Is Interoperable DRM Really Less Secure?

Crouch and hold writes "Are closed DRM schemes like FairPlay more secure than interoperable ones? Based on the number of cracks, it doesn't look like it. 'When it comes to DRM, what history actually teaches us is that one approach is no more secure than the other in practice, as they relate to the keeping of secrets. Windows Media DRM has had fewer security breaches than Apple's FairPlay, yet WM DRM is licensed out the wazoo: there are more than a dozen companies with WM DRM licenses.'"

Comments

+5 informative

[macadamia_harold]

Windows Media DRM has had fewer security breaches than Apple's FairPlay, yet WM DRM is licensed out the wazoo

I had no idea that the MS licensing department was actually an orifice.

Re:+5 informative

[thedarknite]

and here was me thinking that their licensing was forced into orifices.

Re:+5 informative

[Mr2001]

It's not a question of licensees choosing WM DRM because they trust it more than FairPlay - Apple doesn't license FairPlay at all, so Windows Media is the only choice for a third party.

Re:+5 informative

[networkBoy]

True enough, but I've always looked at it as such:
Closed DRM == one set of eyes for the "good" guys (arguably the bad guys in this case but whatever) == pwned by the freedom fighters.
licensed DRM == several sets of eyes, eyes with different corporate mentalities, eyes with different outlooks, thus sorta like OSS == less breaches.

-nB

Re:+5 informative

[DECS]

FairPlay = 2 Billion songs, 10 million movies

MS PFS DRM = 100,000 songs sold?

MS Zune DRM = 250 songs sold?

Leave it to ArsTechnica to suggest that number of exploits or number of licensees somehow relates to the complexity of managing DRM across multiple vendors.

Microsoft is also better suited to handle multiple vendors, as it already licenses OEM Windows, WinCE and various other products. Apple has only ever tried to license the Mac OS and Newton, license FireWire, and franchise iPods though HP, and license ad campaigns like Made for iPod. Apple isn't set up to license FairPlay, nor is it within its core competency.

A riddle of warfare between Apple and Microsoft: Steve Jobs and the iTunes DRM Threat to Microsoft presents DRM as a shot across the bow of Microsoft's flagship, but suggests that, beyond DRM, "Apple is targeting another Microsoft mainstay with a missile that may cause far more damage than the iPod and iTunes together." 2007 - Apple Strikes Back chronicles the recovery of Apple over the last decade, and Apple's Open Source Assault hints at how Apple will engage Microsoft. What is Apple up to?

Re:+5 informative

[Eustace Tilley]

You have been answered twice already, but I cannot resist telling you again.

Cryptography is used so that a message from A can be read by B but not by C. With DRM, B and C are the same person.

The message from A (the publisher) must be readable by B (the consumer) but not by C (the consumer).

I hope you understand now why DRM is a concept flawed in its fundament.

DRM would be useful. So would a perpetual motion machine. It is wishful thinking to believe that the sheer utility of a function means it is capable of being produced.

Re:+5 informative

[DECS]

Sure throw in subscriptions. 25,000 subscribers = 1 DRM key each. You don't get to count individual songs, because once they stop paying they lose them all.

Surely you realize that Microsoft's PFS and Zune are not making money because of ultra low revenues? That's why all the stores are tanking, and none of them brag about how many subscribers they have or songs they are selling.

Subscription/Rental DRM is harder to manage; it makes the player a less attractive product. And it's far more onerous.

Apple had eaten up market share long before the iTunes Store opened. Most iPod users aren't even using the iTS to a great extent - 25 songs on average is not holding people to the iPod. Outside regions with a store, there are plenty of people still buying iPods.

fairplay vs. wm?

[applegoddess]

Doesn't mean anything when you consider the market share of Apple vs. all of the Microsoft-licensed stores combined. Clearly people will be cracking the more-popular DRM, and that happens to be Apple's FairPlay.

Re:fairplay vs. wm?

[suv4x4]

Doesn't mean anything when you consider the market share of Apple vs. all of the Microsoft-licensed stores combined. Clearly people will be cracking the more-popular DRM, and that happens to be Apple's FairPlay.

You know, I once started thinking a lot and realized nothing ever means anything. It's all just a bunch of people arguing over unprovable hypotheses in a one-up-man-ship style and eventually spinning whatever facts they have in their disposal to reach a goal determined in advance before any analysis was done.

Wow. I'm boring.

Hang on, you can't have it both ways...

[spoco2]

Windows Media DRM has had fewer security breaches than Apple's FairPlay, yet WM DRM is licensed out the wazoo: there are more than a dozen companies with WM DRM licenses. Hang on... so in this case, where it's a Microsoft product that's fairing better you apparently can being into play the 'well, it's not used on nearly as many devices as the Apple version' shtick. Yet when OSX fares better than Windows in virus threats you aren't allowed to use the exact same and just as legitimate argument that Windows is installed on VASTLY more machines than OSX, and as such is a MUCH greater target for compromise?

How does that work?

Insecurity vs policy

[Space cowboy]

I'm not suggesting this is official Apple policy, but just because something has been cracked more times than any other doesn't actually imply much. If Apple deliberately set the bar low, then they fulfill their obligation and allow the counter-culture to flourish as much as the "official" party line. Hmmm, who would that benefit ?

I know some very smart engineers at Microsoft, and I know some very smart engineers at Apple. Devising a hard-to-break DRM system wouldn't be beyond any of them, and iTunes really doesn't go to too much effort. I'll let you draw your own conclusions :-)

Simon.

Re:Insecurity vs policy

[kfg]

If Apple deliberately set the bar low, then they fulfill their obligation and allow the counter-culture to flourish as much as the "official" party line.

Bingo!

Apple is doing the minimum necessary in order to be allowed to sell content. Microsoft is trying to do the maximum possible in order to sell the security system to the content owners.

Their markets are entirely different, so their products are entirely different.

KFG

funny

[ArbitraryConstant]

Funny how Apple supporters dismiss this reason when it's applied to Windows security, but when it supports Job's reasons for keeping FairPlay closed it's accepted.

Re:funny

[applegoddess]

Never said anything to the contrary, in fact I agreed with you: http://slashdot.org/comments.pl?sid=221484&cid=179 44918

Fewer security breaches?

[Incoherent07]

It only takes one. Last I checked the FairUse4WM hole still hasn't been fixed.

It could just be poor implementation

[Infonaut]

Funny how Apple supporters dismiss this reason when it's applied to Windows security, but when it supports Job's reasons for keeping FairPlay closed it's accepted.

You're right to point out the contradiction. However, another way of interpreting it is just that FairPlay is simply not as well-iplemented as Windows Media DRM. That would be an interpretation consistent with the view that Windows gets cracked not just because of its market dominance, but also because of its flaws in implementation. Maybe Apple simply isn't as good at DRM as Microsoft, which isn't necessarily such a bad thing.

Who has the best BAD IDEA?

[IBitOBear]

It's like that thing were people propose a truly horrific law because they know they will be "forced to settle" for a merely terrible law.

No Digital Restriction Management is good. NONE of it.

I am not anti-encryption.
I am not anti-artist.

But any scheme that involves someone "selling" or "giving" me something so provisionally that they can then just take it back is simply a BAD IDEA.

The next step down this road is the one where some Bad Actor gets to send people threatening letters and blackmail that is "unprintable", "read only once", "no screen shot", "read only for 1 minute", watermarked to prevent your camera from taking a picture of the screen. Leaving you, in turn, with no proof for a complaint and then leaving the police with no clues while they are pondering over your corpse.

Eh, so what, at least some music executive is *sure* to get to split the full 99-cents that he ripped off the consumer for, in the name of an artist who got a bill for overages in production.

Oh, wait... which kind of Illegal Prior Restraint (commonly misspelled DRM) was good again?

It is _NEVER_ helpful to repeat the artificially biased question as if it represents something worth answering.

The question, as stated, presumes facts not in evidence, namely that the DRM that is harder to break is in any possible way "Better".

What a silly question

[shaitand]

Since there are no effective DRM schemes out it seems silly to evaluate which are 'more secure'. What do you do; count the ways available to bypass the DRM? There are easy cookie cutter utilities to crack them all.

Re:What a silly question

[ajs318]

The only way DRM can work is if every consumer is forced to have a special DRM chip in their head and it would be interesting or horrifying to see if the consumer would accept this blindly or fight against it.

Under Thatcher, nobody would ever have stood for such a thing. There would have been rioting in the streets, people burning effigies, punk rock benefit gigs and all sorts. People who had the brain chips fitted would be on the receiving end of flying bricks crudely scratched with "SCAB". We'd be out marching with placards, chanting "Maggie Thatcher's GOT one, [name of major Brain Chip proponent] IS one". Decrepit coaches would be brought out of retirement to ferry Flying Pickets around, and enterprising kids would be hard at it poking holes in old oil drums to make braziers to flog to the striking workers.

Under Blair, there would just be a bit of polite tutting and moaning, followed by total passive acceptance. The Working Classes (who mostly think they aren't working class anymore just because [1] they have mobile phones and DVD players and [2] a whole new social class has grown up beneath Working) would even be saying things like "Well, it's probably a good thing. I mean, I've been looking for ages for a reason to cut down the amount of media I copy, or even give it up altogether; so I mean, this chip-in-the brain thing is a good idea really."

Talk about licking your arse and calling it chocolate .....

Because WMV sucks

[kerouacsgp]

"Windows Media DRM has had fewer security breaches than Apple's FairPlay, yet WM DRM is licensed out the wazoo: there are more than a dozen companies with WM DRM licenses"

Hmmmm.... could it because no one really cares about downloading wmv files? The point is that if the product sucks, no one will bother even to break into it.

Security through Obscurity

[flaming error]

Does Swiss Cheese have more holes when its package is opened or when it is closed?

You missed a bit

[Space cowboy]

Quite an important bit, actually.

Apple had to sign over the right for the record-labels to pull their entire catalogue from the iTunes store, if a breach happens and Apple don't fix it in a timely manner.

Jobs doesn't care about DRM, but (because he's sane) he doesn't want to lose the iTunes store either - here's his nightmare scenario:

• Apple licence fairplay to all who'll pay the fee
  
• Some no-mark MP3-player company pays the fee, gains the licence, but screws up and somehow the encryption codes are made public - a bit like the first crack of DVD's was because some no-mark company screwed up their encryption key
  
• Apple release a fix
  
• No-mark company doesn't release the fix for *their* client-base, maybe there's no firmware update...
  
• Apple lose all their iTunes songs from the "big 4".
  

Now Apple can try and pin liability on No-mark company, but at the end of the day, the iTunes store contract is between Apple and [insert record label], and if fairplay is compromised, [record-label] are fully entitled to pull their catalogue...

See it now ?

Simon

Does licensng DRM lead to success?

[mveloso]

Again, this question isn't the right question. DRM is not interoperable. Using the word "interoperable" is deliberately confusing, because DRM by definition isn't interoperable. It's a method of restriction, not an operatable thing per se.

The operative word is "third party licensed."

Audible.com is licensed to multiple vendors. How have those vendors done? Besides the iPod, Audible.com's DRM is licensed to a number of other players. Has it been a major factor in anyone's purchase? Possibly, if they want to listen to audible.com content.

WMA/Plays for Sure is licensed to multiple vendors. How have those vendors done? The market has spoken.

Zune WMA isn't licensed. The market is in the process of working out how the Zune is doing, but the prognosis isn't good.

FairPlay isn't licensed. The iPod is doing great.

The iPod is reallly a good example of what's called a "Network Effect Monopoly." People buy iPods because it has the most accessories. The iPod has the most accessories because people buy iPods. Etc etc etc. eBay is the same: people sell on eBay because the buyers are there. The buyers are there because everyone sells on eBay. Ad infinitum.

Will licensing FairPlay change this? No. If Apple licenses FairPlay to hardware makers, it'll make the iTMS even more dominant. If Apple licenses FairPlay to other stores, it'll make the iPod even more dominant in hardware. If it licenses FairPlay to everyone, then Apple will sit on the dominant DRM system, period.

As I said before, there isn't one thing that makes the iPod successful. But of those things, DRM is definitely not one of them.

Security Through Obscurity

[thedbp]

Ahem. This is going to feel mighty good.

The only reason that PlaysForSure isn't cracked all the time is because no one really uses it on a large scale. Since Apple dominates the DRM music field, and most DRM'd music sold is from Apple and includes FairPlay, then of course people are going to attack FairPlay more than PlaysForSure. If it were the other way around, PlaysForSure would be just as insecure as FairPlay.

I don't really believe that, of course - but it was nice to turn the whole security through obscurity argument around for once so Windows fanboys could see how freaking STUPID it is.