breach happens and Apple don't fix it in a timely manner.
Jobs doesn't care about DRM, but (because he's sane) he doesn't want to lose the iTunes store either - here's his nightmare scenario:
Now Apple can try and pin liability on No-mark company, but at the end of the day, the iTunes store contract is between Apple and [insert record label], and if fairplay is compromised, [record-label] are fully entitled to pull their catalogue...
See it now ?
Simon
Physicists get Hadrons!
Again, this question isn't the right question. DRM is not interoperable. Using the word "interoperable" is deliberately confusing, because DRM by definition isn't interoperable. It's a method of restriction, not an operatable thing per se.
The operative word is "third party licensed."
Audible.com is licensed to multiple vendors. How have those vendors done? Besides the iPod, Audible.com's DRM is licensed to a number of other players. Has it been a major factor in anyone's purchase? Possibly, if they want to listen to audible.com content.
WMA/Plays for Sure is licensed to multiple vendors. How have those vendors done? The market has spoken.
Zune WMA isn't licensed. The market is in the process of working out how the Zune is doing, but the prognosis isn't good.
FairPlay isn't licensed. The iPod is doing great.
The iPod is reallly a good example of what's called a "Network Effect Monopoly." People buy iPods because it has the most accessories. The iPod has the most accessories because people buy iPods. Etc etc etc. eBay is the same: people sell on eBay because the buyers are there. The buyers are there because everyone sells on eBay. Ad infinitum.
Will licensing FairPlay change this? No. If Apple licenses FairPlay to hardware makers, it'll make the iTMS even more dominant. If Apple licenses FairPlay to other stores, it'll make the iPod even more dominant in hardware. If it licenses FairPlay to everyone, then Apple will sit on the dominant DRM system, period.
As I said before, there isn't one thing that makes the iPod successful. But of those things, DRM is definitely not one of them.
...Don't encourage them by implying that DRM can be licensed and is a legitimate option.
:)
DRM is bad bad bad, and is broken whether licensed or not. Don't use it, that's the answer
Enjoy Y2K? Roll-on Year 2037!
Whats wrong with this picture? Logically, if you can put them together in order to play the media you can 'read' the unencrypted data, and if you can read it you can copy it. The "magic" in DRM is simply the "how" that they keep you from knowing how to put them all together. Its nothing but a secret designed to prevent you from accessing your own computers data while playing the media. Everything else is nothing but hype with smoke and mirrors. The only people that truly benefit from the distribution of DRM are the ones designing, producing, and selling it the DRM itself, not the media that it encodes. The Media boardroom executives at the major studios are just not smart enough to realize the hype that they are being fed by these DRM designer companies. Bottom line, you can't make a DRM that is unbreakable so it prevents nothing so far as the goal that it is being sold for. Its a sham and it needs to be recognized for what it is.
To the professional black-market vendors all the DRM smoke-and-mirrors is merely a speed bump because they just physically copy the whole disk/file bit by bit and bypass the need to even decode the data, it's the user needs to do that and their player will happily do that for them. Making the much sought after DRM-free Internet down loadable version of the file is a little harder, but then you only need one pissed-off geek to put it out there and the game is over. Just one. Thats something that the all the Board Room Exec's should all think about. How much has the price of what they produce gone up due to the DRM they have uselessly added to their product? How many fewer people have purchased their product due to the DRM making it more expensive and in many cases completely unusable? If there is one thing I know is that the bottom line in their check book is what matters, and they are being duped by the technology vendors just like the snake oil salesmen of years ago.
Ahem. This is going to feel mighty good.
The only reason that PlaysForSure isn't cracked all the time is because no one really uses it on a large scale. Since Apple dominates the DRM music field, and most DRM'd music sold is from Apple and includes FairPlay, then of course people are going to attack FairPlay more than PlaysForSure. If it were the other way around, PlaysForSure would be just as insecure as FairPlay.
I don't really believe that, of course - but it was nice to turn the whole security through obscurity argument around for once so Windows fanboys could see how freaking STUPID it is.
DRM is a huge pain in the ass for consumers and digital distribution of media that uses it is never likely to take off in the same fashion as it's physical medium counterparts unless it's easy to use and not very restrictive like Apple's FairPlay. Part of what makes FairPlay acceptable to me is the ability to burn purchased content to a CD that I can then take with me and listen to in any CD player that I wish. If FairPlay didn't have this ability I wouldn't use it. Likewise I'll never buy a "digital download" version of a movie or TV show unless I have the ability to burn that movie or show to a DVD. IMHO anything with DRM that doesn't let you burn to some kind of physical media that can then be played back on other devices (players, portables or other PC's) is essentially a rental and isn't worth it. I think most consumers agree which is why I'm tired of these DRM articles. A huge factor in any media format leap is convenience. Does anyone here really think that either CD's or DVD's would have taken off as they did if they didn't involve huge leaps in convenience for consumers? Quality played a part sure, but I'd argue it was the convenience of CD's and DVD's that really caused them to take off. Being able to leap back and forward between tracks instantly and not having to flip back and forth between sides was a huge factor in moving from tapes to CD's. Likewise the ability to skip back and forth easily through movies (and not having to rewind tapes to watch them) was a huge factor in the move from VHS tapes to DVD's. Not to mention never having to worry about a bad tape or VHS player destroying your music or movie. A poster on Slashdot said something a while back that I completely agree with. Everyone is looking at HD-DVD and Blue-Ray, freaking out about the DRM, and wondering which will be the next big thing in video and I think they are off the mark. All that HD-DVD and Blue-Ray offer over their DVD counterparts is more space and HD content. Newsflash, most consumers don't have an HD TV and won't anytime soon. Even when there's an HD TV in every home, HD TV's are expensive and most homes have more than one TV anyway so most consumers would then probably have one HD set in the living room and regular TV's elsewhere. I think some kind of hybrid DVR / Apple iTV kind type of box with a price point of around $200 bucks would be poised to be the next big thing in video. Consumers want a leap in convenience more than they want a leap in quality because at this point the leap in quality requires a large investment in expensive new hardware to pay real dividends. Why pay thousands of dollars for one brand new large HD TV in the living room and a bunch of HD-DVD's and/or Blue Ray discs (when you probably already own the content on DVD) who's improvements in quality can only be seen on that one expensive large TV in the house when you can spend between $600 and $700 dollars and have set top box hooked up to each TV in the house that lets you record, share with the other boxes and play back content recoded by the DVR and/or download, share with the other boxes and playback movies and TV shows that you've downloaded from the Internet. IMHO that latter option makes a lot more sense than shelling out all that money for a new HD TV set and bunch of content in HD that I've already paid for just to get better picture quality. My point is that convenience sells. DRM that isn't convenient won't sell and DRM that is convenient will. The box that I spoke of above could be DRM'd to the hill as long as I could share the content with the other boxes, have a backup system or the ability to re-download content that I paid for if I lost it and as long as it had a simple interface and "just worked" it would be a hit much like the iPod / iTMS combination. The RIAA and MPAA are to stupid to get it that and I have no doubt they'll DRM consumers to death and turn them off to digital distribution completely if they are left to their own devices. All they have to do is look at Napster. Napster didn't offer higher quality. Napster offered the con
Whether a DRM scheme (or any other software implementation) for that matter is more or less secure because of interoperability is in the margins; security is a question of implementation, not licensing. (Some have made the point that open schemes are subject to more scrutiny and more likely to identify flaws early; perhaps so, but I still argue that the difference is probably marginal.)
The point Jobs raised in his essay is that it's harder to propagate fixes to software that is broadly licensed across many vendors, which in turn means that vulnerabilities remain in the field longer. He also asserts that this could threaten the agreement between Apple and music companies, although you might want to add salt to that to suit your tastes.