Slashdot Mirror


HD-DVD and Blu-Ray Protections Fully Broken

gEvil (beta) writes "According to an article at BoingBoing, the processing keys for the AACS encryption scheme used by both HD-DVD and Blu-Ray video discs have been extracted, and a crack has been released. What this means is that there is now a method to extract the copy-protected content of any HD-DVD or Blu-Ray disc out there. This is different from Muslix64's previous crack, which only extracted the volume key for each disc. This new method bypasses this step and allows anyone to extract the data without first requiring the volume key."

682 comments

  1. Nice. by FatSean · · Score: 5, Funny

    In five years, when I finally buy into HD television and content, there should be an assload of free content out there to download.

    --
    Blar.
    1. Re:Nice. by alx5000 · · Score: 5, Funny

      ... as if a million RIAA execs cried out in terror and were silenced at once...

      --
      My 0.02 cents
    2. Re:Nice. by toleraen · · Score: 1

      Somehow I don't think Metallica is going to be terribly afraid of this.

    3. Re:Nice. by Tumbleweed · · Score: 5, Funny

      An 'assload' is the metric name for 'buttload', both of which are greater than or equal to 1 'shitload' or 'crapload', respectively. I know the whole Imperial/metric conversion thing is problematic at times, but you could've at least Googled this before asking such a silly question.

    4. Re:Nice. by stewwy · · Score: 5, Funny

      Its important to be fair and ensure both formats are equally broken.

    5. Re:Nice. by Alphager · · Score: 1, Redundant

      An assload is the equivalent to a metric fuckton.

    6. Re:Nice. by Anonymous Coward · · Score: 5, Funny

      Actually, wouldn't the correct metric term be "arseload"?

    7. Re:Nice. by eno2001 · · Score: 4, Funny

      Well, seeing that the average ass on Slashdot is probably about three to four feet wide, two feet high (from a sitting position) and about a foot deep from front to back, that means at most eight cubic feet of HD DVDs ripped and placed online. In reality, I'm not sure what the parent poster was that happy about since eight cubic feet of DVDs is actually not that much. I would have been inclined to say, "Great! This means that when I buy into HD stuff in five years, there should be more HD content online than there have been cocks in porno actress Houston's Yoni. If you catch my drift..." A little more accurate.

      --
      -"...bad old ideas look confusingly fresh when they are packaged as technology" - Jaron Lanier (Digital Maoism on Edge.o
    8. Re:Nice. by Anonymous Coward · · Score: 5, Informative

      Editor's Note: Houston is a porno actress who was supposed to gang bang 500 men and wound up gangbanging 620 men instead. So the parent post would suggest that only 620 movies would be online in five years. I suspect that there will be many more movies online.

    9. Re:Nice. by lotsotech · · Score: 1

      Maybe the point is that he likes to be about 8 years behind on technology so he'll only be able to download a couple movies with his USRobotics 56k x2 modem.

    10. Re:Nice. by harryk · · Score: 1

      Well, seeing that the average ass on Slashdot is probably about three to four feet wide, two feet high (from a sitting position) and about a foot deep from front to back, that means at most eight cubic feet of HD DVDs ripped and placed online. In reality, I'm not sure what the parent poster was that happy about since eight cubic feet of DVDs is actually not that much. I would have been inclined to say, "Great! This means that when I buy into HD stuff in five years, there should be more HD content online than there have been cocks in porno actress Houston's Yoni. If you catch my drift..." A little more accurate.


      I couldn't find a reference... for Houston's Yoni ...
      --
      think before you write, it'll save me moderator points.
    11. Re:Nice. by jb.hl.com · · Score: 4, Insightful

      Why the fuck would the Recording Industry Association of America care about movies being pirated, precisely?

      (Seriously, I see this far too often on Slashdot. It annoys me. A lot.)

      --
      By summer it was all gone...now shesmovedon. --
    12. Re:Nice. by Anonymous Coward · · Score: 2, Interesting

      My goodness, you're right.

      Is there *nothing* that Google can't find an answer for?

    13. Re:Nice. by eno2001 · · Score: 1

      Houston.

        Yoni.
      Look it up!

      --
      -"...bad old ideas look confusingly fresh when they are packaged as technology" - Jaron Lanier (Digital Maoism on Edge.o
    14. Re:Nice. by Kadin2048 · · Score: 5, Funny

      Actually, wouldn't the correct metric term be "arseload"?

      That's an Imperial assload; it's only used in Britain. It's equal to 1.24 U.S. assloads.

      --
      "Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
    15. Re:Nice. by alx5000 · · Score: 1

      Yeah, sorry, I was afraid you'd pick on that. I mistook Submit for Preview.

      --
      My 0.02 cents
    16. Re:Nice. by starnix · · Score: 2, Insightful

      I believe a "shit ton" outweighs all of those.

    17. Re:Nice. by fbjon · · Score: 3, Funny
      8 cubic feet gives a cube with sides of 60,96 cm, which fits at least 5*5= 25 stacks of DVDs. With a thickness of 11,2 mm, this gives a total of 1350 DVDs. Turns out it is quite a lot after all, with a slashdotter's ass having a bandwidth of 40,5 TB/load, assuming single-sided, double layer HD DVDs.

      Latency is horrible though, for more reasons than I care to imagine.

      --
      True confidence comes not from realising you are as good as your peers, but that your peers are as bad as you are.
    18. Re:Nice. by 117 · · Score: 5, Funny

      That's an Imperial assload; it's only used in Britain. It's equal to 1.24 U.S. assloads. Your figures are incorrect, the comparative sizes of arse/asses between the two nations means that there are in fact 1.6 UK arseloads to every US assload.
    19. Re:Nice. by mediocubano · · Score: 1

      Why buy into the HD content if we can just download it all for free? Somehow I doubt that the studios will create better content for HD - it will all be just higher resolution crap. Just like spending 2x or 5x on a TV doesn't really get you any better programming, it is all garbage just a bigger or brighter view of it.

    20. Re:Nice. by poot_rootbeer · · Score: 1

      In five years, when I finally buy into HD television and content, there should be an assload of free content out there to download.

      Surely you're running your desktop PC display at a resolution higher than 720x480? You can enjoy the benefits of "HD"-resolution video content today!

    21. Re:Nice. by Jethro · · Score: 0, Redundant

      *laughs* nice.

      --


      In the land of the blind, the one-eyed man is kinky.
    22. Re:Nice. by Anonymous Coward · · Score: 5, Funny

      Actually, it's calculated by the internal volume, not the external surface area. We Americans are lard asses, but the British are full of shit.

    23. Re:Nice. by misleb · · Score: 1

      Actually, the real measurements are fuckton and metric fucktons. See: http://www.urbandictionary.com/define.php?term=met ric+fuckton

      -matthew

      --
      "THERE IS NO JUSTICE, THERE IS ONLY ME." -Death
    24. Re:Nice. by lazybeam · · Score: 1

      Uh, 720x480 is Standard Definition (NTSC); 768x576 is SD PAL; HD is 1280x720 or 1920x1080

      --
      --
      no sig for you. come back one year.
    25. Re:Nice. by Xanius · · Score: 4, Funny

      There's also the fuckton and metric fuckton, thus far the heaviest units of measurements I've come across.

    26. Re:Nice. by YU+Nicks+NE+Way · · Score: 1

      Yeah, but how many Libraries of Congress is each of those asses worth nowadays?

    27. Re:Nice. by Anonymous Coward · · Score: 0

      If /. ever needed a +1 TMI mod, that would be right now!

      This is the text equivalent of seeing goatse. EWWW!

    28. Re:Nice. by carlmenezes · · Score: 5, Funny

      Which kinda explains why America is so focussed on oil and British ideas never float....

      *ducks* hehehe :)

      --
      Find a job you like and you will never work a day in your life.
    29. Re:Nice. by diablomonic · · Score: 1
      which seems to be exactly the grandparents point (whooosh....(*)): "surely your computer has higher res than standard def, and would thus benefit at least a little (although maybe not be able to play in full 1080p depending on your monitor) from hd content" (paraphrasing).

      (*) look up....

      --
      watch "the money masters" on google video
    30. Re:Nice. by iamstretchypanda · · Score: 1, Flamebait

      Non-sense! Everyone knows a metric fuckton + a metric assload = 1 George Bush

    31. Re:Nice. by JonathanR · · Score: 1

      So the RIAA wouldn't derive any sort of royalties or benefits from movie soundtracks?

    32. Re:Nice. by Anonymous Coward · · Score: 0

      All of these posts look like a load of crap to me!

    33. Re:Nice. by SenseiLeNoir · · Score: 1

      God, u owe me a new keyboard!

      i am a brit

      --
      Have a nice day!
    34. Re:Nice. by Anonymous Coward · · Score: 0

      Uhm. I don't get it. Huh?

    35. Re:Nice. by Jherek+Carnelian · · Score: 4, Funny

      Why the fuck would the Recording Industry Association of America care about movies being pirated, precisely?

      Because they have a very strong sense of empathy?

      I mean, they are suing grandmas and invalids, how can they not?

    36. Re:Nice. by Trogre · · Score: 1

      Wouldn't that be an 'arseload', then?

      --
      "Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
    37. Re:Nice. by rrohbeck · · Score: 1

      Well, seeing that the average ass on Slashdot is probably about three to four feet wide, two feet high (from a sitting position) and about a foot deep from front to back, that means at most eight cubic feet of HD DVDs ripped and placed online. According to the Bekenstein bound, the limit on information density goes by surface area, not by volume. Your average Slashdot ass would have a maximum surface area of roughly 28 ft^2, assuming it's rectangular (crude approximation, I know. Doing the calculation for two half-spheres is left as an exercise for the reader.) That's 9.96*10^69 Planck areas, which corresponds to 3.59*10^69 bits. Since a key has 16 bytes, you can put at most 2.81*10^67 keys on a Slashdot ass. Enough for me.
    38. Re:Nice. by c_forq · · Score: 1

      Man, does that bring back memories, I used to have a U.S. Robotics 28.8k modem, and was in such awe when my father came home one day with a new work laptop equipped with a state of the art 56.6k x2 PCMCIA card.

      --
      Computers allow humans to make mistakes at the fastest speeds known, with the possible exception of tequila and handguns
    39. Re:Nice. by frogstar_robot · · Score: 1

      An 'assload' is the metric name for 'buttload', both of which are greater than or equal to 1 'shitload' or 'crapload', respectively. I know the whole Imperial/metric conversion thing is problematic at times, but you could've at least Googled this before asking such a silly question.

      That is also the value of one green van made from marijuana resin.

    40. Re:Nice. by Tumbleweed · · Score: 1

      That is also the value of one green van made from marijuana resin.

      Mmm, "Still Smokin'" ... a classic.

    41. Re:Nice. by pallmall1 · · Score: 1

      Why the fuck would the Recording Industry Association of America care about movies being pirated, precisely?
      Concert DVDs, perhaps?
      --
      3 things about computers: they're alive, they're self-aware, and they hate your guts.
    42. Re:Nice. by Anonymous Coward · · Score: 0

      That's an Imperial assload; it's only used in Britain.

      Incorrect. Arseload is also used in Australia, which is a purely metric environment.

    43. Re:Nice. by ekhben · · Score: 1

      Ah, then you've never had to measure anything in shagpiles.

    44. Re:Nice. by boarsai · · Score: 1

      Music videos? Bands release DVDs with them playing live concerts amongst other things. If anyone can throw an arseload of crap onto a Blu-Ray disk filling it entirely... I'm sure it's the music industry.

      I got a metalica DVD for a birthday a while back... it didn't even have 1 full length song on it and it was full. There was a lot of talking and showing snippets of the video clips... but d'ya think they'd give me just a single one to watch? No chance! *sigh* At least other music DVD's actually had the music.

      Nowhere in the post you replied to was the word "movies" when mentioning RIAA.

      Having said that he was probably thinking MPAA...

      None the less I'm sure there'll be RIAA content on next gen media :P Be they Media disks or audio.

      And as far as I'm concerned RIAA/MPAA should just join forces - that way I wont have to divide my dislike between two entities.

    45. Re:Nice. by frogstar_robot · · Score: 1

      Actually, that was from "Up In Smoke".

    46. Re:Nice. by Milikki · · Score: 2, Funny

      What, did someone lose count or was she just into her work?

    47. Re:Nice. by ScaryMonkey · · Score: 1

      Also, the vast majority will be films *of* Houston's yoni...

    48. Re:Nice. by IMightB · · Score: 1

      You know I've thought that writing a conversion tool to take care of this would be a great idea. You know something like
      12 hershey squirts == 1 crapload
      1024 craploads == 1 Assload

      2000 Assloads == 1 Fuckton

      Then you have to worry about metric

      1 Assload == 1.6 Arseload

    49. Re:Nice. by plover · · Score: 1

      Because they have a very strong sense of empathy? No, because there's blood in the water and a shark is a shark.
      --
      John
    50. Re:Nice. by ccmay · · Score: 1

      Hey, I didn't know your name was Alex, man!

      --
      Too much Law; not enough Order.
    51. Re:Nice. by Anonymous Coward · · Score: 0

      It's funny because Americans are fat.
      1 American butt = 1.6 British butts
      For the mass required for a single US butt, you could manufacture three British cheeks. Plus one tenth.

      You should have drawn a picture. Word problems are fun.

    52. Re:Nice. by gameforge · · Score: 1

      To both you and the cranky GP - three of the RIAA "big four" (Warner, Sony and Universal) are also of the MPAA "big six". Additionally, two others of the MPAA "big six" are RIAA members (Fox and DreamWorks).

      It's not like they're some different breed of animal or something. Same suits & lawyers. More relevantly, what pisses off one of the **AA's will, by simple association, piss off the other.

    53. Re:Nice. by ezzzD55J · · Score: 1

      units(1).

    54. Re:Nice. by C0vardeAn0nim0 · · Score: 1

      because some members of RIAA are also members of MPAA. warner and sony comes to mind...

      --
      What ? Me, worry ?
    55. Re:Nice. by jackharrer · · Score: 1

      I remember connecting to Internet in middle '90s using 14400 baud modem from school. For about 2 months before somebody checked the phone bills and nicked the modem so some smartarses couldn't use it any more (that was us).

      Not much later they connected leased line - 128k for something like 50 computers... We needed to nuke rest of them (Win95 was soooo cool with this) so only our computers were online.

      And seeing 20 BSOD at the time and other kids with jaws down - PRICELESS!

      Brings back memories...

      --

      "an experienced, industrious, ambitious, and often, quite often, picturesque liar" - Mark Twain
    56. Re:Nice. by ewn · · Score: 1

      Actually, wouldn't the correct metric term be "arseload"?

      That's an Imperial assload; it's only used in Britain. It's equal to 1.24 U.S. assloads.

      So Britons crap bigger than Americans?
    57. Re:Nice. by Jesus_666 · · Score: 1

      Sequentially or simultaneously?

      --
      USE HOT GRITS WITH STATUE OF NATALIE PORTMAN (NAKED AND PETRIFIED)
    58. Re:Nice. by Anonymous Coward · · Score: 0

      I think I speak for most people in saying: got a .torrent link for that? ;-P

    59. Re:Nice. by Anonymous Coward · · Score: 0

      Dude, this is slashdot! Sureley you meant parallel or serial...

    60. Re:Nice. by lazybeam · · Score: 1

      My GGP said "You can enjoy the benefits of "HD"-resolution video content today!" which to me implies full HD resolution, not just a little bit better. Besides, I live in a PAL area so 720x480 would be a downgrade...

      --
      --
      no sig for you. come back one year.
    61. Re:Nice. by Anonymous Coward · · Score: 0

      Aussie units of measure are only relevant in drinking games.

    62. Re:Nice. by RespekMyAthorati · · Score: 1
      You still don't get it, do you? 1920X1080 is "a resolution higher than 720x480".

      I take it English is not your native language.

    63. Re:Nice. by diablomonic · · Score: 1
      in all cases with my current pcs at work and home, I could enjoy content in FULL 1080p HD (actually, even slightly higher than that), and I severely doubt you could find any but the most ancient of pc's in use at the moment unable to at least display true 720p (720*1280) or better (which IS a HD format)

      in other words, perhaps you should shut up? (also 720* 480 is NOT hd(720p is 720*1280), thats the point. Which you again missed. You should perhaps take up fencing as you are good at dodging/missing the point).

      --
      watch "the money masters" on google video
    64. Re:Nice. by AUDIOMIND · · Score: 1

      Try MPAA. :)

  2. OK, time to switch now! by Anonymous Coward · · Score: 5, Insightful

    The time has come to make the upgrade.

  3. DVD-JON by otacon · · Score: 5, Funny

    I wish Jon Johansen would have done it so he could be called HD-DVD Jon, or maybe Blu-Ray Jon.

    --
    In a world of acronyms, the words are the real victims.
    1. Re:DVD-JON by morgan_greywolf · · Score: 5, Funny

      Yeah, but now we got HD-DVD Blu Arnezami. That's at least as easy to say and remember as DVD-JON.

      What?

    2. Re:DVD-JON by Citizen+of+Earth · · Score: 1

      We could use "Blu Arne" or "HD Arne". Does the guy have a nickname?

    3. Re:DVD-JON by definate · · Score: 5, Funny

      I wish someone named Charles could have cracked Blue-Ray so we could have Blue-Ray Charles.

      --
      This is my footer. There are many like it, but this one is mine.
    4. Re:DVD-JON by ccmay · · Score: 1
      If he's Swedish, he can be Blu Swede. That would be cool.

      -ccm

      --
      Too much Law; not enough Order.
    5. Re:DVD-JON by monsted · · Score: 0, Redundant

      I'd prefer someone named Charles. Blu-Ray Charles!

  4. drm by Anonymous Coward · · Score: 5, Funny

    years to create, weeks to break- sounds about right.

    1. Re:drm by Anonymous Coward · · Score: 5, Funny

      The solution is obvious, we need even tighter, more intrusive DRM!

    2. Re:drm by Anonymous Coward · · Score: 4, Funny

      Sure! Why don't they just hook a padlock through our taints and latch us to a movie theater seat.

      Oh no! Not Howard the Duck again!!! For the love of God!!NO!!!

    3. Re:drm by elrous0 · · Score: 1
      It's like that biker who jumped me in the alley said the other day: "It's always easier to tear down than to build up."

      -Eric

      --
      SJW: Someone who has run out of real oppression, and has to fake it.
    4. Re:drm by IdleTime · · Score: 1

      years to create, weeks to break- sounds about right. I see an incredible business opportunity here.
      Make a deal with MPAA and hire people to follow each sold HD-DVD/Blueray disc to make sure it's viewed only on legal hardware. Might make a few billions on this...
      --
      If you mod me down, I *will* introduce you to my sister!
    5. Re:drm by amigabill · · Score: 2, Funny

      The solution is obvious, we need even tighter, more intrusive DRM!

      Indeed. In the future, every device capable of reading HD media will come with a guy named Guido. If Guido detects the user attempting to crack, reverse engineer, or in any way compromize the security built in to the HD reader device, Mr. Guido will break the users kneecaps with a baseball bat. The HD Media content industry believes this will finally demotivate the evil people in our society who believe they have some bizarre things they refer to as "rights", whatever that means, these evil people seem to think these "rights" somehow make it OK to do really evil things. The heroic Guidos shall discover who these evildoers are and bring them to the light, using their mighty baseball bats of justice to convince the supervillans that their wicked ways are wrong, that they will not be tolerated under any circumstances, and that there is no escape. Yes, the Guidos will be a far superior content protection method than relying merely on technology and the weak assumptions that this technology is smarter than the evil superillans are.

  5. Cue Nelson (pointing at the officers of the MPAA) by CyberLord+Seven · · Score: 1, Funny

    HA! HA!

    --
    We have always been at war with Eurasia!
  6. props to Muslix64 and hackers everywhere by cpearson · · Score: 5, Insightful

    It puts a smile on my face knowing that a small group of unpaid media hackers are able to crack the AACS encryption scheme what tooks many developers and millions in R&D to create, in just a few short weeks.

    Vista Help Forum

    --
    Windows Vista Help Forum
    1. Re:props to Muslix64 and hackers everywhere by Anonymous Coward · · Score: 5, Insightful

      cpearson,

      It has always been easier to destroy/crack something than to create it in the first place.

      It is not a great undertaking to break a DRM scheme. It is not comparable to cracking strong encryption (which takes lots of horse power). The basic concept of DRM is fundamentally flawed and therefore open to attack.

      DRM by its nature is both widely available and has to function on a user's local device or PC. The wide availability (unlike an encrypted message with a unique key) means the attacker has easy access both the algorithm and protected content. This mathematically greatly reduces uniqueness. One only has to setup the correct environment and observe how it functions with a legal copy. And since the DRM scheme is most likely non-unique on a copy by copy basis the affect instantly cascades. Unlike getting a randomly encrypted file you have access to the algorithm (the software) and you have access to the keys.

      The big issue in DRM is how to obfuscate your algorithm and how to keep people from getting access to the stream in the clear. Both of these tasks are next to impossible to carry out effectively.

      So anyone, even the very same "small group of unpaid media hackers" in question, would have to spend a large amount of effort trying to come up with better and better obfuscation schemes. While cracking the DRM will take far less resources, focus, or time.

      Cracking DRM is more akin to white box QA or reverse engineering.

      All that said I'm secretly glad someone stepped up and did this :-) DRM as it exists today is pointless, useless, and gets in the way of a customers fair use of something they have purchased.

      I'm willing to bet 5 years from now we will see far less DRM in use and those still using it won't be selling as much music or as many movies as those not using it.

    2. Re:props to Muslix64 and hackers everywhere by h2g2bob · · Score: 5, Informative

      Sorry everybody, but it's not.

      That said, they have got a player key now, so all disks published to date can be decoded.

      Each player has its own player key, and each disk accepts any player key in its list (the player key is used to decode the volume key which decodes the film).

      With this player key, they can decode any HD-DVD which has been printed already. However, as the key has now been compromised, future disks will not accept that player key. The software will have its player key updated, but the software will be tightened in an attempt to remove this loophole.

      Take a look at the archives of http://www.freedom-to-tinker.com/ for a detailed discussion.

    3. Re:props to Muslix64 and hackers everywhere by Xugumad · · Score: 3, Insightful

      Erm, it's a simple distributed attack. While the group that succeeded was small, the cost (in man hours) of all groups that attempted but failed must also be considered, is likely not a small number.

      I think this is a fundamental problem that the people backing DRM forget. They're massively outnumbered, and it's just a matter of making it not worth the rest of the human population's time to break their stuff. So far, not gone so well for them...

    4. Re:props to Muslix64 and hackers everywhere by file-exists-p · · Score: 2, Insightful

      When I think about DRM -- software or hardware -- I have in mind this image of a small vault in a cave, with a bunch of guys around it with all tools, time and motivation they need.

    5. Re:props to Muslix64 and hackers everywhere by tolan-b · · Score: 1

      +1 Insightful for the parent... Never have modpoints when I need them...

      As the parent points out, AACS was designed with this in mind, it was expected to happen. They're not as stupid as all that. However they are fighting a losing battle.

    6. Re:props to Muslix64 and hackers everywhere by tambo · · Score: 1

      So anyone, even the very same "small group of unpaid media hackers" in question, would have to spend a large amount of effort trying to come up with better and better obfuscation schemes. While cracking the DRM will take far less resources, focus, or time.

      Your analysis is correct, but inaccurately aimed. The parent poster wasn't comparing the skill of the RIAA R&D branch vs. the unpaid hacker community in performing the same task. (S)he was comparing the DRM creation effort vs. the DRM destruction effort. The parties behind it are incidental (even though there's a certain refreshing karma at work here. ;) )

      - David Stein

      --
      Computer over. Virus = very yes.
    7. Re:props to Muslix64 and hackers everywhere by Anonymous Coward · · Score: 0

      It took Bin Laden 1 day to tear down the World Trade Center Towers, which took years to build too. So what? It's always easier to destroy/crack than to create in the first place. THat you give props to such efforts shows what a shallow individual you are.

    8. Re:props to Muslix64 and hackers everywhere by slim · · Score: 4, Interesting

      However, as the key has now been compromised, future disks will not accept that player key. Sure they can remove the compromised player key from the acceptable list. But it remains to see whether they'll actually do it. Presumably there's a decent number of blameless consumers already using that player. What's the commercial impact of pissing them off?
    9. Re:props to Muslix64 and hackers everywhere by D3viL · · Score: 5, Informative

      You would be correct, execpt what has been relesed is not the player key. In fact the player (device) key is one of the two that have not been released, the other one being the root key held by AACS LA. The key that has just been released and reusulted in this article is the processing key which can (and probably will) be changed for any disc authored after the previous key bacame known. The key difference is that the player key is linked to the specific player whereas the processing key is specific to the hddvd/blueray discs created with it and will continue to be valid for those discs even after new ones are produced with a new key. Relasesing a device key would be counterproductive as indiviual device keys can be blacklisted meaning if you had one you would have to break a new player device (hardware or software).

    10. Re:props to Muslix64 and hackers everywhere by kir · · Score: 1

      I'm just nitpicking here, but the RIAA has nothing to do with this. I see this all the time on slashdot. The RIAA (Recording Industry Association of America) is not the MPAA (Motion Picture Association of America). Granted... they might as well be considered one in the same what with all the interlocking corporate boards and such.

      So... nevermind. I guess you are correct.

      Well... shut my mouth!

      --
      3cx.org - A truly bad website.
    11. Re:props to Muslix64 and hackers everywhere by Athenais · · Score: 5, Insightful

      Or as someone once put it, there is no cryptographic solution to the problem where the intended receiver and the attacker are the same entity.

    12. Re:props to Muslix64 and hackers everywhere by stile99 · · Score: 5, Funny

      Informative? INFORMATIVE?

      Man, you people better hope I don't get this one on metamod (which I suppose now I've tossed out the window, but oh well).

      This is the same head-in-the-sand crap we've been hearing for months now. "It will be ROCK SOLID! No way will anyone ever break it! This is the absolute best, most secure copy protection ever! We fin...wait, what? It's broken already? DAMN!"

      It's dead. You lost. As we all have been telling you for months now. "All is not lost, we'll change the key!" Yes. You will. And in less time than it took you to change the key, and at far lesser expense...we'll get that one too.

      Face it. We're coming to your house. If you take the numbers off, we'll just go to the house with no numbers. If you take the numbers off from the neighbor's house, we'll just come to the house next to the house with no numbers.

      You. Lost.

    13. Re:props to Muslix64 and hackers everywhere by interiot · · Score: 3, Interesting

      The contract for software players could require that players work just like Firefox... when a new version is found, they automatically and silently download it, and when the player is started the next time, they offer to seamlessly install it for the user. From what I've heard, this may be built in to all/most software players, making it relatively painless to force-upgrade software players at least.

      (which would mean that hardware keys are actually more valuable to extract, so maybe that's the hacker community's next step?)

    14. Re:props to Muslix64 and hackers everywhere by niiler · · Score: 2, Informative

      It sounds like the new encryption scheme was based on the fact that the Key would be in active memory for such a short period of time that it would be effectively irretrievable. All the hacker did was to slow the decoding process down so that the instant the Media key entered memory, the player was stopped and the Media key was recorded. While it might sound simple to "patch the software" to guard against this, the hacker has found the weak point in the whole scheme. This, to me sounds like a major rewrite, not a patch. And even if there is a rewrite, you still need to give the key to your audience at some point or they can't watch the video. This sounds like a losing proposition from the security viewpoint.

    15. Re:props to Muslix64 and hackers everywhere by mczak · · Score: 1

      You would be correct, execpt what has been relesed is not the player key. In fact the player (device) key is one of the two that have not been released, the other one being the root key held by AACS LA. The key that has just been released and reusulted in this article is the processing key which can (and probably will) be changed for any disc authored after the previous key bacame known.
      You're right, except it wouldn't make sense to change the key before the player used to find it is blacklisted, otherwise it would be very easy to find the new one right again. I'd guess future sw players will be harder to compromise, but it's probably just a matter of time...
    16. Re:props to Muslix64 and hackers everywhere by amRadioHed · · Score: 1

      Who says the players are on the internet? Is a network connection a requirement to watch movies in HD?

      --
      We hope your rules and wisdom choke you / Now we are one in everlasting peace
    17. Re:props to Muslix64 and hackers everywhere by repvik · · Score: 1

      Yeah. And that is what makes buying the most sold HD-DVD/Blu-Ray players, getting the player keys and releasing them extrordinarily fun. Think of all the hassle the regular consumers will have :-D

    18. Re:props to Muslix64 and hackers everywhere by Fordiman · · Score: 1

      And they'll do it again, in a slightly different way. Point is, at some point either the decryption key or the decrypted media MUST at some point be in memory on a software player.

      If they really wanted to lock it down, they'd have tried to pull off the 'hardware only' approach. And, of course, lost millions on the entire industry of HD content.

      --
      110100 1101000 1101000 1100110 0 1101111 1101000 1100011 1
    19. Re:props to Muslix64 and hackers everywhere by Pojut · · Score: 3, Interesting

      No, but they could very easily put the update on newly released discs....with all the space they have, I think they can spare a few zeros and ones to include software that updates the system.

      I wouldn't be suprised if this has already happend at least once or twice.

    20. Re:props to Muslix64 and hackers everywhere by Goaway · · Score: 1

      Hardware players can be individually revoked. There will be no hassle for any customer but yourself.

      Software players are different, but as far as I know their keys are meant to be revoked every six month regardless of whether they have been compromised or not anyway, so they're built to make revoking easy.

    21. Re:props to Muslix64 and hackers everywhere by Anonymous Coward · · Score: 0

      No. It took years of effort to destroy the WTC.

    22. Re:props to Muslix64 and hackers everywhere by mgv · · Score: 1

      Or as someone once put it, there is no cryptographic solution to the problem where the intended receiver and the attacker are the same entity.

      I was going to mod you up, but then I had to write this reply instead:

      Great quote, thank you for my new .sig

      Michael

      --
      There is no cryptographic solution to the problem where the intended receiver and the attacker are the same entity.
    23. Re:props to Muslix64 and hackers everywhere by nuzak · · Score: 3, Interesting

      I like Bruce Schneier's aphorism: trying to make bits not copyable is like trying to make water not wet.

      --
      Done with slashdot, done with nerds, getting a life.
    24. Re:props to Muslix64 and hackers everywhere by amRadioHed · · Score: 1

      I see, that might work (at least as much as anything DRM related works)

      --
      We hope your rules and wisdom choke you / Now we are one in everlasting peace
    25. Re:props to Muslix64 and hackers everywhere by Mr2001 · · Score: 4, Funny

      You still believe that Mossad/CIA fairy tale? That's just a story The Man puts out to appease the people who are too smart to believe the Bin Laden hoax, but not smart enough to question anything else.

      Open your eyes and see the truth, man! 9/11 was executed by the International Male Models' Union working in conjunction with Major League Baseball. It's so obvious you probably overlooked it at first, but dig deeper. It checks out.

      --
      Visual IRC: Fast. Powerful. Free.
    26. Re:props to Muslix64 and hackers everywhere by Splab · · Score: 1

      Uhm... You have to include every update for every compromised player on every disc. Even with a few spare gigabytes you are going to use it up mighty fast.

      And then theres the issue of updating, stuff like that can easily brickify your player and leave you in a worse position.

    27. Re:props to Muslix64 and hackers everywhere by Pojut · · Score: 1

      Never said it was plausible, just possible.

    28. Re:props to Muslix64 and hackers everywhere by timmarhy · · Score: 1

      i believe the summary said this doesn't operate like the muslix64 crack, which used a stolen key? if so your way off base.

      --
      If you mod me down, I will become more powerful than you can imagine....
    29. Re:props to Muslix64 and hackers everywhere by Richard+W.M.+Jones · · Score: 4, Funny

      Presumably there's a decent number of blameless consumers already using that player. What's the commercial impact of pissing them off?

      It's HD-DVD/Blu-Ray we're talking about. I bet both of the consumers will be really pissed.

      Rich.

    30. Re:props to Muslix64 and hackers everywhere by Wanker · · Score: 2, Funny

      I like Bruce Schneier's aphorism: trying to make bits not copyable is like trying to make water not wet. Here you go, water that's not wet: http://www.buydehydratedwater.com/
    31. Re:props to Muslix64 and hackers everywhere by FauxPasIII · · Score: 1

      > when a new version is found, they automatically and silently download it

      Step 1: Find the player key for a popular software player
      Step 2: Find the auto-update mechanism it uses so you can intercept future update pushes (you could do this even without doing Step 1, perhaps)
      Step 3: ....

      etc.

      --
      25% Funny, 25% Insightful, 25% Informative, 25% Troll
    32. Re:props to Muslix64 and hackers everywhere by BalkanBoy · · Score: 1

      IEEE was predicting just that about two years ago.

      --
      'A lie if repeated often enough, becomes the truth.' - Goebbels
    33. Re:props to Muslix64 and hackers everywhere by Lost+Engineer · · Score: 1

      Hell, you could include an entirely new copy of player software for every player on the planet today if you wanted.
      Since all the standalone players are running Linux anyways and presumably can be flashed, they could switch to a whole different DRM scheme for new movies.

    34. Re:props to Muslix64 and hackers everywhere by jquirke · · Score: 1

      Absolutely right. It does seem people have jumepd the gun on this. Whilst it is certainly an impressive feat of debugging/disassembly, the AACS scheme itself has not been cracked or compromised.

      AACS were aware, like almost everyone on this forum, that media keys and even device keys will be leaked out of a player somewhere given enough effort. Indeed, the same argument holds for the content itself - if it can be viewed then it exists decrypted somewhere.

      This is why at the heart of AACS is a revocation algorithm significantly more advanced than CSS (which allows revocation of a player key that is shared between many players of a manufacturer etc). In other words, every future disc pressed can revoke this player (WinDVD). AACS can cryptographically revoke any particular player or set of players it likes without significant overhead. For those interested, the subset-cover algorithm does about 1.25 subset-differences per revocation, and each entry for a subset-difference is 16+5 = 21 bytes, so every player in the world that is eventually revoked only adds 26 bytes to the MKB (disc header) of every disc produced from the on.

      Actually I should include a shameless plug on a posting of mine which attempts to explain how this algorithm works, if you're _really_ interested.

      Another poster responded to this parent that revoking WinDVD would inconvenience a lot of people using this player. And that I think is one of the weaknesses of the implementation of AACS - software players. On the other hand, it is fairly easy to update a software player over the internet to use new keys, but all any new version of WinDVD would be doing is hiding its AACS code/keys in more obscure ways, which we know is like throwing a chair in the path of someone chasing you =)

    35. Re:props to Muslix64 and hackers everywhere by dbIII · · Score: 1

      What's the commercial impact of pissing them off?

      About the same as region locking.

    36. Re:props to Muslix64 and hackers everywhere by FrangoAssado · · Score: 1

      No, but they could very easily put the update on newly released discs (...)

      Erm... I don't think it would accomplish anything. Any method of "updating" from a disc used by the player can be used by anyone to obtain the new keys, if a person has the (old) player keys.

    37. Re:props to Muslix64 and hackers everywhere by kocsonya · · Score: 1

      > and it's just a matter of making it not worth the rest of the human population's time to break their stuff

      Hollywood is trying that angle with their film offerings...

    38. Re:props to Muslix64 and hackers everywhere by larytet · · Score: 1
      Imagine LCD screen with DRM enabled controller. The screen supports "end-to-end" encryption between the controller and DVD player. Now there are two ways to break the system

      - video tape the screen itself losing quality on the way

      - attempt to analyze the handshake between LCD and DVD

      The second option can be made very hard by increasing clocks on the bus (you need special equipment to follow the handshake), adding redundant data and so on. While theoretically it is impossible to create uncrackable DRM, in reality a scheme can be created which makes the crack extremely hard. Of course, I made a couple of assumptions, including that the customer is willing to pay a premium for DRM enabled LCD.

      The released key can be used only for the existing DVD disks - disks which are printed. This key can be revoked and new disks will be printed with new key. Now the question is how hard to find the key and how fast keys can be changed. Naturally it is possible to apply the same procedure again and again and break the new disks. How many different keys can be used in the manufacturing ? How fast manufactures can replace the keys.

    39. Re:props to Muslix64 and hackers everywhere by Eivind · · Score: 1
      The only stunning thing is that so many, even some reasonably intelligent people, claim to not understand this.

      Notice I said "claim to" -- I don't nessecarily believe them. I think all competent companies developing technologies like this know from the get-go that they product they're trying to create is fundamentally impossible. Likely most of their customers (i.e. RIAA) knows it too.

    40. Re:props to Muslix64 and hackers everywhere by crosbie · · Score: 2, Insightful

      Yup, that's why we have the DMCA.

      TPMs only have to demonstrate that some effort has to be expended to circumvent them, i.e. that they are a protection mechanism (no matter how easily the lock may be picked with a tool readily available on the black market).

      I expect it will also help magnify the crime of circumvention in the judge's eyes when it is explained just how expensive the R&D was that went into developing AACS. No-one will point out that such R&D was a priori doomed at the outset (and comparable to R&D into perpetual motion devices).

      DRM is not the problem. DMCA is the problem.

      Pay for art, not for copies.

    41. Re:props to Muslix64 and hackers everywhere by ggeens · · Score: 1

      If we're going to rehash quotes, here's another one:

      Trying to keep a honest user honest is like keeping a tall user tall.

      Also by Bruce Schneier IIRC.

      --
      WWTTD?
    42. Re:props to Muslix64 and hackers everywhere by Eivind · · Score: 1
      The DMCA doesn't help this in the least.

      It further adds to the problems non-technical people may have in legally using material they own, while making no difference whatsoever for the large comercial pirates.

      Mass-copying copyrigthed DVDs and selling the resulting discs is blatantly illegal -- but it was illegal before the DMCA came too. And I don't think all too many pirates will be thinking Oh, so that'd be breaking *two* laws -- I better not then!

      I disagree: DRM would be a problem even without DMCA (though a somewhat smaller one).

    43. Re:props to Muslix64 and hackers everywhere by crosbie · · Score: 1

      DRM is an inconvenience that pretty much anyone with a brain appreciates is counterproductive to all concerned.

      By itself, DRM is an irritant. With DMCA, DRM lands you in prison or fines you millions of dollars.

      DRM is an irritant.
      Copyright is a big problem (and should never have been permitted to apply in the digital domain).
      The DMCA is a bigger problem (law made by corporate sociopaths).

      DRM is simply a logical fallacy.

      Copyright/DMCA is the unethical weapon used against members of the public.

    44. Re:props to Muslix64 and hackers everywhere by Pojut · · Score: 1

      That implies their first effort accomplished something...

    45. Re:props to Muslix64 and hackers everywhere by StikyPad · · Score: 1

      that's rich

    46. Re:props to Muslix64 and hackers everywhere by StikyPad · · Score: 1

      Crack is not a synonym for destroy. Next troll.

    47. Re:props to Muslix64 and hackers everywhere by Eivind · · Score: 1
      Preach it brother ! *grin*

      Ok, so fine. I just got this Gnuicus-like picture of you in my mind currently. I assure you, you look awesome !

    48. Re:props to Muslix64 and hackers everywhere by diablomonic · · Score: 1
      answer yourself these questions if you can be bothered, you might wake up (dont trust any single source, and always look at opposing views for yourself from the source, just to see what they are:

      - how many fighter jet scrambles to intercept commercial planes happened in the US in the year before 9/11 (hint, a LOT more than 1). Contrast this to how many you are told occurred on 9/11,and how many sites like scientific American claim happened in their "debunk" of the conspiracy theories.

      - How much money did silverstein invest in the wtc complex? when? how much did he get on insurance? when? how much was it going to cost to remove the asbestos and other health hazards, or to pull down the buildings? how much public money did they get to clean up the mess instead?

      - was there gold underneath the WTC? how much? how much was found? how was it found?

      - was there insider trading on 9/11? was it investigated? why was it dropped? does this reason sound reasonable given the size and unlikeliness of this being innocent?

      - how much opium was produced in afghanistan pre, during and post Taliban? how much money (cash) does the drug industry bring to the american economy each year?

      - how much money was announced missing from the pentagon budget on the day before 9/11? was it ever found? did the large numbers of accountants that died in the pentagon incident have anything to do with this (lack of recovery)do you think?

      - who or what is PNAC and what is the quote "new pearl harbour" in reference to? was pearl harbour a surprise? really?

      - what is "operation northwoods"

      - can planes be reomote controlled? what companies work on such systems? where any of their employees involved on 9/11

      - who was john oneill? how do we know he is dead? how do we know how he died? do you find this coincidental given how he got his last job and what his job prior to that was?

      - how did wtc7 collapse? have you ever watched it? who said "pull it"? are there any witnesses to this?

      - why where the firefighters testimonies blocked for years? have ou ever read them (look up "explosive testimonies").

      - what is the iran oil bourse? what similar thing did iraq try before getting invaded? what similar thing did venezuala do to get "blacklisted" by the us?

      - what is mkultra?

      - what movement did jfk's head make when the bullet hit? what does that tell you?

      - how many bombs were originally found at OKC bombing?

      - I could go on but I'll leave it there for now (doubt many people will get this far)

      --
      watch "the money masters" on google video
    49. Re:props to Muslix64 and hackers everywhere by Mr2001 · · Score: 1

      You're the one who needs to ask yourself some questions, pal.

      - Which way do male models turn at the end of the runway? Which way do baseball players run around the diamond? Are major league baseball players male or female? Is that a coincidence?

      - How many strikes to an out? How many planes hit their targets on 9/11? What does that tell you?

      - Which MLB teams are partially owned by foreign investors? What are the main exports of those investors' countries? Notice a pattern yet?

      - Why is it that the Boston Red Sox hadn't won a World Series for 86 years until after 9/11? Still think it's a coincidence?

      The connections go on and on. Open your eyes, man.

      --
      Visual IRC: Fast. Powerful. Free.
    50. Re:props to Muslix64 and hackers everywhere by diablomonic · · Score: 1

      Baaa Baa Baaa. (theres your answers in a language you understand)

      --
      watch "the money masters" on google video
    51. Re:props to Muslix64 and hackers everywhere by Mr2001 · · Score: 1

      I hope you realize you're playing right into Bud Selig's hands.

      --
      Visual IRC: Fast. Powerful. Free.
    52. Re:props to Muslix64 and hackers everywhere by diablomonic · · Score: 1
      you know, I want to ask you a question. I know you think my post a while back with a list of questions re 9/11 etc on it is a stupid way to "argue" a point (ala Cartman) but did you actually research any of them even briefly? or have you done any similar research in the past? I put it in question form because convincing people of this stuff in writing form is very difficult, and really only happens when the other person is willing to do some of their own research anyway, so I may as well give any of those sorts of people some starting points and not worry about how "silly" it might look to someone whose (brainwashed(*)) world view makes the whole thing seem like complete nonsense.

      (*) this is not a (deliberate) insult to anyone. I don't know anyone who knows the truth about 9/11 who wasn't at some stage at least partly brainwashed, only to be "awakened" from it by finding the truth about one of these sorts of events. (yeah laugh all you want at my pretentious "awakened" comment, I don't mind. Hopefully one day it will happen to you).

      --
      watch "the money masters" on google video
    53. Re:props to Muslix64 and hackers everywhere by Mr2001 · · Score: 1

      I know you think my post a while back with a list of questions re 9/11 etc on it is a stupid way to "argue" a point (ala Cartman) but did you actually research any of them even briefly? or have you done any similar research in the past? Yes, I have encountered most of those "questions" in the past, researched them, and found them to be thoroughly debunked (Wikipedia is a good starting point). If they'd been less familiar, or if they'd all been on a single topic, I might have addressed them more seriously, but since it was just the same old conspiracy BS and it was all over the map, I thought I'd make a meta-point instead and get myself some +5 Funny while I was at it.
      --
      Visual IRC: Fast. Powerful. Free.
    54. Re:props to Muslix64 and hackers everywhere by diablomonic · · Score: 1
      how bout I go through them one at a time with you then and you can show me how they are debunked? because I've been researching this for along time and while the claims of "debunked" are many, the actual debunks are almost non-existant.

      - how many fighter jet scrambles to intercept commercial planes happened in the US in the year before 9/11? now this seems like an easy question, yet Popular mechanics completely deceives its readers in its so called "debunk" by stating that there was only 1... in actual fact there was on average more than ONE PER WEEK!: "# Not only were no NORAD intercept planes scrambled for well over half an hour after the first plane gave indications of trouble at 8:17 am, NONE were ever scrambled to defend DC and P-56, the most protected air space in the country.
      * Available planes in Canada were not scrambled, which regularly protect New York air space.
      * Available planes at Andrews AFB and Anacostia NAS proximate to DC were not scrambled.
      * Planes scrambled from Langley AFB, 130 miles south of DC, were sent to NYC and asked to confirm the hit on the Pentagon on the way there.
      * In addition, planes scrambled from Otis AFB in CT, sent too late to intercept the two NY attack planes, turned to intercept Flight AA77 headed to DC and were called back.
      * Fighter pilots from Pomona AFB in Atlantic City, NJ, on military maneuvers, within sight of the first tower burning in NYC were called back to base.
      * Planes in the air over North Carolina, based out of Andrews AFB were not tasked.
      Normal response time in over 65 other air emergencies in the year before 9/11, in far less serious
      circumstances, was an average of 6-10 minutes. On 9/11 the time stretched to over an hour.

      "

      see here for a rundown of the deceptions and lies in this "debunk": http://www.serendipity.li/wot/pop_mech/reply_to_po pular_mechanics.htm

      Now I would like to know your answer to this first question and one follow on one: (roughly) how many times in the year before 9/11 were planes in the US scrambled to intercept "wayward" aircraft? is this what the mainstream media tells you when "debunking" 9/11 CT's?

      (by the way, it was all over the map to give anyone interested more starting points, but again I can see how this looks to someone with said worldview, I just dont really care. Hell just pick one and address it?)

      --
      watch "the money masters" on google video
    55. Re:props to Muslix64 and hackers everywhere by diablomonic · · Score: 1

      oh and a source for the scramble figure is this, and another interesting critique is this

      --
      watch "the money masters" on google video
    56. Re:props to Muslix64 and hackers everywhere by Mr2001 · · Score: 1

      No thanks, I'm not going to waste my time cutting and pasting from other sites, especially answers to irrelevant questions like these. This is so typical of conspiracy theorists (and creationists) - obsessing over a bunch of details that are only vaguely related to the real issues, as if the tiniest little thing could simultaneously disprove The Government-Perpetuated Lies and prove The Truth They Don't Want You To Know, while overlooking the big, important questions such as:

      * How could a conspiracy of this scale be pulled off perfectly, with no leaks from the people involved and leaving behind insufficient evidence to convince any mainstream experts, by the same government that has proved itself 100% incompetent in every other field of endeavor?

      * If The Man is willing to sacrifice 3000 civilians and then cover it up in order to seize power, or whatever the supposed goal of this conspiracy is, then why haven't you been killed too, along with everyone else who's Exposing The Truth Behind The 9/11 Hoax?

      --
      Visual IRC: Fast. Powerful. Free.
    57. Re:props to Muslix64 and hackers everywhere by diablomonic · · Score: 1
      How could a conspiracy of this scale be pulled off perfectly - it wasn't, they failed to get the white house like they wanted because air force personnel decided to go ahead and shoot down the Pennsylvania jet. A whitehouse strike would have given them reason to justify martial law. I wont go into that but you could look it up if you were actually interested in this stuff rather than shooting your mouth off.

      with no leaks from the people involved - there are hundreds of whistle blowers, again you are just proving you ignorance. Problem is the MEDIA. the media ignores them all, preferring to lie to you. doesn't really matter how many people leak info if the main stream media wont publish it (and PUSH it not just hide it somewhere once).

      leaving behind insufficient evidence to convince any mainstream experts - Bullshit, there is tonnes of evidence, its just, yet again, the media WILL NOT publish it in any one place or make it well known, and constantly publishes lies and distortions which confuse "experts" into thinking they know there is "nothing to see here" when really they dont even know what the issue is.

      by the same government that has proved itself 100% incompetent in every other field of endeavor - Oh wake up and listen to what people say. Its not "the government".. it wasn't like this was an act of congress or something. This was people IN the government, acting on behalf of OTHERS (other groups/people) by utilizing their government contacts and connections: So it matters not at all whether this particular administration is inept or not, since only some members of it were "in on it", and they weren't acting within the normal (useless) government bureaucracy, but independently.

      If The Man is willing to sacrifice 3000 civilians and then cover it up in order to seize power - 3000 is nothing to them. the mindset is that civilians are worth LESS than military people (since they "cant even be bothered serving their country"), and look how much they care about thousands of them (soldiers) dying...its all greater good or just pure greedy don't give a shit mentality.

      then why haven't you been killed too, along with everyone else who's Exposing The Truth Behind The 9/11 Hoax? - oh this retarded comment again? I love maddox too, he's a funny bastard, but the 9/11 page was among his worst work. Why havent I been killed? Because I'm a nobody. A nobody who hasn't caused any problems for "them" yet. If they were to catch me in the process of becoming a somebody, and realise I might be a problem, or causing a problem while still a nobody, then I might have cause for worry. If I already am a somebody, then wiping all the "me's" out on a wide scale would be too suspicious, especially since they still control the media so it makes little difference anyway (plus I dont live in america). According to various polls the vast majority of americans think the government is at least not telling the full truth about 9/11, yet with the media covering it up, nothing happens. Its like superheating water in the microwave in a smooth sided dish: without a seed (the media pushing an issue) the water (population) wont rise up and explode and can get slowly raised above its normal boiling point. (plus the population has had 50 years of brainwashing and chemical doping to dumb them down, I dont even know if they CAN be fired up on a widescale level.)

      overlooking the big, important questions such as: - Those were your important questions? you're barely worth even responding to. Unprecedented scientifically impossible events on large scale and you're asking how some of the most powerful people in the world could organize something you already assume some fucken hobo in a cave can organize? you really just couldn't answer a single one of the questions could ya.

      --
      watch "the money masters" on google video
    58. Re:props to Muslix64 and hackers everywhere by Mr2001 · · Score: 1

      Unprecedented scientifically impossible events on large scale and you're asking how some of the most powerful people in the world could organize something you already assume some fucken hobo in a cave can organize? 1. They're only scientifically impossible if you ignore the testimony of scientific experts who have explained exactly how it happened.

      2. I'm not asking how you think they organized the actual attack. I'm asking how they managed to cover up an operation that would involve far more people than the official story, with none of them coming forward in the years since and saying "yeah, I planned the attacks". I'm asking how they managed to bribe or coerce the media and all the experts who have examined the evidence. That's the part that's hard to believe - a successful conspiracy and cover-up from some of the most incompetent people in the country.

      plus the population has had 50 years of brainwashing and chemical doping to dumb them down Chemical doping! Damn, dude. Save some of this for April 1st, otherwise you won't have any jokes left.
      --
      Visual IRC: Fast. Powerful. Free.
    59. Re:props to Muslix64 and hackers everywhere by diablomonic · · Score: 1
      testimony of scientific experts who have explained exactly how it happened.: doesnt exist. All I've seen is multiple vague completely unscientific rubbish handwaving style conflicting descriptions, all of which start with the assumption that the planes brought the towers down, and try to work out how (*) Hell they STILL havent released the report on wyc7 explaining in any detail how it fell. And the company they contracted to simulate the collapse was only contracted to look from the second highest floor down to the 7th floor, even though 1) THEIR initial report said the collapse initiated below floor 12, and 2) any controlled demolition of wtc7 would have mainly involved wiring the bottom floors (according to CD inc.). 1) says they are either complete morons or have a reason to ignore the most important part of the building, and 2) tells you what that reason is.

      how they managed to cover up an operation that would involve far more people than the official story, with none of them coming forward in the years since and saying "yeah, I planned the attacks". I'm asking how they managed to bribe or coerce the media and all the experts who have examined the evidence.

      the media is controlled from the top down by the very people that organised this in my opinion. Have a look at a documentary called "outfoxed" to see just how honest and free journalism is in todays mainstream media. Look up who owns each media conglomerate. Its not a case of every media person is aware and being kept silent, its that 90% are taken in by the bullshit they themselves are feeding us, and have never SEEN the proof and evidence, nor even really heard truly what all the fuss is about. They trust other (ignorant) media people to tell them whats going on, and this is a cycle of ignorance. Occasionally one or two realise something, even occasionally managing to publish something before getting fired, but on the whole, they 1) dont realise the full truth 2) dont have time to investigate for themselves 3) so they trust others to research for them, none of them actually delving into any real research 4) those that do just get written off as loons, CT nuts, crazies so forth. Even lifetime millitary officers, high level government insiders, International intelligence ministers, professors, etc have come out and simply been labelled loons. its a feedback loop: no one comes out who knows because those that do just get called loons and ignored, therefore almost no one knows, therefore anyone that comes out is called a loon and ignored by the majority that dont know. (and stop saying incompetant, not only is it an ACT, its not even the same people! bush junior didnt organise this. He most likely helped cover it up with his connections, but I'd bet George senior, and a whole bunch of others (called the illuminati by some) planned it, who "just happen" to be well represented in the government (mainly because they decide who gets to run for government, and now, who wins thanks to electronic voting).

      anyway, its all irrelevant. You are sitting on the jury in a murder trial, looking at the dna on the murder weapon and the video footage of the murder and going "but how did he get away with it? why does no one know? forgetting that YOU know, the people presenting the evidence know, and now, the rest of the jury knows

      as to chemical doping, look up what the nazi's and soviets used flouride in the water for (hint it wasnt to protect teeth). heres a link that just came up from a Google search that has some interesting info http://curezone.com/dental/fluoride.asp but I'd recommend you do your own research. then ask why something which makes people docile and lowers IQ is being fed to much of the population of the US (and other countries) (*)This is like starting from the assumption that the guy hanging from a rope by his neck died of natural causes, and trying to work out what those natural causes were..

      --
      watch "the money masters" on google video
    60. Re:props to Muslix64 and hackers everywhere by Mr2001 · · Score: 1

      You know, they called me a loon when I exposed Major League Baseball, too.

      Do you really think the Red Sox won that World Series all on their own? After 86 years? That's what I call a crazy conspiracy theory.

      Ever notice how the official story tries to frame Muslims for the 9/11 attacks--Muslims, who don't eat pork? Look at the hot dog connection. Follow the money.

      --
      Visual IRC: Fast. Powerful. Free.
    61. Re:props to Muslix64 and hackers everywhere by diablomonic · · Score: 1

      keep avoiding the issue with jokes and not answering my questions. You are the only one talking nonsense. Since you seem unwilling to actually hold an honest conversation, preferring to make jokes, lie, deceive and ignore pretty much everything I say, there doesn't seem to be much point continuing.

      --
      watch "the money masters" on google video
    62. Re:props to Muslix64 and hackers everywhere by Mr2001 · · Score: 1

      If the Major League Baseball explanation is really just a "joke", as you claim, then it should be easy for you to disprove it. But you haven't. So far my theory is looking a bit more plausible than yours.

      --
      Visual IRC: Fast. Powerful. Free.
    63. Re:props to Muslix64 and hackers everywhere by diablomonic · · Score: 1
      why? because you say it is? I gave you evidence, you gave me comedy.

      There have been no steel framed highrise collapses before from anything but earthquakes and CD EVEN THOUGH many have had FAR WORSE fires in them, burning for more than twenty times as long, and the collision damage was designed for. Since there was no earthquakes, the initial assumption SHOULD have been CD, since this is the simplest explanation which fits the evidence. It is not the politically correct explanation, but that is unimportant scientifically. It is not the simplest to accept but that is a psychological issue. It is the simplest because it introduces the fewest new (scientific) unknowns into the equation: we know CD works, it has been demonstrated many times before. We have NO idea how a "pancake collapse due to fire" or any of the half dozen other ludicrous theories given to us would work because THEY HAVE NEVER HAPPENED BEFORE. Its occams razor, it just doesnt work how skeptics think it works (its not the simplest to explain theory that is probably true, nor the simplest to accept. Its the simplest scientifically speaking, meaning repeatable, precedented, physically understood. Only if this theory can be proven/shown to be likely to be WRONG (for which an attempt should be made, and yet I have found no such proof) should you assume a less scientifically simple theory (like pancakes), and then you should try to repeat it to prove it's even possible (no the simulation didnt show that, they couldnt actually get it to collapse with realistic or extreme input values).

      remember that there are 3 events on the one day to explain here, for which there is no prior precedent except earthquakes (not present) and CD (witnessed by many, admitted by owner). Trying to sell a single event as some unprecedented event when there is a perfectly workable precedented explanation is silly, but 3 on the same day is bizarre, yet everyone buys it because 1) they are not engineers so many dont realise not only has this never occurred before, those buildings were designed to withstand the strikes, designed to withstand the fires, over-engineered greatly 2) they are told "ooooh scary jet fuel, very hot" by the media even though it is only kerosene, there was 1 litre of it or less for every tonne of concrete and steel per floor (ie it was gone very quickly without making much noticeable difference, even according to "official" sources), and it DOES NOT burn hot enough to heat the steel to weakening (let alone melting as witnessed by many) in the time frame and oxygen deprived situation present, nor could it have affected the 47 massive core columns noticeably (think giant 100 story heatsink being heated by a splash of kero). 3) they trust what they are told.

      By the way, im talking about what happened that day, not who caused it. thats an entire other issue, and is very unlikely to be as simple as "bush did it", and is likely to get even more eye rolling from you if I try to explain it without you even believing the first part (that it happened).

      --
      watch "the money masters" on google video
    64. Re:props to Muslix64 and hackers everywhere by Mr2001 · · Score: 1

      why? because you say it is? I gave you evidence, you gave me comedy. I gave you nearly as much evidence as you've given me (and my evidence hasn't been debunked repeatedly by experts). You haven't researched any of the questions I gave you, have you? I bet you think it's just a coincidence that the Red Sox won the World Series. Just like The Man wants you to think. Maybe if it was just one of those things, we could write it off as a coincidence... but the direction of turning, the number of planes that hit, and the hot dog connection? You'd have to be brainwashed not to see it.
      --
      Visual IRC: Fast. Powerful. Free.
  7. All DRM implementations will be broken. by MartinG · · Score: 5, Insightful

    DRM is fundamentally broken by design. Ciphers of this kind rely on the attacker not getting hold of the key. At the same time, the recipient needs the key to get the data. I can never work because the attacker is the same person as the recipient.

    In effect, DRM is security through obscurity.

    How much longer will we have to put up with this crap before the media companies realise this and stop inconveniencing their customers and wasting our money and time as well as their own?

    --
    -- MartinG To mail me: echo kewyjlcxyzvjfxbqwh | tr bcefhjklqvwxyz .@adgimnoprstu
    1. Re:All DRM implementations will be broken. by TheSpoom · · Score: 4, Informative

      Indeed. These guys should have listened to Cory Doctorow when he was talking at Microsoft. Unfortunately, it seems they didn't get it either.

      --
      It's better to vote for what you want and not get it than to vote for what you don't want and get it.
      - E. Debs
    2. Re:All DRM implementations will be broken. by mrsbrisby · · Score: 5, Insightful

      It can never work because the attacker is the same person as the recipient.
      That's why TPM is being pushed by DRM proponents: TPM means your computer no longer trusts you (its owner). It means that someone that can convince Verisign to sign their key will be able to have access to all your secrets- including the ones that you do not. It already happened.

      Forget all that jibber-jabber about whether they have a right to protect their "copyrights", or even if you have any rights to copy: they clearly cannot be trusted with your secrecy and your privacy.
    3. Re:All DRM implementations will be broken. by spellraiser · · Score: 4, Funny

      Or things could go in the opposite direction. Just wait 'till they hear about one-time pads!

      Of course, that would mean that no one could watch their stuff, period, but hey - at least no one could pirate it either!

      --
      I hear there's rumors on the Slashdots
    4. Re:All DRM implementations will be broken. by ArsonSmith · · Score: 1

      Just out of curiosity what would you consider security not through obscurity? Only one I can think of is living breathing security guards. Everything else is just a matter of obscuring the way to get into something.

      --
      Paying taxes to buy civilization is like paying a hooker to buy love.
    5. Re:All DRM implementations will be broken. by Tumbleweed · · Score: 4, Insightful

      And the problem with TPM is that you still have access to the hardware. If you've got that and enough time and skill, TPM eventually won't matter, either.

    6. Re:All DRM implementations will be broken. by Tumbleweed · · Score: 4, Funny

      You know, if they go for one-time pad encryption for only the most popular movies, then society would probably be better off. Hopefully they could implement that right at the source - Will Farrell and Ben Stiller themselves encrypted with one-time pads. Yeah, that'd about do it for me.

    7. Re:All DRM implementations will be broken. by tuffy · · Score: 3, Insightful

      Security not through obscurity would be akin to keeping the decryption key from a third party so that he'll have to try and use brute force to decrypt your data. Much like how web browsers use SSL to keep packet sniffers at bay.

      In the case of DRM, the guy who wants to watch the movie is the same person that the studios are trying to keep from decrypting it. So they try and hide the decryption key in the player so the owner can't find it. Thus, DRM always boils down to finding a way of obscuring the key's location in a big game of hide-and-seek.

      --

      Ita erat quando hic adveni.

    8. Re:All DRM implementations will be broken. by spun · · Score: 1

      It's a specific concept, different that just "obscuring the way to get into something." With security through obscurity, knowing the underlying implementation will grant you access, not just knowing the authentication factor. It's the difference between "The password must remain obscure or people will get into our system" and "The algorithm must remain obscure or prople will get into any system using it, regardless of the obscurity of the password."

      --
      - None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
    9. Re:All DRM implementations will be broken. by CastrTroy · · Score: 4, Informative

      Security through obscurity means that you hide the way your security algorithm works in order to make it seem more secure than it is. Take a safe for instance. Security through obscurity would be trying to hide how the safe was designed, and trying to stop the thief from touching the safe in order to prevent them from breaking into it. A safe that doesn't rely on security through obscurity means that you could give the plans to the safe, to show how it's made, and all the mechanisms inside, as well as give him free access to the safe to try to do a bunch of things with it, and you would still be sure that he wouldn't break into the safe, short of using brute force. Common encryption algorithms like RSA are believed to be secure, even though everybody already knows how they work. The only way people know to break them, is to try all the keys. This is like trying every possible combination on a safe, in order to open it. Instead of safes which aren't really secure, that you can break just by listening to the tumblers with a stethescope.

      --

      Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
    10. Re:All DRM implementations will be broken. by grumble_au · · Score: 1

      Between the truism about DRM being security by obscurity and the rather cool obfuscation of your email address in your sig I find this something of a zenlike post.

    11. Re:All DRM implementations will be broken. by MartinG · · Score: 3, Insightful

      Asymmetric ciphers are not security through obscurity as long as the key is not in the hands of the attacker. When used properly, the whole process is totally transparent and the attacker can see the encrypted data all day long and knows exactly how the system works but still can't get at the unencrypted data. It is not obscured at all.

      Security through obscurity is where the attacker has everything they need to get at the data but they just have a few hoops to jump through. Proper security is where the attacker has no chance because they are missing something (like a secret key)

      DRM gives the attacker the key (because the attacker is the owner of the media and they need the key to play it) but makes some attempt to hide it. All these attacks on DRM do not break the cipher or find a weakness in the crypto algorythm. All they do is find the key (it's in there somewhere) and use it to decrypt the content.

      --
      -- MartinG To mail me: echo kewyjlcxyzvjfxbqwh | tr bcefhjklqvwxyz .@adgimnoprstu
    12. Re:All DRM implementations will be broken. by tzhuge · · Score: 5, Funny

      Hmm... the logical conclusion is the MPAA needs site security in people's homes so they can prevent access to the hardware. They're probably working on it right now. Maybe some sort of USB powered taser would work?

    13. Re:All DRM implementations will be broken. by FireFury03 · · Score: 2, Interesting

      And the problem with TPM is that you still have access to the hardware. If you've got that and enough time and skill, TPM eventually won't matter, either.

      Presumably you don't even need access to the hardware - just emulate all the hardware (including the TPM) and you can poke around at the hardware's innards all you want then.

    14. Re:All DRM implementations will be broken. by bersl2 · · Score: 1

      Except that the TPM is designed to be tamper-resistent. How are you supposed to hack something like that, where the only unencrypted copies are inside the chips and not on the busses? Or do you think that the TPM concept is also fundamentally flawed (which I do not believe---morally flawed, yes, but technically sound)?

    15. Re:All DRM implementations will be broken. by Mercedes308 · · Score: 5, Funny

      I was thinking along the lines of having the hardware on a platform in the middle of an aquarium surrounded by sharks with fricken tasers on their heads.

      --
      And no, I couldn't give a shit what my karma is.
    16. Re:All DRM implementations will be broken. by Dunbal · · Score: 1

      If you've got that and enough time and skill, TPM eventually won't matter, either.


            Not to mention the fact that someone is going to realize there is going to be a _HUGE_ market for NON TPM boxes...

      --
      Seven puppies were harmed during the making of this post.
    17. Re:All DRM implementations will be broken. by jridley · · Score: 2, Insightful

      Emulate the hardware, or monitor the chip internals. It's been done before; many of the satellite TV hacks were discovered by people that drilled/dissolved the plastic off the chips and probed the internals.
      Access to electron microscopes is pretty widespread too. Lots of university students can get access to them.

    18. Re:All DRM implementations will be broken. by Anonymous Coward · · Score: 0

      Huge = 2-5% of the market, probably. People just on the MicroSoft teat as they would on the McDonald's teat.

    19. Re:All DRM implementations will be broken. by dpilot · · Score: 3, Informative

      I wouldn't be quite so optimistic. The difference is that at least some of the people involved in crafting TPM know something about security, as opposed to the people doing DRM and touch-screen voting machines. There has been quite a bit of art and work involved in developing tamper-resistant chips, and at least some of the TPM implementations use this art.

      Of course the devil is in the details. It's fully possible to build an insecure system around a secure TPM chip, and no doubt that's going to be done, too.

      Then again, TPM isn't bad, on it's own. It really depends on who owns the TPM. As long as I own it, it just might be good. The moment someone else owns it, then I merely pretend to own my system that has it, and that's bad. Some time ago, I picked the (M) stuff for the kernel build on my Thinkpad, and have been building them ever since. I've never used them yet, but if SOMEBODY is going to be controlling that chip, I want it to be ME.

      --
      The living have better things to do than to continue hating the dead.
    20. Re:All DRM implementations will be broken. by hardburn · · Score: 1

      Tamper resistence is useless when the attacker has a limited time to try to break the device. For instance, ATM design docs often list requirements such as "an attacker should need no less then 20 minutes with a hacksaw and a screwdriver to break open the keypad".

      When the time and tools you have to spend on the project are unrestricted, no ammount of tamper-proofing can stop you. The only choices are:

      1. Make it hard enough that people will give up
      2. Destroy the device

      Destroying the device is common in military applications (such as loading encryption equipment with thermite charges), but is likely too dangerous for consumer products.

      --
      Not a typewriter
    21. Re:All DRM implementations will be broken. by bill_kress · · Score: 4, Insightful

      Perhaps the inclusion of TPM in later OSes, chipsets and hard-drives will spur adoption of Linux (which presumably would just not enable such garbage).

      Perhaps TPM is going to be one of the best things to ever happen to our community...

    22. Re:All DRM implementations will be broken. by nurb432 · · Score: 1

      But i would imagine that the 'solution' will never filter down to the common man as it will be so complex only a few of us will be able to control our own hardware at that point. ( such a small amount they wont care anymore )

      Then the industries wil have 'won', and freedom will have 'lost' ( since this is much larger then just being able to watch a DVD, its about the basic rights of freedom of information ).

      --
      ---- Booth was a patriot ----
    23. Re:All DRM implementations will be broken. by AeroIllini · · Score: 2, Informative

      And the problem with TPM is that you still have access to the hardware.

      No, the problem with TPM was that lousy Jar-Jar character. He had more than enough jibber-jabber.
      --
      For security, the MD5 hash of this message and sig is 09f911029d74e35bd84156c5635688c0.
    24. Re:All DRM implementations will be broken. by Poruchik · · Score: 1

      Security by obscurity means is trying to prevent the thief from finding out the safe exists, while all the safe related data is freely available.

      --
      $signature =~ s/$signature//;
    25. Re:All DRM implementations will be broken. by h4rm0ny · · Score: 1


      Agreed, there is potential good use to be had of TPM. But really physical ownership of it is not the issue. That's clearly the case as when you buy a computer with TPM you will legally own it, no questions. What you're really talking about is who gets to decide what use is made of it. And that comes down to the balance of power between the seller and the buyer. What TPM does is open a new option for the one with power to abuse the one without. In this case, and for now, that appears to be the seller.

      --

      Aide-toi, le Ciel t'aidera - Jeanne D'Arc.
    26. Re:All DRM implementations will be broken. by dpilot · · Score: 1

      You know, you've got something here!

      If nobody can read the DVD anyway, we could really cut down on production costs. "dd if=/dev/urandom of=/dev/dvdrw bs=1M count=4700"

      --
      The living have better things to do than to continue hating the dead.
    27. Re:All DRM implementations will be broken. by Anonymous Coward · · Score: 0

      that kb article does not apply to windows xp.
      maybe b/c the article is so OLD!
      (but it does apply to evrything else since win95)

    28. Re:All DRM implementations will be broken. by FlopEJoe · · Score: 1

      Shows what I know... I thought the problem with TPM was Jar-Jar.

    29. Re:All DRM implementations will be broken. by jwhyche · · Score: 0

      Haven't they not already gone this way? I think the mpaa have come up with a perfect way to prevent people from pirating their shit. They just start making crap so bad that no one will watch it, much less pirate it. I mean, Snake on a Plane? Please.

      I thought of this when I noticed that my Netflix queue was full of anime and forgien films instead of Hollywood shit.

      --
      I read at +2. If your post doesn't reach that level I will not see or respond to it.
    30. Re:All DRM implementations will be broken. by Tumbleweed · · Score: 1

      No, the problem with TPM was that lousy Jar-Jar character. He had more than enough jibber-jabber.

      As much as I hated Jar-Jar, there was a *hell* of a lot more wrong with TPM than just him.

      At least it had a truly *great* lightsabre battle in it.

    31. Re:All DRM implementations will be broken. by Tumbleweed · · Score: 3, Insightful

      But i would imagine that the 'solution' will never filter down to the common man as it will be so complex only a few of us will be able to control our own hardware at that point.

      Well then *fuck* the common man. If you're too stupid to be free, that's not my problem.

      I guess only the smart people get to be rebels. The rest will just be rabble.

    32. Re:All DRM implementations will be broken. by tfinniga · · Score: 2, Informative

      So, like some of the other posters mentioned, the confusing part is security through obscurity vs. using secrets.

      It can be shown that if two people know a secret, they can exchange information over a common channel, and eavesdroppers can't decrypt the message without trying every possible secret. This is somewhat like sending a safe through the mail - anyone intercepting packages at the post office would have to try every possible combination to get it open. Even if they knew the design of the safe. Even if they had helped design the safe.

      A real-world example of this is the design of the ATM: The author used public-key encryption so that even if he were trying to break the encryption, he wouldn't be able to. While he made the design, he doesn't know the secret key.

      The reason such strong encryption can't be used on DRM is because they have to give you the secret. It's like giving you a safe, giving you the code, and then telling you that you should only open it in certain circumstances.

      --
      Powered by Web3.5 RC 2
    33. Re:All DRM implementations will be broken. by dpilot · · Score: 1

      Actually, there's nothing at all wrong with using obscurity as part of your toolkit for security, as long as the rest of your toolkit is good. Security through obscurity gets a bad name in cryptography, because cryptography is HARD, because it takes some heavy-duty analysis and expert review to get it right, and primarily because the people who try to practice don't really know squat about what they're trying to do, and do it badly.

      Now imagine a well-designed safe (or cryptographic algorithm) where you've kept all of the details secret, and let someone try and crack it. Simply knowing the design (or algorithm) gives you the starting point for the attacks.

      The whole issue is "well-designed," and how well that can really be done without expert peer review. But assuming you could really hit that target, the less revealed the safer you are.

      --
      The living have better things to do than to continue hating the dead.
    34. Re:All DRM implementations will be broken. by dpilot · · Score: 1

      What it really comes down to is some sort of "TPM ownership utility" that people can run on their new computers. The utility evaluates whether I control my TPM, or someone else. But here comes the important part...

      People need to be educated that they need to control their TPM, and if they don't they should return the PC for refund because "it's broken." This can be intuitive, that "It's mine and I should be able to control it," and "If it's not mine because I can't control it, something is wrong with it."

      So the biggest need right now in the DRM fight is a "TPM evaluation utility," and a public relations campaign.

      --
      The living have better things to do than to continue hating the dead.
    35. Re:All DRM implementations will be broken. by Em+Adespoton · · Score: 1

      In other words, the difference is between making key information difficult to understand how to use and withholding information necessary for use. In security through obscurity, all the information required is present, just not easy to understand. With withholding, you have to guess what the missing information might be.

    36. Re:All DRM implementations will be broken. by Bocconcini · · Score: 1

      That's why TPM is being pushed by DRM proponents: TPM means your computer no longer trusts you (its owner). It means that someone that can convince Verisign to sign their key will be able to have access to all your secrets- including the ones that you do not. It already happened.

      This is actually exactly what is happening with Symbian OS 9.0 and Platform Security. Several layers of protected functionality and naturally DRM is on the most secure one. Good luck trying to get the hardware vendor to sign your media player application which plays DRM-enabled files.

      I am quite sure that Symbian OS 9.0 is spelling the eventual death of Symbian environment as it will be replaced by Windows and Linux based operating systems.

    37. Re:All DRM implementations will be broken. by Tumbleweed · · Score: 1

      Yeah, the Jar-Jar problem kind of overshadowed the problems like Annakin, the directing and the writing.

      Still, cool lightsabre battle there at the end, eh?

    38. Re:All DRM implementations will be broken. by radtea · · Score: 4, Interesting

      Of course the devil is in the details. It's fully possible to build an insecure system around a secure TPM chip, and no doubt that's going to be done, too.

      Unless you change the laws of physics it is completely impossible to build a secure TPM chip. TPM is an inconvenience, nothing more, just like DRM. DRM, no matter how implemented, involves supplying the same person with:

      a) the ciphertext
      b) the plaintext
      c) the decryption key

      All of those things must be present on the user's system for DRM to work. TPM etc are merely means to try to make it hard for the user to access the key, and they never work. One way of thinking about it is: a TPM chip "hides" certain details inside a little bit of plastic. It is security through obscurity and nothing more, and so long as the chip emits any EM radiation the internal details will ultimately be inferable, although it is doubtful that going so far as reading internal bits via EM fields will be required.

      But if it is, we can all take comfort in the fact that Maxwell's equations aren't just a good idea: they're the law.

      --
      Blasphemy is a human right. Blasphemophobia kills.
    39. Re:All DRM implementations will be broken. by Joe+The+Dragon · · Score: 1

      another problem with Destroy the device is that hackers will try to trigger it to perform a DOS attack.

    40. Re:All DRM implementations will be broken. by mrchaotica · · Score: 1

      Emulating the TPM requires knowing the Trusted Computing Group's (or whoever's) private key. If you know that, you're already done.

      --

      "[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz

    41. Re:All DRM implementations will be broken. by Chris+Burke · · Score: 1

      I wouldn't be quite so optimistic. The difference is that at least some of the people involved in crafting TPM know something about security, as opposed to the people doing DRM and touch-screen voting machines.

      I'd be optimistic. radtea had the theoretical reasons why it will never work down. Like I learned in school, cryptography is about Alice sending Bob a message that Charlie isn't supposed to read. Except with DRM, Bob and Charlie are the same person, which pretty much breaks the entire basis. So you have to go through all this trickery with the hardware to let Bob view the message, but then treat him like Charlie and do so without giving him the key to view the message on his own terms.

      And yes, there are very smart security people working on TPM. I happen to know a couple such people working on the hardware side of things, and they also agree with the fundamental premise in my first paragraph, which is that TPM can never truly do what it sets out to do. All they can do is what every other DRM scheme has done -- try to make it annoyingly difficult for casual non-tech piracy. There will come along a person or group of persons with the means, and the will, and who will see "annoyingly difficult" as "interestingly challenging" and then that's all she wrote.

      --

      The enemies of Democracy are
    42. Re:All DRM implementations will be broken. by dpilot · · Score: 3, Insightful

      It's merely a matter of making it hard enough to stop most attacks. By the time you're sniffing on-chip signals with RF, you're way past "most". By the way, on really good secure chips there's a heck of a lot more to the package than "a little bit of plastic." Some "secure chip" packages are designed to keep the chip from being de-packaged, or to at least guarantee that the chip will be "correctly" damaged in the de-packaging process.

      I don't doubt that with a complete lab and some really good hackers, a even well-designed TPM setup can eventually be compromised.

      But I'd also assert that a well-designed TPM setup is WAY beyond the resources of DVD John, the AACS crackers, and maybe even the distributed.net efforts.

      By the way, by that last token, all security is by obscurity, because you're always hiding the key, and ultimately that's a key part of what the TPM does.

      A few quick searches on TPM can strip away most of the arrogance on both sides, the "anything will fall" side as well as the "unbreakable" side. I can't substantiate it here and now, but I suspect that TPM can be good enough to defeat any software-only attack, and would really require significant hardware resources to compromise.

      But the key point in here is a general lack of confidence in the ??AA's ability to do good encryption/DRM. At the moment, they just don't have the mindset for it.

      --
      The living have better things to do than to continue hating the dead.
    43. Re:All DRM implementations will be broken. by spyfrog · · Score: 2, Funny

      Cool. You have solved the cooling problem to...

    44. Re:All DRM implementations will be broken. by amRadioHed · · Score: 2, Interesting

      BTW, that sounds like it would be an awesome case mod for all the overclockers out there. Maybe someone at MIT could turn the whole ocean tank at the New England Aquarium into a supercomputer!

      --
      We hope your rules and wisdom choke you / Now we are one in everlasting peace
    45. Re:All DRM implementations will be broken. by Trogre · · Score: 1

      Forgive me but that's a rather naive position.

      What will you do if/when TPM is implemented on the die of every commercial CPU produced? Start making OSS processors? We all know how well that's worked out so far.

      I don't really think we can just ignore this, it has to be stopped now.

      --
      "Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
    46. Re:All DRM implementations will be broken. by JohnFluxx · · Score: 3, Informative

      Just FYI, use of an electron microscope is pretty cheap too. I'm charged £35 ($70) an hour.

    47. Re:All DRM implementations will be broken. by gdamore · · Score: 2, Insightful

      TPM is just a way of saying "secure key store". Given a TPM (and put it in the TV display, rather than in the player), it is pretty much possible to secure stuff so that the only way to break will require a high degree of sophistication and an electron scanning microscope. (And in some cases, even that might not be good enough. At very high levels of security devices are shielded against most or all forms of radiation, and removing the shield erases the key store. This is called "active countermeasures" in FIPS 140-2, IIRC.

      TPM is like a powertool. It can be used for great good. It can also be used for great evil. Which it does depends on whose hands it is in.

      (TPM, or similar approaches are very, very useful for things like secure transaction processing, digital security, platform assurance (i.e. guarantee that your OS load hasn't been compromised with a keylogger), and similar things.)

      TPM can also be used to secure media delivery. However, in order to really prevent sophisticated pirates from stealing the HD content, the _entire_ data path must be encrypted. This includes all the electrical signaling up to and including the pixels themselves.

      Then the next level of sophistication will be when somebody figures out how to use some kind of high-speed CCD or somesuch to capture the individual pixels on a high-resolution display. Of course the kind of gear required to do this would really only be worthwhile to large-scale commercial pirates -- and I wouldn't be surprised to find if _those_ guys also tried to protect the data stream against copying -- after all their illegal copies represent an income stream for them as well! (Though lacking keys, it might be hard for them to do so.

      TPM properly done can certainly prevent casual piracy.

      The best solution to this whole problem is not to purchase DRM'd content if you care about this kind of thing. Or, just accept that when you buy a physical copy of the media, you're pretty much going to have to accept the limitations of using just that media.

      As to the concern about the fact that some studios put un-skippable ads and such on the media -- well, wait for reviews, and if it bothers you that much, don't buy the media. If enough people vote with their wallets then studios will figure it out, eventually, and give people what they want.

      Oh, and one more thing, nobody should assume that they have a God-given right to watch whatever movies or listen to whatever songs they want. The distribution companies are not legally obligated to make this content to you in the first place (in any form), after all.

      It ticks me off when people bitch and complain about DRM and such, and then go pirate stuff. If it bugs you, don't access the content at _all_. Your time would be better spent writing letters to your legislators and the media execs than stealing/borrowing/pirating (or whatever you want to call it) content that you have no legitimate right or need to access. Or even better yet, spend some time and money finding alternative content that fits with your ideals. (I think even more than lost sales, sales lost to a competitor will appeal most strongly to media execs.)

    48. Re:All DRM implementations will be broken. by Kjella · · Score: 2, Interesting

      That put security by obscurity in a very bad light. First of all, there's the "security by non-locateability", if you couldn't find the safe you couldn't break into it. Now, there's two ways of doing this - one is to have a well hidden safe which is using obscurity as an extra safeguard, the other is a hiding place which relies on security by obscurity. Secondly, you have "security by non-reproducability" which is for example custom tripwire systems and the like. Unless you know what it triggers on, you don't know how to avoid it. However, this kind of security is completely moot if you can pick up a similar item on any street corner, pick it apart and see how it works. It also relies on the implementer having a clue and on the attacker only having a limited number of attempts.

      Basicly there are many good reasons security by obscurity works when you're trying to guard off a few unique installations like military bases or valuable servers, temporary information like troop movements, covert information like recon capabilities and such. Everything from the classification system to camouflage suits is security by obscurity - you'd be just as dead in a pink bunny suit as army green if the bullet hit you wrong. Hell, even body armor probably counts because it only makes the vunerable parts more obscure to hit.

      However, most of all security by obscurity isn't good to hide a system. If I see one military unit moving, it's a small piece of tactical information. If I from that could deduce how every other military unit was moving, it'd be a disaster. Particularly with computers, which you can poke and prod until you've figured out how it'd respond to almost anything. If they try to ban software players (I'd like to see them try when HTPCs, Windows Media Center and FrontRow is taking off), it'd still be picked apart because one break can decrypt every disc since the last break, it's like a jackpot that keeps growing. Right now it's reset and won't start counting again until the keys are revoked. But the higher the number of movies get, the more effort someone will put into it. Even with the most tamper-resistant TPM chip around, I think there'll always be someone...

      --
      Live today, because you never know what tomorrow brings
    49. Re:All DRM implementations will be broken. by Surt · · Score: 1

      Not to mention the fact that someone is going to realize there is going to be a _HUGE_ market for NON TPM boxes...

      Slight typo there, you forgot the word 'black' in 'black market'.
      Non-TPM boxes will be illegal.

      --
      "Who is the Journal of Quantum Physics going to believe?" --Stephen Hawking
    50. Re:All DRM implementations will be broken. by amRadioHed · · Score: 1

      Yeah, *fuck* all those stupid rabble. If those people, like cancer researchers and their ilk, don't have the time to be Linux geeks they get what they deserve.

      --
      We hope your rules and wisdom choke you / Now we are one in everlasting peace
    51. Re:All DRM implementations will be broken. by olman · · Score: 2, Informative

      But I'd also assert that a well-designed TPM setup is WAY beyond the resources of DVD John, the AACS crackers, and maybe even the distributed.net efforts.

      Just one good example here.. Xbox 360. It's been out for a while and the DRM is still essentially there. Except that games can be COPIED. But forget about playing that "backup" of brand new R1 game in your R2 console, pardner. Region codes are NOT hacked.
      Neither is requirement for signed code.

      So what the modchips essentially do is hack the dvd drive to give "we're good here" response to appropriate media query, but you need 1:1 copy of the original media to pull that off or the signature won't match.

      No media center for X360, thought. XNA program does not let you do it even after you fork out $99/year for the privilege because XNA progs cannot use network (and access your huge collection of dvd rips and mp3s)

    52. Re:All DRM implementations will be broken. by alphamugwump · · Score: 1

      I think you were thinking of quantum cryptography. A one-time pad is only as strong as the random number generator used to create it. American cryptanalysts were able to break russian diplomatic communications from the cold war because they used a crappy random number generator.

    53. Re:All DRM implementations will be broken. by Splab · · Score: 2, Insightful

      You only need to be compromised once and you have lost the game here.

      When the keys are out in the wild the content can be ripped, zipped and shipped. (Yeah they use rar, but this sounded cool :D)

    54. Re:All DRM implementations will be broken. by Tim+C · · Score: 1

      Except that the TPM is designed to be tamper-resistent. How are you supposed to hack something like that, where the only unencrypted copies are inside the chips and not on the busses?

      At some point, the signal is unencrypted; it has to be in order for the viewer to be able to understand it. If TPM actually is impossible to circumvent (and if it is, I'll buy a hat and eat it), then you can attack the monitor/TV, intercepting and recording the signals to the panel or even the individual transistors. If that's too much hassle, just point a high quality camera (on a tripod) at a high quality panel and record it that way.

      DRM can not work. All it can do is make it harder to copy the content, it cannot render it impossible.

    55. Re:All DRM implementations will be broken. by TheSpoom · · Score: 1

      The answer they would give you to that is that, ideally, you won't have access to the hardware. Think of next-generation TPM computers as a titanium black box with internal sensors that detect anything attempting to access the inside and destroying the contents upon detection. Not to mention that the TPM chip itself will be hidden inside the CPU, which will have its own access controls. Check out the TCPA FAQ for details (rather old, but still relevant to the basic points).

      BTW, I don't think this sort of paranoid computing will actually take off. I have a little more faith in the free market than that.

      --
      It's better to vote for what you want and not get it than to vote for what you don't want and get it.
      - E. Debs
    56. Re:All DRM implementations will be broken. by Anonymous Coward · · Score: 0

      It'll be a long while before that happens, when you've got idiots saying "it's great now that it's broken there'll be lots of free stuff to download'. They should f**king grow up and realise you can't have your cake and eat it too. It's people like them that ruin it for the rest of us.

      Hopefully if the music labels start ditching DRM, the movie studios will follow. You'll always have people who will pirate stuff, but there'll always be people willing to buy stuff too. In an ideal world, we'd all be informed enough to vote with our wallets and be very clear on why we're doing so.

    57. Re:All DRM implementations will be broken. by SiliconEntity · · Score: 1

      Perhaps the inclusion of TPM in later OSes, chipsets and hard-drives will spur adoption of Linux (which presumably would just not enable such garbage).

      Actually, most work on the TPM is being done on Linux. See Trousers, Trusted Grub, TPM Device Driver, Enforcer, OSLO, etc. Not to mention that open-source Xen supports virtualizing the TPM and is aiming at TPM-based trusted boot functionality.

    58. Re:All DRM implementations will be broken. by Tumbleweed · · Score: 1

      The problem is that it has to output the video/music/whatever at some point. It's only unbreakable if you're trying to prevent access. They want people to be able to view the movies without being able to copy them, but if they can be viewed, they can be copied, one way or another. If you can figure out what the output is, and you have access to the encrypted form, eventually someone will be able to crack it, whether it's embedded in inaccessible hardware or not, *especially* when you have keys that are, at least for now, accessible. Plus you have multiple encrypted content that can also be viewed (multiple movies, all of which work with the currently-accessible key). It's only a matter of time until this scheme is broken, and I suspect it will be much sooner rather than later.

      This seems to be rather like some weird version of the game Master Mind. You know what the scrambled input is, but you also know what the output is supposed to be. You now have a key to the lock (at least for now), so you just need to figure out the innards of the lock mechanism itself.

      Anyone who keeps up with the protection history of the Sony PSP knows what the outcome of this battle will be. It's inevitable.

    59. Re:All DRM implementations will be broken. by cortana · · Score: 1

      Hm, do you have any details about this for the lazy reader? I always wondered why you couldn't just emulate the TPM...

    60. Re:All DRM implementations will be broken. by Anonymous Coward · · Score: 0

      Yep. It costs $100 to build a scanning tunneling electron microscope from commonly available parts. Strip the encapsulation off the "trusted" chip (use acid). Use the STM to read off the pattern of transistors. I gather the STM can even be used to read off the pattern of electrons from a flash memory, giving its contents. Reverse engineer the circuit, along with all its secrets. It'd be less trouble though to just create some new media and put the RIAA and its members out of business. But it *is* possible to reverse engineer anything.

    61. Re:All DRM implementations will be broken. by radtea · · Score: 2, Informative
      It's merely a matter of making it hard enough to stop most attacks.

      Nope--it's like the IRA said to Mrs. Thatcher: "To stay alive you have to get lucky every time. To kill you we only have to get lucky once."

      And real security isn't through obscurity: it is through physical denial of access to the decryption key. What even hardened TPM chips do is more akin to handing a user a safe with the key inside, and giving them unlimited time and all the resources they feel like using to open it. Grad students with access to x-ray micrographs, people who like to solve near-field problems...

      Additionally, here's a nice summary of one of the many non-physical reasons why TPM is not secure:

      There is a risk of serious data loss in the event that a TPM security chip or hard drive is corrupted or if a user leaves the organization. For example, organizations may need access to a former employee's encrypted data or TPM-secured keys for disaster recovery purposes. The archive and recovery of keys protected by the Trusted Platform Module security chip is vital for all businesses and especially those needing to retain access to encrypted data for a predetermined time. Security and data integrity must be maintained while ensuring proper archive procedures and recovery by someone other than the original user. Additionally, transferring data to a replacement PC requires an enterprise-level process for transferring the appropriate TPM-secured application keys.

      Ergo, some users must ultimately have access to keys to ensure failure recovery. Given everything we know about users, it would be ill-advised to bet against breaches driven by user behaviour even if the physically impossible were achieved and someone was able to make the hardware genuinely secure.

      I can just see the headlines in 2010: "Intel Admits TPM Keys Leaked"
      --
      Blasphemy is a human right. Blasphemophobia kills.
    62. Re:All DRM implementations will be broken. by gordgekko · · Score: 1

      Nope--it's like the IRA said to Mrs. Thatcher: "To stay alive you have to get lucky every time. To kill you we only have to get lucky once."


      That quote probably would have been more effective if the IRA had actually managed to get lucky once.
      --
      You want to know who isn't running Firefox 2.x? They spell it "definately" and "rediculous".
    63. Re:All DRM implementations will be broken. by Anonymous Coward · · Score: 0

      Perhaps the inclusion of TPM in later OSes, chipsets and hard-drives will spur adoption of Linux (which presumably would just not enable such garbage).


      It's easy to implement TPM in a way that only a signed OS will be allowed to boot on the system.

      If you, a user, compile the OS yourself, the resulting binary will not be signed.

      Which means you can only run binary kernels that come signed from the vendor. If you're lucky, RedHat will pay Verisign (or whoever) so they can sign the kernels they distribute. But what if you want to compile the kernel yourself to make sure there are no trojans? What if you want to run OpenBSD? (It's a safe bet that Theo will never sign on this TPM crap.)

      The only "good" way for TPM to behave is if the owner of the machine -- not Micros**t, not the MPAA or RIAA, not the Federales -- can decide which signatures are OK. And that's something you can be sure will not happen.
    64. Re:All DRM implementations will be broken. by mrchaotica · · Score: 1

      Well, first of all I'm not an expert, so anything I say might be incorrect. Nevertheless, I'll try to explain:

      It's like public-key cryptography. The TPM has a code (aka "private key") inside it that you don't know, but that Microsoft or the Trusted Computing Group or whoever does. They can send the TPM a message such that it needs that key to construct a proper response, and thereby tell whether the TPM is real or not. Unless you have that key (which you can only get from the Trusted Computing Group, AFAIK), you can't emulate a TPM.

      --

      "[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz

    65. Re:All DRM implementations will be broken. by TheLink · · Score: 1

      Mrs. Thatcher obviously didn't rely on luck.

      --
    66. Re:All DRM implementations will be broken. by Mr2001 · · Score: 1

      Your time would be better spent writing letters to your legislators and the media execs than stealing/borrowing/pirating (or whatever you want to call it) content that you have no legitimate right or need to access. My right to access a song or movie is every bit as "legitimate" as my right to access the digits of pi or the speed of light. It's information. I don't need it, I won't die if I can't have it, but no one else has a right to tell me that information is off-limits. Not even the heirs of the people who calculated the digits of pi or the speed of light can prevent me from using that information; why should the people who recorded a song or movie be any different?
      --
      Visual IRC: Fast. Powerful. Free.
    67. Re:All DRM implementations will be broken. by TheLink · · Score: 1

      They don't have to give you the secret you know.

      I'm not claiming that the following is how AACS works because it isn't.

      But all they need to do is encrypt a random media specific secret with the public keys of the various players and stick the result on the media.
      Each player then uses its own private key to access the media specific secret.
      The player then decrypts the media with that secret.

      To aid with the detection of which player was compromised they could have potentially different scenes/frames encrypted with different media keys, and players are to skip/ignore scenes which they can't decrypt.

      If it is detected that a player is compromised, publishers/creators are to not use that player's public key to encrypt the media key in future media, or they alter/degrade content for that player.

      The problem with this approach is that it involves a lot more work and cooperation from the creators and publishers, and it also requires players to have enough grunt to do public key crypto for scenes.

      And it doesn't stop the problem of what happens if thousands of players have their keys revoked. Sure you could in theory reissue new keys and update the affected legitimate players, but who pays and would it be practical? Having thousands of people return their hardware players is a problem. If it really saves/makes the Industry more money then they should be able to afford to pay for it all and throw in sweeteners. But I bet that won't happen. You can do the same thing for TPM, you have the same problem though when it comes to revocation time.

      Finally, it'll still be fairly easy for people to crack the video and audio output bit (does HDCP have stuff that makes it easy to detect which device was used?). All the attacker needs do is keep buying players and returning them for a refund or a different player (by that time the shop may have got used to complaints of "This player plays Movie X, but not Movie Y").

      So strong encryption can be used on DRM.

      It's more like people _paying_extra_ for a safe that's designed to only allow them to watch their movie through a thick bulletproof glass window in that safe. They aren't allowed to open that safe or tamper with it in anyway.

      Why should people pay extra for all that?

      If DRM really was effective AND those piracy losses are real, the movie industry should be confident enough to subsidize players.

      As it is, most people will be happily and obliviously buying Vista etc.

      --
    68. Re:All DRM implementations will be broken. by Jewfro_Macabbi · · Score: 1

      TPM won't work either. Hardware hacking is old news. Consider the battle between satellite TV hackers and the dish companies. When access cards were compromised, the company responded by building access cards into the receiver (some with so called tamper-resistance), and of course those have been hacked also...

    69. Re:All DRM implementations will be broken. by Crunchie+Frog · · Score: 1

      TPM can also be used to secure media delivery. However, in order to really prevent sophisticated pirates from stealing the HD content, the _entire_ data path must be encrypted. This includes all the electrical signaling up to and including the pixels themselves.

      You mean i need to decrypt the signal somewhere between the surface of the view screen and my brain? Thats gonna be an issue...
      --
      --- Never attribute to malice that which can be adequately explained by stupidity
    70. Re:All DRM implementations will be broken. by Anonymous Coward · · Score: 0

      Then again, TPM isn't bad, on it's own. Yes it is.

      It really depends on who owns the TPM. As long as I own it, it just might be good. Then, by definition, it is no longer TPM.
    71. Re:All DRM implementations will be broken. by andy_t_roo · · Score: 1

      true random one time pads are made from random noise (radioactive decay, random thermal noise in electronics, ....) that noone else would have access to. The problem is then shipping it over to the destination.

      you are talking about psudo-one-time-pads, using a seeded PRNG. The main problem with most PRNG is that they have a small key and once you have watched a small amount of the output (guessed a small amount of the encripted text) you can predict the rest.

      I have come across several PRNG that have a relatively simple implementation, but which have a large enough key space and repeat time that any sort of probabilistic attack is not feasible. (see ISAAC : http://www.burtleburtle.net/bob/rand/isaacafa.html ) - it has a key space of over 10^2000 (the number of atoms in the universe times the number of milliseconds the universe is likely to be in existence is about 10^100). The only known attack requires access to many megabytes of output from the generator, and means you only need to check the sqrt of the number of keys (10^1000 keys). baring a mathematical breakthrough there is essentially no chance of messages encrypted with ISAAC generated one time pads this side of the heat death of the universe without the key being given to the person doing the decrypting.

    72. Re:All DRM implementations will be broken. by Anonymous Coward · · Score: 0

      Exactly. There is no such thing as complete security. I worked for a government spook house (yes, those people you kids put tin foil hats on to hope you can surf the net anonymously --no you can't--). The first thing my first briefing session was discussed the fact that there is no perfect security. Its all breakable with time. The super secret stuff (if in the wrong but oh so capable hands), perhaps a month, maybe two. The medium secret stuff --couple of days, maybe even a week--, the low security stuff-- couple of hours if you are lucky. Bundling all the stuff you need to break the code onto each disk means looking for it a bit. Its easier than normal cryptography, and with enough people (and on the net, thats a lot), the work of several hundred gets shredded in a few weeks. The economic incentive to break the drm is bigger than the incentive to put it in place. From an economics perspective, breaking drm is inevitable. From a cryptographic one, obvious. From a haxOr perspective, a challenging puzzle with street cred rewards, and from a civil liberties/fair use perspective, a noble deed. The **AA's call it bad, but they aren't considered knights in shining armor by most of the groups I've mentioned.

    73. Re:All DRM implementations will be broken. by rew · · Score: 1

      And the problem with TPM is that you still have access to the hardware. If you've got that and enough time and skill, TPM eventually won't matter, either.

      Not true. TPM can and should hold a key inside some tamper resistant module. The key should NOT ever leave the module. The module will destroy the key when tampering is suspected.

      So, a modern computer, where the CPU doesn't have any ROM (Code + key) onboard, does NOT satisfy the requirements.

      Suppose we take an Atmel AVR CPU. It can be programmed not to divulge a key it holds. You could then ask it to decode a volume key. However before it gives this decoded value, it should determine that the entity it divulges the key to is also trusted. This is is extremely difficult to guarantee.

      The TPM model, applied to hardware players and HD monitors works. Monitor and player are both designed to destroy their key when tampered with. Both use public key cryptography to determine the validity of the other side, so they allow setup of an encrypted link.

      DRM becomes extremely difficult if you want to allow a general puropose PC with some software to decode the protected content as well.....

    74. Re:All DRM implementations will be broken. by asuffield · · Score: 1

      Microsoft has never cared about this. They do not care about stopping "piracy".

      The purpose of DRM to Microsoft is control over the distribution channels. Nothing more, nothing less.

    75. Re:All DRM implementations will be broken. by RMH101 · · Score: 1

      what if TPM was used in both ends of, say, a pair of encrypted walkie talkies for you? it'd allow you very, very hard encryption. it's the *use* it's put to, surely?

    76. Re:All DRM implementations will be broken. by Anonymous Coward · · Score: 0

      Then again, TPM isn't bad, on it's own. No, it is. Jar-Jar will always suck.
    77. Re:All DRM implementations will be broken. by dpilot · · Score: 1

      What if I own/control the TPM, and use it to make sure that no code runs on my box that *I* don't approve?

      What if the TPM blocks the Sony rootkit, for instance?

      However I agree that the most likely use is for Evil.

      --
      The living have better things to do than to continue hating the dead.
    78. Re:All DRM implementations will be broken. by dpilot · · Score: 1

      I'm not saying TPM can't be hacked, I'm just saying that it may well to be orders of magnitude more difficult than those things that have been hacked so far, simply because at least SOME of the people involved have a clue about what they're doing. The same can't be said about DRM, touch-screen voting, and now we'll have to add satellite TV to that list.

      There's a necessary mindset to proper encryption, and if profit is tops on the list, you ain't got it. (I was going to put something about paranoia in there, but realized that that counters my point.)

      --
      The living have better things to do than to continue hating the dead.
    79. Re:All DRM implementations will be broken. by Anonymous Coward · · Score: 0

      "AACS took years to develop, and it has been broken in weeks. The developers spent billions, the hackers spent pennies"

      Inaccurate statement, cracker.
      Some would suggest if true, sue the developers and Architects.
      Cutting to the chase, the key was read from memory, and it looks like the morons padded zeros around it to advertise 'look here'.

      TPM is NO solution as the key has to travel to memory over a bus, and like playstation, clipping on a logic analyser to or on TPM bus is a simple affair, or if lucky, a TPM chip with uncut diagnostic circuit goes out the door. Most of these chips have semi-secret diagnostic ice modes etc.

      Nobody should be surprised by this very predictable event, or that some people will make outlandish promises - and that someone actually paid.

    80. Re:All DRM implementations will be broken. by birge · · Score: 1

      The best thing to happen to the linux community would be the linux community forgetting the idea that eventually the consumer OSes will become so bad that people will be driven to linux, and starting to work to make linux so good that people are drawn to it. And by "so good" I do NOT mean "a very good implementation of Windows circa 1998" but something actually novel and compelling.

    81. Re:All DRM implementations will be broken. by NoseyNick · · Score: 1

      ... or you man-in-the-middle it.

      --
      Nick Waterman, Sr Tech Director, #include <stddisclaimer>
    82. Re:All DRM implementations will be broken. by julesh · · Score: 1

      It's merely a matter of making it hard enough to stop most attacks. By the time you're sniffing on-chip signals with RF, you're way past "most".

      As soon as somebody has a working mechanism to break TPM security, the game's over. What happens then is that software is implemented that pretends to be a computer with a TPM module, but lets the user see the internal state (i.e. get hold of the keys necessary to decrypt stuff). You hack a real TPM module, then you sell a few hundred consumers software with the keys for that module. They buy DRM-protected media and can immediately unencrypt them. Repeat ad infinitum. After not particularly many iterations TPM-based DRM vendors will stop trying to track the compromised keys and this scheme will be permanently and effectively broken.

    83. Re:All DRM implementations will be broken. by dpilot · · Score: 1

      I would argue that in a corporate situation, the user is not the owner, and doesn't get the keys, anyway. The corporation is the owner and has the keys, and permits the user to use the system.

      Of course that simply shifts the "user leaving the organization" problem from the user of the laptop to the person in charge of the keys. Theoretically, the person in charge of the keys doesn't really have them sitting in a file, but is authorized to run a "key extraction process." Of course the "key extraction process" would need to have controls to keep that person from simply extracting all of the keys, and then quitting. (even extracting all of the keys over a matter of months)

      --
      The living have better things to do than to continue hating the dead.
  8. Horseshoe racket by RichardDeVries · · Score: 4, Insightful

    Instead of spending billions on technologies that attack paying customers, the studios should be confronting that reality and figuring out how to make a living in a world where copying will get easier and easier. They're like blacksmiths meeting to figure out how to protect the horseshoe racket by sabotaging railroads.
    The railroad is coming. The tracks have been laid right through the studio gates. It's time to get out of the horseshoe business.

    Exactly.
    --
    Error 001
    Security Scan and Virus Detection do not work with your operating system.
    1. Re:Horseshoe racket by Anonymous Coward · · Score: 0

      They're like blacksmiths meeting to figure out how to protect the horseshoe racket by sabotaging railroads.
      The railroad is coming.


      Worst anology ever.

      WTF does that anology mean. Are people who break DRM supposed to be the railroad? Are you comparing a group of hackers who deal in electronic data to the railroad which drove the industrial revolution and set the course for western civilization as we know it.

      I have head soem bad one in my day but this anology is up there.

      How about an alogoy where the hackers are some kind of meat based processed food product and the **AA is a song bird, that would be good. Somebody come up with that anology.

    2. Re:Horseshoe racket by melikamp · · Score: 4, Insightful

      Content publishers are the blacksmiths, DVD's are the horseshoes, BT trackers are the railroads. This is the best analogy ever.

    3. Re:Horseshoe racket by homey+of+my+owney · · Score: 1

      I'm with AC above, how is this moded as insightful? If we follow the analogy, the MPAA should get out of the business because we are now free to copy the content they no long make?

    4. Re:Horseshoe racket by Miseph · · Score: 3, Insightful

      Actually, it's a very good analogy. It is intended to show the futility of DRM and copy protections (stopping the railroad) by the media giants who have shoehorned themselves into forced obsolescence (blacksmiths), and point out that perhaps instead of trying to prevent copying, which they cannot do, they should find ways to profit from it any way (railroad tracks are made out of steel, blacksmiths work with steel, instead of making horseshoes, they could make railroad tracks, or even locomotive parts).

      And yes, for the record, I think it IS fair to say that hackers working on ways to disseminate data electronically faster and more efficiently are like the people who first put together the railroads: they are radically changing how we think about moving "goods" and conducting business; they also share some similar personality characteristics, such as creativity (to come up with ways to make things happen), intelligence (or do you think any dumbass can perform either task?), and vision (to imagine a way of doing things radically different than the ways that they are done now). DRM crackers may not be the guys laying the tracks or inventing the steam engine, but they ARE the guys designing comfortable passenger cars, figuring out where stations need to go, and showing people how much cheaper and easier it is to travel by train rather than taking a carriage.

      --
      Try not to take me more seriously than I take myself.
    5. Re:Horseshoe racket by squiggleslash · · Score: 1

      It's a lousy analogy because it offers no solutions and it also doesn't represent the actual dynamics of the industry.

      The railroads made horseshoes obsolete, but did so without relying upon the horseshoes to be made anyway. The situation here is that we have something to copy, and copying is getting easier. The more copying we do outside of the wishes of the content creators, the harder it is for the content creators to make a living making the content in the first place. Which means they'll stop. Which means there's nothing to copy.

      Railroads didn't become obsolete thanks to an absense of horseshoes.

      --
      You are not alone. This is not normal. None of this is normal.
    6. Re:Horseshoe racket by Mercedes308 · · Score: 1

      I could actually hear the sound of that one going whoosh over your head from where I am sitting on the other side of the world.

      --
      And no, I couldn't give a shit what my karma is.
    7. Re:Horseshoe racket by OldeTimeGeek · · Score: 1

      (railroad tracks are made out of steel, blacksmiths work with steel, instead of making horseshoes, they could make railroad tracks, or even locomotive parts).

      Except that making railroad tracks required a foundry and a lot of very heavy equipment and railroad equipment needs specialized tools - something that very few blacksmiths would have had laying about

      Besides, it wasn't the railroads that killed the blacksmithing trade off, it was the motorcar. Railroads are great if you're going where they were, but horses were still needed once you got off. The motorcar, however, could go just about anyplace that there were roads. Which they frequently did. And when they broke, the person with the only tools available to fix them was, strangely enough, blacksmiths - who became the first service station mechanics.

    8. Re:Horseshoe racket by Miseph · · Score: 1

      I think you want too much from an analogy.

      That said, maybe the media companies should find new ways to make money that do not rely on outdated and obsolete versions of reality. The capital required to move 100,000 copies of Justin Timberlake's new album just isn't what it would have been 50 years ago, and the RIAA needs to not just get over that, but embrace it and find a new profit model. Do I know what that profit model is? No. Is that not my job, but the record industry's? Yes.

      As with the analogy, maybe the solution the blacksmiths are looking for is to start producing parts for trains, or to move to a more consumer oriented product line (silverware, puzzles, frying pans, etc.), or to invent ICEs and start building cars (a great piece of turnabout, making the trains obsolete); what the solution ISN'T is to go out every night and wreck the tracks and smash the windows of the railroad company, because it isn't accomplishing anything other than being a nuisance and creating a slight delay of the inevitable.

      --
      Try not to take me more seriously than I take myself.
    9. Re:Horseshoe racket by Firethorn · · Score: 2, Informative

      Like most analogies, it ultimately breaks down. Still, the RIAA/MPAA marketing models are increasingly flawed.

      That doesn't mean that they have to get out of the movie(blacksmithing) making business. It's just that they have to realize that they're not going to sell physical media products such as VHS tapes and DVDs forever. DRM isn't working, giving only months of protection in this case. Most of the anime DVDs I purchase don't have DRM. They have empty keys and the macrovision bit isn't set*. Why? The Anime companies took a look at their target market and figured out that DRM A: Annoys their customer base, and B: said customer base is on average technically skilled enough that DRM is less than an annoyance to their copying efforts. Yet they can still make money on sales.

      Music content is shifting away from CDs to online, why shouldn't movies? Heck, I'd love to be able to purchase a movie online, then download it to my computer/DVR to watch while I do something else. It'd be faster than netflix and not require so much personal time as a rental place that I have to drive to(not to mention better selection).

      Most people are willing to pay money for a legitimate product as long as it's competitive with the real one. Generally the legitimate producer has advantages of superior quality, the ability to advertise, operate a real storefront, etc... Illegal producers have the advantage of not having to create the material, allowing them to be cheaper.

      The MPAA/RIAA have both messed up in their attempts to move into the market niche currently taken by pirates(online), by their insistance on using DRM, as it has in some cases managed to give the pirates an advantage: Their version's superior. One example was a couple DVDs released by disney that had 5 minutes of non-skippable advertising before the movie could be played. Another would be MP3's downloaded off the internet vs the commercial CD which attempts to silently install a back-door DRM that leaves a mile-wide vulnerability in your system. For that matter, storing movies on a TB size DVR type device vs having hundreds of DVDs that you have to physically search through to find the video you want to see.

      *setting it costs $, and since the companies found that it's effectivness in preventing copying approached zero, decided not to waste the money.

      --
      I don't read AC A human right
    10. Re:Horseshoe racket by fimbulvetr · · Score: 1

      Which means they'll stop. Which means there's nothing to copy.

      By some huge stretch of the imagination, I can picture maybe, just maybe that us humans _may_ just be able to figure out how to still make music after this armageddon. Even more far fetched is that I forsee the ability to make money by making music after this cataclysm as well.

    11. Re:Horseshoe racket by rudlavibizon · · Score: 1

      The situation here is that we have something to copy, and copying is getting easier. The more copying we do outside of the wishes of the content creators, the harder it is for the content creators to make a living making the content in the first place. Which means they'll stop. Which means there's nothing to copy. Good. The content creators are going to stop making "content" and perhaps we are going to see some art instead.
    12. Re:Horseshoe racket by blincoln · · Score: 1

      I agree with you. However, I don't think the ability to copy will necessarily lead to the downfall of major media corporations.

      For the last 15-20 years, since I was a kid, I've found out about music and movies in ways that weren't profitable to the people who made them. Copying tapes and CDs from friends and the library, downloading mp3s and DVD/TV rips, etc. But I've then gone on to buy a ton of them. Why? Because if I like something enough to watch/listen to it, I like it enough to support more of it being made. I also think it's really ghetto and tacky when peoples' entire media collection is recordable media with titles written in magic marker.

      I have no problem spending money on media. But I do have a problem with spending it on media I don't know if I will like. So when e.g. the MPAA sends a warning to my ISP because they think I downloaded a movie off of BitTorrent, it means I won't be buying any new movies, because I won't have any way to see them first (and also it makes me angry that they're effectively trying to get my internet service cancelled, despite my being a much more valuable media customer than the average). I'm on call at work too much to see movies in theatres. I hate television because of the fixed schedule and ads, and I'm not going to spend hundreds of dollars for a DVR to make up for the deficiencies of the format.

      The solution here isn't a technical one, IMO. It's:

      a - Make people realize that if they don't support something, it will go away.
      b - Don't expect kids to buy everything, because *they don't have money*. They probably will when they're older.
      c - Realize that offending customers and paying companies like BayTSP costs more in the long run than taking a small (paper-only) hit on piracy.
      d - Play up the cheap-ass factor about people who only have bootleg media. Make it the new backwards baseball cap and 40 oz malt liquor.

      --
      "...always new atoms but always doing the same dance, remembering what the dance was yesterday." -Richard Feynman
    13. Re:Horseshoe racket by Justin+Ames · · Score: 1

      I'd say BT is more like a lot of little trucks...

    14. Re:Horseshoe racket by Sneftel · · Score: 1

      It's difficult for me to describe just how worthless and futile it is to scrutinize an analogy over the internet. It's a little like nailing Jello to a swimming pool.

      --
      The opinions stated herein do not necessarily represent those of anybody at all. Deal with it.
    15. Re:Horseshoe racket by StikyPad · · Score: 1

      Most of the anime DVDs I purchase don't have DRM. Why? The Anime companies figured out that [their] customer base is technically skilled enough that DRM is less than an annoyance.

      Or maybe they just didn't feel like paying $15,500 to license CSS and $25,000 to license Macrovision.

      Nah, you're probably right. They probably did a lot of market research and decided "only nerds buy Anime!"

    16. Re:Horseshoe racket by Tyger · · Score: 1

      You know, as I read your reply, it occurred to me that whoever made that analogy had it all wrong.

      The artists (Whether it be movie makers or musicians) are about getting around on horses. Sure, it can go anywhere, but it's not the quickest mode of transportation. Still, even in modern times there is something quaint about it.

      Then there is the MPAA/RIAA/etc. They are the railroads. They gets you over large distances... As long as you want to go where they go.

      Where music is now is cars. It's something very personal and easy to use, useful when used responsibly, dangerous when used irresponsibly, and you can go wherever you want with it. Only, it's as if the big railroads were trying to make cars illegal to use because it is possible to cause an accident with one.

    17. Re:Horseshoe racket by Crunchie+Frog · · Score: 1

      Am i the jello or the swimming pool? see i think you analogy fails becau... oh wait, I see what you did there.

      --
      --- Never attribute to malice that which can be adequately explained by stupidity
    18. Re:Horseshoe racket by Firethorn · · Score: 1

      If you looked at the note down in the bottom, you'd see that I noted that it costs money. And not just $40.5k. There are also per DVD costs for macrovision at the least, and at this point macrovision only 'protects' against copying with a VCR, not copying in a computer. Even then, a $50 piece of hardware will fix that right up(and restore signal quality to a varying degree from 'not much' to 'not noticeable'). Needless to say, CSS is broken to the point of uselessness.

      --
      I don't read AC A human right
  9. I disagree by TheSHAD0W · · Score: 4, Insightful

    After reading through the article I must conclude that while the author has made decoding current discs easier, AACS has NOT been "fully cracked". The key embedded in the current software may be expired in the future, rendering this method useless for discs produced after that expiration.

    I'm not saying that this isn't a nice event, but we have further work to do.

    1. Re:I disagree by p0tat03 · · Score: 4, Interesting

      The same method used to acquire this key can be used to acquire future keys. All it takes is one determined hacker willing to rifle through his memory addresses for the key.

      I do not see a terribly effective fix for this - your key has to exist somewhere, and even in a CPU register it is still in memory more often than not.

    2. Re:I disagree by Anonymous Coward · · Score: 1, Interesting

      Correct. And there are plenty of things that can be done to make this a lot harder. What was broken was a poor implementation of a decoder. I suspect that not only will that key be revoked, but also that player author may lose their right to future keys until they show that they have fixed this problem adequately.

      This is not remotely "fully cracked". However, IF the cracker had not revealed what player was involved, and instead just provided a website for obtaining the disc keys, THEN you could call it "fully cracked", since that would provide the ability to decode without the ability to revoke. As long as the crackers feel the need to prove that they really cracked the DRM by providing all the details of how it was cracked, it can never be "fully cracked".

      In hindsight, we may see that the downfall of DRM crackers is the same hubris that brought about the downfall of DRM.... *sigh*

    3. Re:I disagree by chill · · Score: 1

      Yes, but wouldn't his method of recording the memory location changes work again? I believe they could take a page from OpenBSD's playbook (and others) and randomize memory locations, but short of de-authorizing every player that does it the old way, they're screwed.

      Even with memory randomization, you could find it, since he knows what to look for.

      Absolute DRM is a fundamentally flawed concept. It is like locks on interior (hollow) doors. They aren't there to keep you out, they're there to let you know you should keep out. If you're determined, all they can do is slow you down.

      --
      Learning HOW to think is more important than learning WHAT to think.
    4. Re:I disagree by FunkyELF · · Score: 1

      I'm no expert so could you explain a couple of things....
      Could you explain why they wouldn't be able to figure out which player it came from if they didn't release all of their details.
      Also, if both of these cracks can be rendered useless in future releases via key revocation, then what is different between this one and Muslix64's crack?

    5. Re:I disagree by niiler · · Score: 1

      The guy went through a process to find the key. Once the particulars of the process have been cataloged and organized, the process could be coded into a library like libdvdcss which would automatically extract the key when the HD-DVD is loaded. I'm not saying that the user's experience would be stellar as it sounds like one would have to wait a bit for the key. But most users of "non-approved" players probably don't care so much as long as they can play their purchased movies on machines of their choosing.

    6. Re:I disagree by j00r0m4nc3r · · Score: 1

      I do not see a terribly effective fix for this

      The fix will be, "No More Software Players"... eventually. I'm actually pretty surprised they licensed software players to begin with, considering this is the exact same attack vector they used to break the DVD protection.

    7. Re:I disagree by Tharkban · · Score: 1

      "attack vector", I like that. It makes it sound dangerous, instead of just meaning you played a movie on your computer.

      btw, I wouldn't be able to watch any movies anymore if I couldn't play them on my computer (no TV, no media devices). I don't think that this situation is that uncommon anymore. Disallowing software players would be a business suicide strategy (much worse than having the DRM broken).

      In fact, even a trusted computing module (or whatever they call the chip that doesn't let you do stuff) wouldn't help matters, since someone would mod their motherboard and patch the software so that it plays. And then you have the same situation; you can go dig through memory for the key. Anyone determined enough to go digging through memory, would also be willing to circumvent the hardware protections. Hopefully, however, customers rebel way before that happens.

      --
      Tharkban (It is a signature after all)
    8. Re:I disagree by ady1 · · Score: 1

      and what when someone figure out the jtag port on a standalone HD-DVD player and extract it's key? No more stand alone players?

    9. Re:I disagree by Sancho · · Score: 1

      By far, more people use set-top boxes over PCs for watching movies. They might lose a few customers this way, but they'll "make up for it" by maintaining a stranglehold on their content.

    10. Re:I disagree by Em+Adespoton · · Score: 1

      I see them using a slightly more intelligent approach: the keys of the future will dictate resolution. Software players will get 320x240 resolution; certified hardware will get HD. That's what I'd do, anyway.

    11. Re:I disagree by Thagg · · Score: 1

      There will be mostly-software players -- players that require some bit of computation being done in a tamper-proof bit of hardware. Microsoft will ensure that that hardware is built into all Windows-Certified motherboards.

      Thad

      --
      I love Mondays. On a Monday, anything is possible.
  10. Too funny... by esarjeant · · Score: 4, Insightful

    When will the media industry learn that DRM strategies simply don't work?

    As soon as you can see or hear it, it is then possible to duplicate it. No amount of copy protection will ever be able to prevent that short of preventing consumers from accessing the material altogether.

    Learn to trust your consumers a little and focus on adding value to the material, and then people will buy your content. It might also help to provide some flexibility in the content licensing model, maybe giving people the option to upgrade DVD discs to HD-DVD for the same content may encourage them to continue buying media.

    --

    Eric Sarjeant
    eric[@]sarjeant.com

    1. Re:Too funny... by austior · · Score: 1

      ... short of preventing consumers from accessing the material altogether. Clearly, this is the next logical step in DRM technology. In the future, consumers who purchase digital movies will simply receive a certificate stating that they own the rights to said material and some tiny white pills that induce a vague memory of having watched something new.

      This new form of content distribution has countless advantages. The bandwitdth required to send a movie is reduced by a factor of at least 100,000. Additionally the replay value of movies encoded in this manner actually increases over time!

      Much of this technology already exists; The MPAA has recently engaged in informal negotiations with the makers of ambien to develop such a scheme.
    2. Re:Too funny... by AbRASiON · · Score: 1

      I've said this before and I completely agree with you.
      If HD-DVD and Blu-ray camps were truely commited to the formats and looking after the consumer AND their wallet, we'd be allowed to "upgrade" our DVD's

      We paid for a license to the original movie - or so they claim so therefore we should be able to trade that license in for an updated license of the same product.

      I don't know how much a DVD movie costs or a HD-DVD but I'm going to assume in the states it's 15->20$ US for a DVD movie and 20->30$ US for a HD-DVD

      I can't see people being unhappy about paying 10>15$ US and mailing in the disc only for their DVD for an upgrade to the new version, the company might theoretically see less income but in reality a lot of people will suddenly adopt REAL fast.

      It's the smart way to go, huge program to co-ordinate though, but possible.

    3. Re:Too funny... by iminplaya · · Score: 1

      ...maybe giving people the option to upgrade DVD discs to HD-DVD for the same content may encourage them to continue buying media.

      The whole purpose of "upgrading" the media is to make you re-purchase the content. We wouldn't have DVDs at all if that wasn't their intent. If they simply wanted us to have better storage media, they would encourage the fabrication of VHS to DVD recorders.

      --
      What?
    4. Re:Too funny... by esarjeant · · Score: 1

      This also opens the door for consumers to access the same movie on HD-DVD, Blu-Ray and online. The key is we are not paying for a license to use the material again, we only ever pay for the media and/or the bandwidth to acquire the content.

      Providers can offer varying QOS, where top-tier movie vendors might charge $15 to get the movie in 5 minutes onto a DVD disc and a discount service might charge $9 a month to download the movie over the Internet.

      The music industry might want to try something like this too. I've still got LP's and cassette tapes that I wouldn't mind "upgrading" to CD or MP3, I'm just not keen on paying $15 for $0.50 worth of media.

      --

      Eric Sarjeant
      eric[@]sarjeant.com

    5. Re:Too funny... by grant420 · · Score: 0

      Learn to trust your consumers a little and focus on adding value to the material, and then people will buy your content.

      Or not, since now they can make a copy for free. So how exactly do you add so much value to it that I would go to the DVD store to buy instead of my friend's house to make a copy of the product he bought? Yeah, yeah someone has to buy it first (unless it's all over the bittorrent sites) but that's moot here.

  11. Can this be fixed? by CastrTroy · · Score: 5, Interesting

    Can this be fixed by revoking a player key? Or is this a more extensive breach like what happened with DECSS? Will this work on all future discs, or does it just work on the discs that are currently being produced?

    --

    Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
    1. Re:Can this be fixed? by yanos · · Score: 1

      It seems to be working for all disc produced so far. I don't think revoking the player key will do much good but since it's not a breach à la DECSS (the encryption is not cracked, he just happen to stumble on a key), I'm sure movie studios will find a way to render this particular key obsolete with future releases.

    2. Re:Can this be fixed? by jo42 · · Score: 1

      ...and then they will find the new key.

      Repeat.

    3. Re:Can this be fixed? by yanos · · Score: 1

      Of course. But it will still remain a bit of an hassle this way. If we want to play those disc the way we currently are playing dvds on our linux box, we'll have to wait until someone actually crack the encryption.

    4. Re:Can this be fixed? by mhall119 · · Score: 1

      Yes, future disks can be made without this particular player's key, meaning another player will need to be used to decrypt new disks. This is not like DECSS, the encryption mechanism was not compromised, only the keys were compromised, and those can be changed on future disks.

      The problem for the recording industry now is one of politics and partnerships. Basically, are they willing to cause financial harm to the maker of the software player that allowed their key to be found? If they revoke that player's key in future disks, they force the maker to provide free updates to all their current customers, or risk having many very irate customers who can't play their new movies.

      Now the maker of a software player can rather easily offer a free patch on their website that fixes the compromise and installs a new device key that will be used in future movies. But imagine if someone does this for a hardware player, would the content companies be willing to revoke the device key used in a widely adopted hardware player, causing huge customer outrage and financial fallout?

      --
      http://www.mhall119.com
    5. Re:Can this be fixed? by Em+Adespoton · · Score: 1

      ...which will be a matter of minutes. We now know where the key is stored. In order to keep the new key private, they would have to move its storage location, which would break the current AACS implementation.

    6. Re:Can this be fixed? by Anonymous Coward · · Score: 0

      Um... the security hole used by DeCSS could be fixed (and, I believe, was fixed) by revoking a player key: DeCSS used the key (51, 67, 67, C5, E0) that was stolen from the Xing player. Current DVDs, as far as I know, no longer have the corresponding encrypted disk key.

      It was only after the DeCSS source was published that an efficient attack was discovered, allowing a whole bunch of player keys to be brute-forced. This in turn was what made the current free-software DVD players possible.

    7. Re:Can this be fixed? by SiliconEntity · · Score: 1

      I'm a crypto guy, and I've just spent an hour or so studying the AACS spec to see what was broken and whether AACS can fix it.

      The short answer is yes, for now AACS can change the processing key on future disks. They could even start making different disks with different processing keys. Right now the same one is used for all disks, but they could easily have set aside say a million different processing keys and start rotating through them. But there is a limit to how far they can go with this.

      Down the line, AACS anticipates revoking device keys. They have a very complicated system where individual players have device keys that can be revoked if people crack the players. The problem is that these so-called processing keys are connected to device keys in a complicated and subtle way. The bottom line is that once device keys start getting revoked, AACS may be somewhat forced to use certain processing keys for an extended period of time. If those keys get published, AACS may not be able to easily work around and revoke the processing keys.

      So I would say that this crack does point to a potential weakness in the AACS revocation system. The recently discovered processing key will not be good forever, but if hackers can continue to pull keys out of HD players with impunity, they may be able to stay ahead of AACS revocation efforts.

  12. if i ... by cosmocain · · Score: 1

    ...would get a dollar everytime someone claimed that something is/was/will be unbreakable...

    and somehow a few weeks later it was "broken"...

    uh, man. i'd be THAT rich.*


    *a man can dream, can't he?

    1. Re:if i ... by DigitAl56K · · Score: 1

      I don't think anyone ever claimed it was unbreakable, nor do I believe even the designers expected it to be. Strong and flexible, yes. And it sounds like this is true: Keys can be revoked and replaced, albeit with pain and suffering on the part of customers. The scheme itself is still not broken.

      I'm not a proponent of DRM, of course, but amongst the jubilation it's also important to realize what really happened here. A weakness in a software implementation allowed they key to be exposed in memory for some period of time. Is having the key the same as defeating the lock? Until the lock is re-keyed, yes.

    2. Re:if i ... by LordVader717 · · Score: 1

      The thing about DRM encryption, is that no matter how hard they try, the customer needs to be able to decrypt the signal to display the content. Even if almost every step of the process is tightly controlled, a cracker could still record the signal from whatever controls the pixels in the TV.

  13. Doom9's Forum by yanos · · Score: 5, Informative

    It all starts here: http://forum.doom9.org/showthread.php?t=121866&pag e=6

    Later posts seem to confirm that it works for both BR and HD-DVD

  14. industry's response? by bcrowell · · Score: 4, Interesting

    So what is the industry's response to all this? Can they deal with the problem without breaking every DVD player in existence? Is the encryption completely symmetric? Can they start releasing DVDs with new keys, without creating a situation where some DVD players can read old dics, and others can read new ones? Are different keys used in Europe, U.S., etc.?

    1. Re:industry's response? by piquadratCH · · Score: 4, Insightful

      So what is the industry's response to all this?

      Lawyers, I guess.

    2. Re:industry's response? by bcrowell · · Score: 1

      >>So what is the industry's response to all this?

      >Lawyers, I guess.

      Is there any real point of legal vulnerability? The people who cracked it are all anonymous. Any resulting scripts would presumably be distributed in jurisdictions that don't have the DMCA, where AFAIK the scripts would be perfectly legal.

    3. Re:industry's response? by I'm+Don+Giovanni · · Score: 1

      They could simply stop making HD-DVDs and BR discs altogether. DVDs still make plenty of money for them anyway, and would continue to do so. Which would be a sad event. Especially since there was no legit need to "crack" this DRM in the first place. Buy a disc, and it plays in any HD-DVD or BR player. Why was there a need to crack the DRM (besides piracy)?

      --
      -- "I never gave these stories much credence." - HAL 9000
  15. Now we get to see... by ameline · · Score: 3, Interesting

    Now we get to see how effective the key revocation system (that forms part of aacs) is going to be.

    Should be interesting...

    --
    Ian Ameline
    1. Re:Now we get to see... by awkScooby · · Score: 4, Interesting
      They won't do it. Their bluff has been called.

      Revoking keys would have a huge negative impact on the adoption of HD-DVD and Blue-Ray. Look at the backlash from the Sony rootkit -- that was something a lot of consumers were/are unaware of. It's harder to be unaware of the fact that your $900 dvd player no longer works, or your $2000 HDTV doesn't work. The inevitable lawsuits aren't worth it.

    2. Re:Now we get to see... by AnyoneEB · · Score: 4, Interesting

      They would only be revoking keys used by software players. Eventually someone will probably go through the effort to get keys out of a hardware player, but it is a lot more work to do so.

      --
      Centralization breaks the internet.
    3. Re:Now we get to see... by CastrTroy · · Score: 1

      What if somebody hacked a Hardware player? Would they revoke that key? I imagine that although it would be harder, it would not be impossible to get the key out of a hardware player. Who knows, there's probably already some hardware player sitting out there that has the player key stored unencrypted in it's ROM. What happens if the PS3 player key is discovered. No way Sony would ever revoke that.

      --

      Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
    4. Re:Now we get to see... by Tweekster · · Score: 1

      In theory they could change the PS3 keys with an update i think
      Perhaps, i dont know enough though about the subject, but I assume they would just update they key and ps3s would have a new key

      --
      The phrase "more better" is acceptable English. suck it grammar Nazis
    5. Re:Now we get to see... by Wesley+Felter · · Score: 0

      Each individual player is supposed to have a different key, so if one PS3 gets revoked it doesn't affect the millions of other PS3 owners.

    6. Re:Now we get to see... by CastrTroy · · Score: 1

      I'm pretty sure that's not true. Each model is supposed to have a different key, otherwise, how do the discs contain the key of every player, even the ones that haven't been produced yet.

      --

      Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
    7. Re:Now we get to see... by drinkypoo · · Score: 1

      What happens if the PS3 player key is discovered. No way Sony would ever revoke that.

      The PS3 is a horrendous example because Sony is behind Blu-Ray. All they have to do is put firmware updates on Sony Pictures and Sony-Distributed Blu-Ray discs and sooner or later the user will get the update. But since they exercise some level of control over all Blu-Ray pressing facilities, they might conceivably get their code into a majority of Blu-Ray discs, which would mean that the PS3 would be the player with the absolute least reason to worry about key revocation. You just put the PS3 key updating code on every Blu-Ray disc...

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    8. Re:Now we get to see... by CastrTroy · · Score: 1

      Even assuming they could update the PS3 with a new key, the hardware hasn't changed, and it would probably be just as easy to discover the new key. They wouldn't be able to push updates to the PS3 every month when the key was broken.

      --

      Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
    9. Re:Now we get to see... by Tweekster · · Score: 1

      Oh I definitely agree, I was just pointing out that they probably can update the player key without recalling them. The entire HD format is trying hang itself on DRM expecting it to work. It clearly is going to be a losing battle for them.

      --
      The phrase "more better" is acceptable English. suck it grammar Nazis
    10. Re:Now we get to see... by Wesley+Felter · · Score: 1

      It's all done with trees of keys. "The other obvious alternative, having a unique key for each device, would mean that the media key block would be far too large. There will be one billion DVD players built over the life of the system, and if each one needed a separate encryption, there would be no room for the movie. The secret is for each device to have a set of keys rather than a single key. Many of those keys are shared with other devices, but no two devices have exactly the same set of keys."

    11. Re:Now we get to see... by CastrTroy · · Score: 1

      Acutally I just checked, and it seems as thought I'm wrong, and that each player is supposed to have it's own key. However, I'm not sure how this works with software players, because each CD containing the players software would have to have a different key, which would make it impossible to press the CD by regular means.

      --

      Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
    12. Re:Now we get to see... by Detritus · · Score: 1

      I don't think so. There isn't enough space on the disk to store a unique key for every PS3. Then again, the way PS3 sales are going, the list might not be that long.

      --
      Mea navis aericumbens anguillis abundat
    13. Re:Now we get to see... by Anonymous Coward · · Score: 0

      If the decision was made to revoke a given key, it would only affect EITHER blueray OR hddvd titles, correct?

      If this is the case, it will be interesting to see which camp reacts to this exploit first, and how. And how the consumers react to that....this may play a role in deciding what format comes out on top.

    14. Re:Now we get to see... by Goaway · · Score: 1

      Revoking hardware player keys is a lot easier and less of a hassle, because hardware players have essentially individual keys.

    15. Re:Now we get to see... by asuffield · · Score: 1

      Revoking hardware player keys is a lot easier and less of a hassle, because hardware players have essentially individual keys.


      That doesn't help. Those hardware players also have essentially identical designs - so the method used to extract the key from one of them also works to extract the key from the next one.

      You simply pick up a new hardware player each month and fetch a new key, which can be used to decrypt all of the previous month's disks. They can revoke it, but you'll just get another one for the next month's batch.

      Giving individual keys to hardware players actually makes this sort of attack *more* effective - instead of a key that works once, you get a limitless supply of keys.
    16. Re:Now we get to see... by Pablo+El+Vagabundo · · Score: 1

      Someone needs to get the device key from the PS3!!!

      Revoke that.

      Checkmate Sony!!

    17. Re:Now we get to see... by Goaway · · Score: 1

      You simply pick up a new hardware player each month and fetch a new key

      You do not "simply" do that, even if you've figured out how. It still involved stripping ICs and electron microscope scanning them. The cost is significant, no matter what, while the cost of revoking the keys is very low. You will need to have signficiant money to keep pumping into that project. Who would do that?

    18. Re:Now we get to see... by asuffield · · Score: 1

      You do not "simply" do that, even if you've figured out how. It still involved stripping ICs and electron microscope scanning them.


      Every hardware DRM system that mattered (like every game console) has been cracked. None of them involved stripping ICs and electron microscopes. Mostly they're bus-snooping attacks, quite straightforward when you know where to look on a given piece of hardware.
    19. Re:Now we get to see... by julesh · · Score: 1

      Revoking hardware player keys is a lot easier and less of a hassle, because hardware players have essentially individual keys.

      (a) I'm willing to bet that there's a manufacturer out there lazy enough to give the same key to each player.
      (b) I don't see any mention of a contract being associated with ownership of an HDDVD player that grants permission to some authority to disable it. Therefore, if my player is disabled, will they be offering to replace it? Or will I have to sue them?

    20. Re:Now we get to see... by Goaway · · Score: 1

      Game consoles are a completely different problem. They usually do not encrypt data on the disc. They just want the discs verified as originals and not copies. And even that hasn't been cracked, as nobody can create a disc that boots and runs on any of the current consoles without modifying the hardware.

    21. Re:Now we get to see... by Goaway · · Score: 1

      (a) I'm willing to bet that there's a manufacturer out there lazy enough to give the same key to each player.

      Very doubtful. There are strict rules for the use of AACS technology. Nobody is dumb enough to threaten their license and their product line by not following them.

      (b) I don't see any mention of a contract being associated with ownership of an HDDVD player that grants permission to some authority to disable it. Therefore, if my player is disabled, will they be offering to replace it? Or will I have to sue them?

      Your player will not be disabled. It will work just as well as it always has. It's just that no new discs will be made that can play on it. Since the keys are individual, the only reason, apart from a mistake, that this would happen is because you've released the keys from your player. In the case of a mistake, I'm sure you could argue yourself into getting a new player.

    22. Re:Now we get to see... by julesh · · Score: 1

      Your player will not be disabled. It will work just as well as it always has. It's just that no new discs will be made that can play on it.

      I could trivially argue in a court of law that the purpose of a media player is not only to play already existing media, but future media that is advertised using the same media type name (e.g. an HD-DVD player should be capable of playing all HD-DVD media), and that any action taken by somebody to prevent that happening in effect causes damage to the player which devalues it to the point of almost worthlessness.

      Since the keys are individual, the only reason, apart from a mistake, that this would happen is because you've released the keys from your player. In the case of a mistake, I'm sure you could argue yourself into getting a new player.

      And, as there's no law against releasing them intentionally, presumably you could do so in this case, too.

  16. All your CRAP are belong to us by sehlat · · Score: 4, Insightful

    I've said before, "safemaker, safebreaker."

    Hollywood gets ONE move in the game: "Protecting" the content.

    The rest of the world gets as many moves as it wants to get around the ConsumerRightsArentPermitted.

    So Hollywood does everything it can to make itself hated by its customers and still expects to WIN this game?

  17. oblig Pirate Bay by Anonymous Coward · · Score: 0

    Free, free at last. Free in HD.

  18. Released Too Early by MrSteveSD · · Score: 4, Insightful

    I think they've made a mistake by breaking it too early. They should have waited until it was much more widespread. Then again, I would imagine it is psychologically virtually impossible to sit on a "breakthrough" like that.

    1. Re:Released Too Early by zappepcs · · Score: 5, Insightful

      Wrong! Break the DRM, Break it early, and break it often. DRM is dead, in fact it was stillborn. The foundational thinking behind DRM (or CRAP if you like) was so 'not right' that it's 'not even wrong' and it isn't getting any better. The more often the *AAs have to fight back with new DRM the more likely it is that we will see who in the governments is getting paid to support DRM, and then we will really have a target to ridicule, impeach, or tar and feather.

      The premise that all consumers are criminals is criminal in and of itself. Bear with me here. It defies logic and law to (analogy time) remove guns from citizens to prevent them from shooting people. It defies logic and good business sense to make .38 bullets that can only be used in guns made by one manufacturer. It defies the intent of the framers of the law in the US to presume that you are guilty until proven so, yet this is exactly what DRM is all about, the assumption that all consumers are guilty or would be if given even half a chance.

      Besides this, governments should not be propping up business models that are antiquated and broken. Desktop publishing put typesetters out of work, did the governments do anything? Trains put buggy makers out of work, did the governments do anything? That is only naming a couple of examples, but the governments seem hell bent on protecting certain industries. I can only conclude that those same governments are being well paid by those industries, for that is the only logical motivation for such infringements on citizen's liberties and rights.

      Now that AACS is cracked, time to follow the money and figure out who is getting paid and expose them as broadly as the DRM keys are exposed.

    2. Re:Released Too Early by Anonymous Coward · · Score: 0

      I think its best to crack it ASAP, the more often and thoroughly it is cracked, the more the industry will start realizing that DRM is costing them more than piracy. Anyways, which is more humorous: MPAA's new ultra uncrackable DRM being cracked before release, and again after release partly, then only a few weeks after that its completely broken a third way; OR MPAA's new ultra uncrackable DRM holding off everyone for YEARS and its finally broken while the next gen format is beginning to phase in?

    3. Re:Released Too Early by jafac · · Score: 1

      Actually, there IS a DRM scheme that should theoretically work.

      It would involve encrypting the product, each copy with its own unique key, and giving each licensed user a unique key. Wrap the purchase in a legally binding license. Such that any crack that makes it into the wild, will be tracable back to a purchaser who would be responsible for protecting the integrity of that copy of the product. The user would be held legally responsible, and thus would have a huge incentive to protect the product's encryption.

      However, such DRM would be severly at odds with any mass-production or marketing technique, and therefore, would cost far more to implement than it would be worth. Maybe someday, information technology will mitigate such costs. But that's a long ways down the road. And the market for such a scheme would be questionable at best. Would you pay for a legitimate product, knowing that if someone cracked your key and distributed that product illegally, you would be held responsible for damages?

      I know I would not.

      --

      These are my friends, See how they glisten. See this one shine, how he smiles in the light.
    4. Re:Released Too Early by mrhandstand · · Score: 1

      foundational thinking behind DRM (or CRAP if you like)...

      Consumers
      Really
      Are
      Pirates

      Yep - from their POV CRAP sounds about right...

      --
      Always value the individual over the system. --Bruce Lee "I don't need a Sig - I have a custom 191" - me
    5. Re:Released Too Early by Anonymous Coward · · Score: 0

      ... DRM (or CRAP if you like) ...

      I like it! Content Reproduction and Access Protection:

      Do you want CRAP on your media?

    6. Re:Released Too Early by elrous0 · · Score: 1
      No way. It's the perfect exercise in educational cruelty towards the MPAA and studios. Give them just enough time to brag that they've got a new unbreakable scheme, then break it and shove it right back in their face. Let them fix it, give them a little time to brag that they got the fix, then crack the fix and smack them down again. After a while you've got them shitting their pants in the corner begging you to stop hitting them. This way either they learn their lesson or we get to keep hitting them. Either way, it's a win.

      Reminds me of a braggart I went to school with. He bragged no one could beat him in vollyball. He even shot his mouth off once as he was returning a serve. Before he could even finish his sentence an ace on the other side spiked it right beside him. Next time, exact same thing, he brags/other guy spikes him. Pretty quickly thereafter he finally shut up.

      -Eric

      --
      SJW: Someone who has run out of real oppression, and has to fake it.
    7. Re:Released Too Early by Anonymous Coward · · Score: 0

      The JEWS are behind all of this. You surely can't expect 'poor' Hymie to work 10 hours a day on a building site, can you? He's one of "God's chosen people" and he expects YOU, his 'cattle', to do all the hard work FOR him. Who controls Congress? The JEWS. Who's behind the invasion of Iraq? The JEWS. The JEWS benefit, the 'cattle' suffer.
      Inevitably, selfish lazy arrogant bastards who are a tiny minority of the population, end up getting found out, and naturally their victims, the MAJORITY, rebel.
      That's why DRM exists, and that's who's behind it - the JEW.

    8. Re:Released Too Early by grant420 · · Score: 0

      Believe it or not, your logic about guns is flawed. Just go visit the Netherlands or any other European country where the number of guns per capita is FAR lower than the US, and you will find a direct correlation with the number of murders per capita. In case you didn't get it, this means that the number of murders is MUCH LOWER per capita in such countries. Or, even simpler:

      Guns = Bad

    9. Re:Released Too Early by mjwx · · Score: 0

      Besides this, governments should not be propping up business models that are antiquated and broken. Desktop publishing put typesetters out of work, did the governments do anything?
      No motor vehicles shall exceed the speed of 10 Miles Per Hour.

      This law was enacted by the US government circa 1900 after intense lobbying by the horse and cart industry. Typesetters were not well organised enough to produce the same result.
      --
      Calling someone a "hater" only means you can not rationally rebut their argument.
    10. Re:Released Too Early by Anonymous Coward · · Score: 0

      Trains put buggy makers out of work, did the governments do anything?

      Er, yes. In addition to the other points people have made, the buggy makers/operators also lobbied for laws that prevented train stations being built within cities. The idea was that if the train stations were outside the city limits, then people would still need to take a buggy from their home to the station. They got their law, but what happened was that the cities quickly expanded as the population increased, and the stations that were previously outside the city were now well within it.

      The law bought the buggy industry a temporary reprieve, but the end result was inevitable. Will any of the current industries have the sense to learn from history?

  19. Yes, someone walk us through this. by Valdrax · · Score: 1

    Is this a weakness in a particular player, in a particular driver, or in the standard reference method of decrypting a disc that allowed the guy at Doom9 to figure out how to get the player key?

    What exactly is this "processing key," and how fundamental / changeable is it?

    --
    If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
    1. Re:Yes, someone walk us through this. by hardburn · · Score: 5, Insightful

      Poking around Doom9 thread, the processing key for all current HD-DVD discs was found.

      Looking over some example source code, the processing key is used with the encrypted C value to build the media key, which can then build the volume key, which can then decrypt the disc.

      The MPAA can revoke the processing key, but quoting from the forum:

      Some of you are missing the true meaning of this compromise. If they revoke this processing key, we just take a player compatible with a new processing key, put in one of the titles that's already cracked, and go around in memory looking for the known key. We find it, insert a new title, look in the same place and we have a new processing key.

      Essentially, it becomes a known-plaintext attack.

      --
      Not a typewriter
    2. Re:Yes, someone walk us through this. by Petrushka · · Score: 1

      Someone mod parent informative to the roof. This is the most important question people have been posting.

    3. Re:Yes, someone walk us through this. by IKnwThePiecesFt · · Score: 1

      Wow, this is one of the best posts I've read in a while.

    4. Re:Yes, someone walk us through this. by Alef · · Score: 1

      We find it, insert a new title, look in the same place and we have a new processing key.

      Essentially, it becomes a known-plaintext attack.

      Why can't the player just put the key at a random location each time it is run?

    5. Re:Yes, someone walk us through this. by Anonymous Coward · · Score: 0

      Can someone clarify this better? It sounds really important.

      What is "a player compatible with the new processing key" and how would we get one?

    6. Re:Yes, someone walk us through this. by hardburn · · Score: 1

      For a software player, the new processing key would come from a software update. No discs released with the new processing key would play until the update is applied. In theory, the MPAA could refuse to allow software players anymore, but this would likely cause a class-action suit from consumers who already have next-gen players on their PCs. If publicity is handled well enough, it could kill the new formats regardless of the actual outcome of the trial.

      I would be curious to see how hardware next-gen players hold their keys for updating. The most straightforward method is some kind of firmware that can be easily updated over the Internet or in a retail service center. However, firmware would be prone to tampering. A ROM chip with some tamper-resistance would be harder to play with (though by no means impossible), but also makes updates harder.

      --
      Not a typewriter
    7. Re:Yes, someone walk us through this. by Virak · · Score: 2, Informative

      Unless the Wikipedia article is horribly wrong, or I'm misreading that, I'm pretty sure that's not a known-plaintext attack. Known-plaintext attacks (again, assuming Wikipedia is correct; IANAC) use the ciphertext and its known plaintext to derive the information necessary to decrypt further data encrypted the same way; in this case, the processing key. It'd be a known-plaintext attack if they used a C value decrypted with the old key and the same C value encrypted with the new key to get the new processing key. The method that person proposed is much easier, instead relying on the fact that the memory location the key is stored in is unlikely to change, as it is of a fixed size and as a result only needs memory allocated for it once.

      Of course, there's nothing stopping them from simply moving the key around each time, however then you merely need to find the location that the pointer to the key's location is stored to defeat that. They could also pile on more layers of obscurity of a wide variety of types in order to protect the ones below them, but they'll merely delay the inevitable, like all DRM, as you have no way of knowing if a customer could be a possible attacker and thus must allow everyone access to the content.

    8. Re:Yes, someone walk us through this. by Virak · · Score: 1

      It can, but obviously it needs to know the new location when it's changed. All that would do is add another layer of indirection.

    9. Re:Yes, someone walk us through this. by hardburn · · Score: 1

      Wikipedia isn't strictly wrong, I'm just using "known-plaintext" in a looser way than perhaps I should.

      You know what the old processing key is, and know some of the encrypted information for old discs. Armed with this information, you should easy to attack a new processing key. This is a "known-plaintext" attack in the sense that you know an older key and some of the data that was encrypted with that key.

      As an aside, I'd like some verfication that my points in the GP post are correct. A lot of people are pointing to the above post as a great simplified explaination of the attack, but really it's just what I gleaned with a little time poking around the Doom9 thread and examining the source code posted there. I haven't even spent the time going through the publicly available AACS documentation. So I wouldn't take the above as gospel.

      --
      Not a typewriter
    10. Re:Yes, someone walk us through this. by Alef · · Score: 1

      Yes, but so what? The point is it's no longer as simple as the quote made it sound -- basically just inserting a cracked disk in a new player and you're done. Of course it's not impossible to retrieve another processing key, but I don't see how you automatically get one for free.

    11. Re:Yes, someone walk us through this. by Virak · · Score: 1

      You're right, it's slightly more complex, but it's still not very hard to do. And you don't need to "automatically get one for free"; no matter how hard they make it to get, the key just needs to be gotten once, and then it can be used to decrypt all of the discs that use it.

    12. Re:Yes, someone walk us through this. by Goaway · · Score: 1

      That's an extremely naïve post you're quoting there. It assumes the algorithms will not be tightened up to keep the key from sitting unprotected in memory. That's the first thing that will be done.

    13. Re:Yes, someone walk us through this. by hardburn · · Score: 1

      The question that needs to be answered, then, is how?.

      Anything that simply adds another layer of indirection will just be a bit harder to crack. You could try storing the keys in only registers, but that will make implementation on machines with limited registers difficult (like all 32-bit x86 CPUs). Even if you limit your player to 64-bit x86 CPUs, the OS could still swap out the state of the registers during normal multitasking operations.

      There is no magic pixie dust solution.

      No, this crack isn't a total breakage the way DeCSS was, but it shifts the cat-and-mouse game heavily out of the movie industry's favor. Their best bet (and they seem to finally be waking up to this fact) is to give up on DRM. After all, DVDs have been copyable since 1998, but this has not stopped the format from being commercially successful.

      --
      Not a typewriter
    14. Re:Yes, someone walk us through this. by Goaway · · Score: 1

      Anything that simply adds another layer of indirection will just be a bit harder to crack.

      That may just be enough. Read through the threads about this, and you will find the people who did this aren't geniuses. Make it hard enough, and they won't be able to do it. Sure, there are people out there who can, but you have no guarantee they will try.

      In the greater war of AACS, this is still just a small skirmish. The real battles are still to come.

    15. Re:Yes, someone walk us through this. by hardburn · · Score: 1

      Read through the threads about this, and you will find the people who did this aren't geniuses.

      They're smart enough to know how to go through mem dumps with a hex editor and sniff USB traffic. They should be smart enough to go through any layer of indirection that the MPAA throws at them.

      Even if these specific people aren't smart enough, they're hardly the only ones trying to crack this. Just one engineering student with access to a scanning electron microscope could be enough.

      --
      Not a typewriter
    16. Re:Yes, someone walk us through this. by Goaway · · Score: 1

      I'm smart enough to do that, and I know it's child's play. I can do quite a bit more than that, but I can also think up quite a number of obfuscations that would stop me dead in my tracks.

    17. Re:Yes, someone walk us through this. by complete+loony · · Score: 1

      Each disk has a disk key, this is encrypted on the disk by using every device (or processor) key that will ever be issued.

      If a key is revoked, new disks may not include the device key for one of these devices, and the software or hardware player that was compromised may be updated. But the new player key will still be able to play old disks because all the player keys have already been generated.

      The disk key for an old disk cannot change. Once you have broken the disk key using one player key, you can use that information to find the location in memory where disk keys are temporarily stored for another software player. Enter a new disk, and you can obtain the disk key for that new disk by looking at that memory location at the right time.

      Also since you can find where in memory the disk key is decrypted, it should be easy to find the code that performed that decryption, and you should be able to locate the player key that was used.

      --
      09F91102 no, 455FE104 nope, F190A1E8 uh-uh, 7A5F8A09 that's not it, C87294CE no. Ah! 452F6E403CDF10714E41DFAA257D313F.
    18. Re:Yes, someone walk us through this. by Nasarius · · Score: 1

      Consider: every major game ever released has been cracked. Every single one. There have been a wide array of extremely complex, highly obfuscated copy protection schemes (no different in concept from DRM), and every one has been blown to piecees. For computer games. I won't even get into all the dongle-dependent applications that have been cracked. And you think these skilled people or those like them won't be interested in cracking the next-gen video formats?

      --
      LOAD "SIG",8,1
    19. Re:Yes, someone walk us through this. by hardburn · · Score: 1

      Look, if you want me to be convinced, give specific examples. I've given some possibilities above and reason why they're impractical and unlikely to stop an attacker. Remember, too, you aren't necessarily defending against just the Doom9 people (regardless of their actual intelligence level), but against many other potentially smarter opponents with resources far beyond what a typical home user would have. Further, it only takes one slip-up in one software or hardware implementation to break everything.

      Truth is, any attempt to use a new processing key would invalidate all existing players, and would likely cause a public relations backlash that would kill the new formats in their infancy. For all practical purposes, AACS is broken.

      --
      Not a typewriter
    20. Re:Yes, someone walk us through this. by Goaway · · Score: 1

      Ok, here's what I'd do to obfuscate an AACS implementation:

      First, you need an implementation of AES. Hand-write this in assembly to make sure you know where your bits and bytes go. Never keep unobfuscated keys in memory, and never all in one spot. Spread the parts around, and only re-assemble them in registers when you need them. Never keep a full key in registers at any point either, but swap parts in and out as you work your way through the algorithm (as it will have to be anyway, since you don't have large enough registers to hold it all anyway). You can also work through the maths of the algorithm to add obfuscation to that, and to the values you need to store in registers.

      Now, the key will never be in memory in a useful form, nor will it ever be in registers. Of course, you can reverse the obfuscation, but that requires identifying the AES code, reverse-engineering it to understand how it works, and then working out how to recover unobfuscated keys from that. That is certainly not impossible, but it is orders of magnitude harder than what people are doing now. Especially if you go to the extra effort of obfuscating the machine code.

      I'm sure there are furhter tricks than that, too. This is just off the top of my head.

    21. Re:Yes, someone walk us through this. by Goaway · · Score: 1

      Also:

      Remember, too, you aren't necessarily defending against just the Doom9 people (regardless of their actual intelligence level), but against many other potentially smarter opponents with resources far beyond what a typical home user would have.

      What makes you claim this?

      Further, it only takes one slip-up in one software or hardware implementation to break everything.

      I don't see how that would be the case. Please elaborate on what kind of slip-up would "break everything".

      Truth is, any attempt to use a new processing key would invalidate all existing players, and would likely cause a public relations backlash that would kill the new formats in their infancy. For all practical purposes, AACS is broken.

      I'll admit I haven't looked into the AACS specs enough to see how exactly the processing key works, but I seriously doubt this would be true. AACS is well-designed, and very much built around the possiblity that keys will be broken in mind. Even if changing it would break playback, I was under the impression that only software players use the processing key, and they are already equipped to be able to quickly update keys (as their keys are supposed to be revoked every six months even if they are not compromised), so updating them for this (if it is actually necessary) is trivial.

      Perhaps you can explain this statment further?

    22. Re:Yes, someone walk us through this. by hardburn · · Score: 1

      Remember, too, you aren't necessarily defending against just the Doom9 people (regardless of their actual intelligence level), but against many other potentially smarter opponents with resources far beyond what a typical home user would have.

      What makes you claim this?

      My example of the engineering student. Colleges often have equipment laying around that students are free to use during off-hours. Not just scanning electron microscopes, but other advanced equipment that wouldn't be available on the consumer market, some of which may even be prototypes built by professors and their research assistants.

      In practice, this means that your hardware implementation guidelines can't assume an attacker will just have off-the-shelf electronic analysis equipment, like logic probes and oscilloscopes. You'll have to be at least partially resistant to equipment that you may not know exists. That's a tough problem to design against.

      Further, it only takes one slip-up in one software or hardware implementation to break everything.

      I don't see how that would be the case. Please elaborate on what kind of slip-up would "break everything".

      As examples, a software player which doesn't obfuscate the key locations (which is what happened here), or a hardware player where the title keys are easily sniffed while passing through the traces.

      DeCSS was built because of a poor implementation of one software player (Xing), which broke the entire system. IMHO, AACS is sophisticated enough that we probably won't see such a fundamental breakdown, but that sophistication also means there are more places to attack. In practice, this may have the same effect as breaking it completely.

      I'll admit I haven't looked into the AACS specs enough to see how exactly the processing key works, but I seriously doubt this would be true. AACS is well-designed, and very much built around the possiblity that keys will be broken in mind. Even if changing it would break playback, I was under the impression that only software players use the processing key, and they are already equipped to be able to quickly update keys (as their keys are supposed to be revoked every six months even if they are not compromised), so updating them for this (if it is actually necessary) is trivial.

      Looking over the AACS Introduction and Common Cryptographic Elements (PDF link), section 3.2.4, the processing key is important for the generation of the media key, which would need to work with either software or hardware players.

      Revoking AACS keys isn't a technical problem, but a public relations problem.

      --
      Not a typewriter
    23. Re:Yes, someone walk us through this. by Goaway · · Score: 1

      My example of the engineering student. Colleges often have equipment laying around that students are free to use during off-hours. Not just scanning electron microscopes, but other advanced equipment that wouldn't be available on the consumer market, some of which may even be prototypes built by professors and their research assistants.

      But the only feasible attack that one could mount against a hardware player using any kind of college lab equipment is retreiving the device keys, which would be instantly revoked anyway.

      As examples, a software player which doesn't obfuscate the key locations (which is what happened here), or a hardware player where the title keys are easily sniffed while passing through the traces.

      The software player gets its keys revoked and a release is pushed out which fixes the flaw. This does not break the whole system. A hardware player that lets you get the volume keys would indeed be a problem, but it is extremely unlikely to happen. For it to be feasible, it would have to expose the keys on an external bus, and no such player is going to be allowed onto the market, barring total fuck-ups. Being able to do it once or twice in the lab is not really a feasible attack in practice.

      Revoking AACS keys isn't a technical problem, but a public relations problem.

      The system is clearly set up so that it won't be a public relations problem. Hardware keys can be individually revoked, and software keys are revoked as a matter of course. Where is the problem?

  20. Now that this has happened..... by 8127972 · · Score: 1

    .... Is it not time for the media companies to drop this silly DRM crap? Seriously!

    --
    This is my opinion. To make sure you don't steal it, it's covered by the DMCA.
  21. For as long as... by DimGeo · · Score: 5, Funny

    ... there are developers clever enough to lie to the media companies that this can be done, and then get paid to do it over and over again. :) I kinda like the idea :) :) :)

    1. Re:For as long as... by demallien2 · · Score: 1

      As one of the aforementioned developers, amen to that! :-D

  22. All together now... by gzerphey · · Score: 1

    Everyone who is surprised raise your hand...

    Hello? Hello? Bueller....

    --
    I don't have a microwave. I do, however, have a clock that occasionally cooks shit.
  23. Open Season? by gEvil+(beta) · · Score: 3, Funny

    from the open-season dept.

    Of all the movies to pirate, why'd Zonk have to choose that one?!?

    --
    This guy's the limit!
  24. The inherent problem... by sco_robinso · · Score: 5, Insightful

    ...As most people know is that you're trying to copy protect an inherently open media format. Even in theory it's very difficult to copy protect media in a widely open, public format.

    Until vastly different technology is available 20 or 30 years down the road, all that DRM is going to amount to doing is preventing the 'average joe' from copying en-mass. They just have to make it difficult enough for the casual user to be deterred from copying the content. Look at the copy protection scheme on the iPod - it's basically useless, but it prevents grandma from copying bulk amounts on content. It's like how photocopiers are not a danger to printed media, as it's just 'too' difficult to walk up to a copier and copy things on mass. The industry just has to make it hard enough to deter joe user.

    The real problem for the recording industry comes in when now people are getting more and more saavy at copying content, and it's becoming more and more common place, and digital media sharing is now common place and digital media is now common place in the living room now. 10 years ago MP3's were just making there way on the scene and basically only very saavy users knew what an MP3 was, let alone what to do with it. What happens when 10 years from now mobile HD video players are just as common as MP3 players, and your average iPod video has a half a TB of flash storage? Copying (High-Def) DVD's at that point will be common place like MP3's are relatively common place now.

    1. Re:The inherent problem... by FireFury03 · · Score: 1

      all that DRM is going to amount to doing is preventing the 'average joe' from copying en-mass.

      The thing is that DRM doesn't just stop you breaking the law - it stops a lot of very technical people from using their *legally purchased* content in a way that they feel is completely legitimate. And so once you've made sure these really technical people *have* to crack the DRM in order to use their content they are going to go out and produce tools that even the average joe can use to break the law.

      Here's an example: I am required to crack the DRM on all of my legally purchased DVDs in order to use them on my DVD player (MythTV). Why does the industry thing that I shouldn't be allowed to play my DVDs on my own choice of player?

    2. Re:The inherent problem... by just_another_sean · · Score: 1

      Too true. And while the recording industry is spending billions in R&D on making DRM that works but is easy for people there are people in the other camp making it easier for the hypothetical grandmother in the GP post to crack DRM. When does the arms race end?

      --
      Creationist Textbook Stickers Declared Unconstitutional by CowboyNeal
    3. Re:The inherent problem... by Anonymous Coward · · Score: 0

      New technology won't turn up 20 or 30 years down the road. The device playing back the content has the encrypted content, decryption algorithm, AND decryption keys; there's no way around it, or the content simply wouldn't play. Companies can make it "harder", except really it's not, since once the cat is out of the bag the content can be decrypted by anyone.

                If you look at the case of the Xbox, it was a single model, Microsoft made it as hard as they could to crack, including encrypted ROMs; the bootstrap was like 256 bytes, but built into a larger chip so it couldn't just be read out. They really want you to run purchased games on it and nothing else (well, except the free games you can d/l through Live and all.) But, in reality, someone with time and hax0r skills read the 256 bytes off using some solder pads on the board and a Jtag reader, and others found multiple security holes just in the 256 byte program! There's just no way to have numerous vendors (as would be the case for some future media player, even 30 years from now) all make perfectly secure systems; and it'd still take just one to have a key leak out and have a universal decryptor, just like now.

    4. Re:The inherent problem... by Anonymous Coward · · Score: 0

      "it's basically useless, but it prevents grandma from copying bulk amounts on content."

      That's what they hope, but what it really does is this: It makes grandma annoyed enough that she won't buy the junk anymore...

  25. The Funny Thing by s31523 · · Score: 3, Insightful

    It's funny, the whole DRM thing really seemed to come on strong after Napster was busted. In an effort to thwart the hackers and file sharing people this DRM thing kicked into high gear, yet these groups of people are probably the most savvy and creative buggers out there. The only people this DRM crap will ultimately hurt is the record/movie companies because the average Joe will just get frustrated when his new $40 HD-DVD doesn't play and gives an error of "unauthorized copy" or some crap and go off and not buy stuff any more. The hackers, I am sure, welcome the challenge and probably truly enjoy this cat and mouse game.

    1. Re:The Funny Thing by spikedvodka · · Score: 2, Insightful

      The hackers, I am sure, welcome the challenge and probably truly enjoy this cat and mouse game. As with any game of cat and mouse... unless the mouse gives up and hides, the cat usually wins.

      cat: the hackers
      mouse: the media companies
      --
      I will not give in to the terrorists. I will not become fearful.
    2. Re:The Funny Thing by Dunbal · · Score: 1

      the average Joe will just get frustrated when his new $40 HD-DVD doesn't play and gives an error of "unauthorized copy" or some crap and go off and not buy stuff any more.

            I really, really hope the answer is a/several massive class action suits, not just "not buying the stuff anymore".

      --
      Seven puppies were harmed during the making of this post.
    3. Re:The Funny Thing by drinkypoo · · Score: 1

      I really, really hope the answer is a/several massive class action suits, not just "not buying the stuff anymore".

      Why, are you a lawyer?

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    4. Re:The Funny Thing by LordVader717 · · Score: 1

      Nah, DRM has been around quite a while, even in the analogue days when some lines of a signal would scramble a tape recording. The original DVD also contained DRM, as did Minidiscs, although I'm not sure if they did from the start.

  26. In response by physicsboy500 · · Score: 5, Funny

    New DRM protection methods are now in the works which were cracked last week.

    --
    The original generic sig.
  27. Not Really Broken by Jah-Wren+Ryel · · Score: 5, Informative
    The guy just pulled the device keys for windvd and/or powerdvd from system memory. People have already been pulling the volume keys from memory so this was just an incremental step. The keys will be revoked (which really means that future discs will not include support for the compromised device keys, there is no actual 'taking back' of the keys as the word 'revoke' tends to imply).

    One key thing to take away from this is that the authors of the software made it really easy to pull the device keys out of memory for two reasons
    1. They kept them in variables that were physically near the variables for the volume key
    2. They zero-ed them out after use, leaving big gaping holes of zeros in memory in a place where that kind of looked funny, drawing attention to those areas
    If they are smart (and if the MPAA even give them another chance), the powerdvd/windvd authors will reimplement their AACS decryption code to never store the keys in memory. Without double-checking, I believe the keys are only 128 bits, they could be loaded into the SSE registers in encrypted form and then decrypted on chip. The authors will still need to take measures to prevent an OS context switch from storing the registers in kernel-private memory during the period in which the device keys are present, but that is not an extended period of time, presumably they can kick their priority up high enough that it won't happen without hurting the system much.

    Even that approach isn't hack-proof, but it is a lot harder to dump the cpu registers under such conditions than it is to trace memory accesses.
    --
    When information is power, privacy is freedom.
    1. Re:Not Really Broken by Yartrebo · · Score: 1

      Couldn't you still load the program into gdb and get the register values that way? Or is there something in the modern versions of MS Windows that prevents using a debugger?

      PS: The last Windows OS that I used regularly was MS Windows ME, so I'm surely out of date with what is going on in that area of computer software.

    2. Re:Not Really Broken by spikedvodka · · Score: 3, Insightful

      Even that approach isn't hack-proof, but it is a lot harder to dump the cpu registers under such conditions than it is to trace memory accesses. Not really... If you set up a VM, you can pretty much watch the registers. besides, that data has to exist somewhere in some form to get into the register
      --
      I will not give in to the terrorists. I will not become fearful.
    3. Re:Not Really Broken by TheRaven64 · · Score: 5, Interesting

      Without double-checking, I believe the keys are only 128 bits, they could be loaded into the SSE registers in encrypted form and then decrypted on chip

      Good thing Intel put in those nice debugging registers that let you dump the contents of SSE registers at arbitrary intervals (e.g. after every SSE operation by the debugged process).

      --
      I am TheRaven on Soylent News
    4. Re:Not Really Broken by badasscat · · Score: 3, Insightful

      If they are smart (and if the MPAA even give them another chance), the powerdvd/windvd authors will reimplement their AACS decryption code to never store the keys in memory. Without double-checking, I believe the keys are only 128 bits, they could be loaded into the SSE registers in encrypted form and then decrypted on chip. The authors will still need to take measures to prevent an OS context switch from storing the registers in kernel-private memory during the period in which the device keys are present, but that is not an extended period of time, presumably they can kick their priority up high enough that it won't happen without hurting the system much.

      And the solution the Doom9 guys will use to defeat this?

      Don't upgrade to the new PowerDVD.

      The cat's out of the bag. You can't put it back in now. The new key will be discovered even more easily than the old key, so there's no point even bothering with a key revocation.

      Your solution may make some future DRM scheme for a new media format a little more secure, but it's effectively over for AACS.

    5. Re:Not Really Broken by Anonymous Coward · · Score: 3, Interesting

      You underestimate the problem:
      Lots of media/volume/whatever keys are known.
      If a new (Windows XP) player arrives, with new title keys, it's decryption function will create the same output.
      All you have to do is to look for that output - and you are near the decryption function. Hiding it registers won't help, you might run Windows XP in an emulator, or you could write a kernel driver that generates an insane amount of interrupts and check from every interrupt.
      The only thing that might help is to abandon the idea of
      - Windows XP software players
      - Windows Vista players that play the movie at all if there is a single piece of untrusted software (debugger, performance logging, whatever) or hardware (RDMA capable nic).
      The whole tilt-bit and degrade quality stuff won't help - as far as I see the keys are identical, the degradation happens later.

      Let's wait what happens.

    6. Re:Not Really Broken by Jah-Wren+Ryel · · Score: 4, Informative

      Couldn't you still load the program into gdb and get the register values that way? Or is there something in the modern versions of MS Windows that prevents using a debugger?

      Under most versions of unix, only one debugger can attach to a process at a time. So an easy trick to prevent being debugged is to make the program attach to itself, thus locking out other debuggers. Some unices don't let a process attach to itself, but for those it may be possible to fork a child and have each process mutually debug the other. I'm not an NT programmer, but I would bet something along those lines works the same there too.

      Don't get me wrong, nothing is fool-proof (and I said so in my first post) the best these guys can do is make it difficult. So far, the windvd/powerdvd guys just wiped the device key from memory after use which is about the bare minimum - they could have done lots more without too much effort.

      --
      When information is power, privacy is freedom.
    7. Re:Not Really Broken by Anonymous Coward · · Score: 0

      Why were people "pulling the volume keys" I don't know what that means, anyone?

    8. Re:Not Really Broken by plalonde2 · · Score: 4, Informative
      it is a lot harder to dump the cpu registers under such conditions than it is to trace memory accesses.

      You've clearly never worked with a good hardware-assisted debugger. And virtualization makes this scenario possible without debugger hardware support.

      Even more, no matter what, the key has to make its way from the device to the CPU register. On every modern machine that transaction goes through memory. Which means that brute-force tracing from the device to the registers should be able to find it. Not necessarily easily, but quite doable.

      DRM is dead. Let's bury it.

    9. Re:Not Really Broken by ewhac · · Score: 1

      If they are smart (and if the MPAA even give them another chance), the powerdvd/windvd authors will reimplement their AACS decryption code to never store the keys in memory. Without double-checking, I believe the keys are only 128 bits, they could be loaded into the SSE registers in encrypted form and then decrypted on chip. The authors will still need to take measures to prevent an OS context switch from storing the registers in kernel-private memory [ ... ]

      You've never heard of an In-Circuit Emulator, have you?

      Schwab

    10. Re:Not Really Broken by TheThiefMaster · · Score: 1

      I thought that the "future discs will not include support for the compromised device keys" was done by having a list of compromised keys on the disk? Doesn't that make it easy to ignore?

    11. Re:Not Really Broken by saboola · · Score: 1
      The keys will be revoked (which really means that future discs will not include support for the compromised device keys, there is no actual 'taking back' of the keys as the word 'revoke' tends to imply)

      And future keys will be made to software, which will be pulled out of memory yet again, then revoked. The cycle will repeat until

      A) They no longer allow software based players (unlikely) or

      B) They give up.

      This all wont matter in a few years when a cheap Chinese player hits the market and with a UP UP DOWN DOWN LEFT RIGHT LEFT RIGHT opens up a menu that divulges all needed secrets (think Apex circa 2000).

    12. Re:Not Really Broken by drinkypoo · · Score: 1

      If they are smart (and if the MPAA even give them another chance), the powerdvd/windvd authors will reimplement their AACS decryption code to never store the keys in memory. Without double-checking, I believe the keys are only 128 bits, they could be loaded into the SSE registers in encrypted form and then decrypted on chip.

      In between disk and the SSE registers there is a trip through system memory. Shocking, but true!

      Also, since the processor does not have a decode-aacs-key instruction, the key will have to be decrypted before it can be used, and these operations can be debugged, logged, and used to determine how the key is encrypted. So you're just talking about another layer of obscurity.

      Finally, in the end this is all futility itself, because you can simply emulate the processor.

      The authors will still need to take measures to prevent an OS context switch from storing the registers in kernel-private memory during the period in which the device keys are present, but that is not an extended period of time, presumably they can kick their priority up high enough that it won't happen without hurting the system much.

      They'd also have to detect if they are being emulated or virtualized. A sufficiently good emulator is unrecognizable...

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    13. Re:Not Really Broken by Jah-Wren+Ryel · · Score: 1

      Congratulations, you and a half dozen other people have now proven themselves illiterate.

      Either that, or there is some other meaning to the phrase "Even that approach isn't hack-proof" that I am unaware of.

      --
      When information is power, privacy is freedom.
    14. Re:Not Really Broken by drinkypoo · · Score: 1

      The point isn't that it isn't hack-proof. The point is that it's no security at all. Saying that it's not hack-proof implies that you think it's pretty good. It's not. You can cough a hole in it, to borrow a phrase.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    15. Re:Not Really Broken by KingEomer · · Score: 1

      Couldn't you get access to it through a virtual machine? Heck, if you have the time, run it in bochs; you'll be able to see everything.

    16. Re:Not Really Broken by whitis · · Score: 1

      Actually, the attempt to prevent a context switch would be a dead giveaway and make it that much easier to find the key. With emulators, hardware assisted debuggers, code morphing processors, etc anything
      in the CPU is readily accessible. The only way around this is to not let the CPU do the decoding
      at all but push that to the video card or the monitor. Which they would love to do, I am sure, but
      it will just create problems for consumers of a magnitude to great to go unnoticed. Having to spend more
      $$$ for hardware upgrades will cause a backlash. The context switch prevention gag is also likely to drive interrupt latencies to too high a level and cause problems, as well.

      They may also try limiting computer playback to treacherous computing platforms only thereby cutting themselves off from millions of consumers.

      "You can always count on the Americans to do the right thing, after they have exhausted all other possibilities." -- Sir Winston Churchill

      The MPAA folks will try to exhaust all other possibilities. In the meantime, they will alienate consumers who think that actually buying a legitimate copy is the fair thing to do; there is nothing
      fair about spending money to buy broken products. And of course, there are the consumers who buy
      the product to avoid hassles; if the "legitimate" product comes with more hassles than the copy, that
      goes out the window too.

      And all of this so they can "protect" their ability to price movies at a price that becomes a powerful disincentive to purchase. At $6 per copy, the average consumer will buy any movie they have any
      interest in; a $20+ per copy, they will probably spend significantly less total on movies than they would have at $6 per copy.

      If you treat the customer like the enemy, they will do their best to live up to your expectations.

    17. Re:Not Really Broken by Jah-Wren+Ryel · · Score: 1

      Saying that it's not hack-proof implies that you think it's pretty good.

      Wow, I guess there is some other meaning to "not hack-proof."
      Good of you to make it up for me. I'll be sure to use it the next time I propose a security implementation to a client "It is not hack-proof, but since you are trying to keep out the hackers, I think it is pretty good!"

      --
      When information is power, privacy is freedom.
    18. Re:Not Really Broken by nrozema · · Score: 1

      And the solution the Doom9 guys will use to defeat this?

      Don't upgrade to the new PowerDVD.


      If the player key for your old version of PowerDVD is no longer valid on new media because it's been "revoked", then that doesn't leave you with much choice.

      It seems, however, that old versions of these software players will continue to be relevant for the previously published muslix64 hack that grabs the disc keys. While neither of these exploits completely "breaks" AACS in the same way that DeCSS did for DVD, the two of them together ensure that it's greatly compromised moving forward.

      Remember, only one "smart guy" needs to extract the keys. Everyone else just has to be proficient enough at using google or bittorrent to find them.

    19. Re:Not Really Broken by harl · · Score: 1

      If you do not upgrade and they revoke the key then your unupgraded version of PowerDVD will not play any movies published after revocation.

      The point of key revocation is to put the cat back in the bag.

      The game is not over. It's simply the MPAAs move. Will they actually use key revocation? I hope they do. I hope they keep using key revocation. Eventually they'll revoke a key that angers the wrong person. Say a sentator's player gets bricked.

      Will key revocation even do anything? There's been two seperate successful attack vectors on AACS in a short time. They'll just keep breaking AACS until the MPAA realizes that it is impossible to keep something secure when you give people both the key and the lock protecting it.

      --
      I find being offended by me offensive.
    20. Re:Not Really Broken by poot_rootbeer · · Score: 1

      The keys will be revoked (which really means that future discs will not include support for the compromised device keys

      So that means that the list of acceptable device keys is stored somewhere on every movie disc. And that means to validate the media-device combination, the player needs to compare its own device key against those on disk.

      All the crackers need to do is figure out which bit of code performs this comparison, hex-edit it to always give an 'OK' return value, and the protection is broken forever.

    21. Re:Not Really Broken by Ungrounded+Lightning · · Score: 1

      Good thing Intel put in those nice debugging registers that let you dump the contents of SSE registers at arbitrary intervals (e.g. after every SSE operation by the debugged process).

      Also: Having the keys only in the registers shrinks the search space to microscopic proportions, while expanding the time window of vulnerability (along with labeling it - as the code has to work around the "missing" registers for everything else it's doing.)

      --
      Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
    22. Re:Not Really Broken by Jah-Wren+Ryel · · Score: 1

      Time window is tiny anyway, they only need to decrypt the volume key once, which is itself only 128 bits. Since the device key must be used in the registers to do any decryption anyway, making sure it never exists outside of the registers does not change the search space at all.

      --
      When information is power, privacy is freedom.
    23. Re:Not Really Broken by Jah-Wren+Ryel · · Score: 2, Informative

      No, like so many others posting in this thread, you don't know how AACS works. Which is shameful since wikipedia spells it out.

      Each volume key is encrypted a couple of thousand times and stored on the media. Each encryption is done with an individual device key. If your player's device key was not used for any of those volume key encryptions (as in it was revoked), your player will not be able to decrypt the volume key and thus will not be able to decrypt the movie. So there is no way to simply patch a routine to always return "OK" because it doesn't return OK, it returns the key needed to decrypt the movie.

      --
      When information is power, privacy is freedom.
    24. Re:Not Really Broken by mbrubeck · · Score: 1

      No, A disc doesn't just contain a list of keys; it is encrypted such that only valid keys (i.e. keys not revoked when the disc was printed) can decrypt it. You can't just skip a step -- without a valid key, you can't decrypt the disc. Ed Felten has more info.

    25. Re:Not Really Broken by ZwJGR · · Score: 1

      What this means is that at some point in time, the answer, the decrypted volume key, is stored in an SSE register, of which there are 8, and which are exactly the same length as the value you are trying to hide.
      You would probably just have to monitor the SSE registers and any other 'funny business', like prevention of context switches, obvious obfuscation of memory/code, etc.
      You might as well put up text reading: 'The key that you are looking for will at some point be stored in one of the eight shoe directly boxes below', in mile high letters of fluorescent green fire visible from the far side of the moon.

      Besides, the SSE registers aren't used very often anyway except for things like block calculations in media decoding/encoding anyway, so it will look very suspicious when suddenly all sorts of stuff starts happening in them. Putting a few dummy SSE operations first will be transparent, as a coder can just break at that point and say: WTF is all this crap code doing.
      They are probably better off storing the key in the middle of heap allocated memory block used by the system, making sure that all sorts of other bloatware junk necessary for the correct runing of the player program is stuffed in the haphazardly as well, whilst simultaneously doing absolutely no fancy tricks during the actual process of getting and handling the volume key.

      --
      There is no psychiatrist in the world like a puppy licking your face - Ben Williams
    26. Re:Not Really Broken by cpghost · · Score: 1

      All it needs is a modified kernel to disable those debugger-preventing or -discovering tricks. Then it's child play again. For Unices, it's trivial to modify the sources; for NT some binary patch is just a matter of time; and for virtualizers, it's even easier. I could easily imagine good debuggers providing kernel modules or drivers just for this purpose.

      --
      cpghost at Cordula's Web.
    27. Re:Not Really Broken by Jherek+Carnelian · · Score: 1

      They are probably better off storing the key in the middle of heap allocated memory block used by the system, making sure that all sorts of other bloatware junk necessary for the correct runing of the player program is stuffed in the haphazardly as well, whilst simultaneously doing absolutely no fancy tricks during the actual process of getting and handling the volume key.

      You can't hide in plain sight for the very simple reason that it is trivial to take a memory dump and programmatically walk through the dump trying every single 128-bit sequence, takes about a minute to do it on a modern system. That is exactly how muslix64 figured out the original volume keys.

      At least with tricks to keep it in registers it requires actual analysis of whats going on to figure when the key is present and what it is.

    28. Re:Not Really Broken by Anonymous Coward · · Score: 0

      Use VMWARE!

    29. Re:Not Really Broken by heinousjay · · Score: 1

      Are there a lot of HD-DVD and Blu-Ray players for free operating systems where this would be possible?

      --
      Slashdot - where whining about luck is the new way to make the world you want.
    30. Re:Not Really Broken by Anonymous Coward · · Score: 0

      You've obviously never heard of SoftICE.

      You can crack damn near anything with that tool. It's very low level and actually more closely related to a rootkit than to any normal debugger.
      For example, when I first tried Skype, it complained that it didn't want to run because it noticed I had SoftICE installed and it was afraid I might see its innards. So I got annoyed because I didn't feel like uninstalling SoftICE just to try out Skype. My solution? I debugged Skype, found the two locations where it tests for SoftICE, patched them in memory and it ran fine. Then I patched the executable and ended up with a copy of Skype that couldn't detect SoftICE. I haven't played with the DVD players yet, but I doubt there is anything they could do to prevent a low-level debugger like SoftICE from debugging them.

    31. Re:Not Really Broken by julesh · · Score: 1

      One key thing to take away from this is that the authors of the software made it really easy to pull the device keys out of memory for two reasons

            1. They kept them in variables that were physically near the variables for the volume key
            2. They zero-ed them out after use, leaving big gaping holes of zeros in memory in a place where that kind of looked funny, drawing attention to those areas


      Yes, but even if they learn from these mistakes in future versions, we still have the keys for these early discs. When the player is loaded up with an early disc, the known key will be loaded. We can simply trace the execution until we find bytes from those keys loaded into registers. At worst, this will give us a small number of candidate keys to try until we find the right one. At best, it'll lead us straight to the key wherever they put it.

      If they are smart (and if the MPAA even give them another chance), the powerdvd/windvd authors will reimplement their AACS decryption code to never store the keys in memory. Without double-checking, I believe the keys are only 128 bits, they could be loaded into the SSE registers in encrypted form and then decrypted on chip. The authors will still need to take measures to prevent an OS context switch from storing the registers in kernel-private memory during the period in which the device keys are present, but that is not an extended period of time, presumably they can kick their priority up high enough that it won't happen without hurting the system much.

      Even that approach isn't hack-proof, but it is a lot harder to dump the cpu registers under such conditions than it is to trace memory accesses.


      Not really. You just run as an administrator and use GetThreadContext. A user process *can't* prevent an OS context switch from occurring. You use SetThreadContext to put the CPU into single step mode, and catch the exceptions caused by that in your process using WaitForDebugEvent. See here for details.

  28. joke is on us by circletimessquare · · Score: 4, Insightful

    yes, we're all laughing because this outcome was obvious to the slashdot crowd years ago. however, the people really laughing are the blokes who sell this drm technology to the MPAA/ RIAA

    why laugh at them when you can steal their money?

    we need a committee of slashdot readers to compile a list of buzzwords and concerns of the RIAA/ MPAA, and then sell them some technovoodoo that doesn't protect them in any way whatsoever (nothing can, obviously), but continues the RIAA's/ MPAA's illusion that drm can or ever will work

    give them their false security blanket, steal their money outright, and then continue to rip them off and drive into extinction the antiquated notion of corporate media distribution channel ownership

    they need us, we don't need them. make that point explicit by bleeding them dry via all possible avenues

    win win! idiots

    --
    intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
    1. Re:joke is on us by jafac · · Score: 1

      I just wonder why the RIAA hasn't sued these DRM shysters yet.

      --

      These are my friends, See how they glisten. See this one shine, how he smiles in the light.
  29. look at book publishers... by Churla · · Score: 5, Insightful

    People still buy books, including audio books and eBooks, even though photocopier exist.

    I think the recording and motion picture industries need to look at why, and follow that lead. Instead of millions in copy protection R&D, why not spend millions to improve the product? Make the product something people liked owning. (Notice how libophiles obsess over the actual tangible book?).

    The one really viable way to control it would be to mandate that all players have an internet connection and it verify the purchaser has rights to the media before playing it. Of course if people have good high speed connections to the internet there's no reason to buy the physical media, which they recording and motion picture industries simply can't abide with.

    --
    I'm a fiscal conservative, it's a pity we don't have a political party anymore
    1. Re:look at book publishers... by Grashnak · · Score: 1

      People still buy books, including audio books and eBooks, even though photocopier exist. I'm no fan of DRM, but I have to point out that if copying digital music was as time consuming as photocopying a book, no one would do it. Until a photocopier can turn the pages for me and give me a good bound copy of a book, I for one won't be bothering.
      --
      Life needs more saving throws.
    2. Re:look at book publishers... by AJWM · · Score: 3, Informative

      And one of the big publishers of e-books, Baen Books, not only doesn't bother with DRM, they make the content available in multiple formats, and even offer entire ebooks free (see the Baen Free Library.) They occasionally put out a CD full of big name SF and fantasy books, and encourage copying (just don't charge money for it). Anything to get folks hooked ;-)

      The authors involved agree that this helps get their names out and generates demand for paper copies and paid-for e-copies of their work. The reduced overhead of e-publishing compared to paper publishing more than covers any "piracy", I guess. The "Baen's Universe" e-magazine pays the authors better rates than the current paper magazines (Asimov's, Analog, etc) do. (Don't know about the book payment side. I hope to find out first hand at some point ;-)

      --
      -- Alastair
    3. Re:look at book publishers... by cdrguru · · Score: 3, Interesting

      The problem is you are confusing analog with digital.

      Making analog copies (of a book) is time consuming and impractical.

      Making digital copies of a book - like a PDF - is easy and is done all the time. Nobody buy e-books, you just download it for free. Because one person paid for it and decided (conciously or not) to eliminate the profit from any future purchases by making it available to everyone for free.

      The problem with digital copies is there will always be someone that is hell-bent on destroying the ability of the original publisher to derive profit from future sales. Happens with software, happens with music and it will be happening more with movies.

    4. Re:look at book publishers... by I'm+Don+Giovanni · · Score: 1

      Bah!

      IF they really cared about the consumers, they would offer ALL of their books for free and make money from donations!! :p

      --
      -- "I never gave these stories much credence." - HAL 9000
    5. Re:look at book publishers... by Slashcrap · · Score: 1

      Happens with software, happens with music and it will be happening more with movies.

      Yes, it's always happened with software. That's why no new commercial software has been produced since 1983 and Bill Gates had to eat his own wife to avoid starvation.

    6. Re:look at book publishers... by julesh · · Score: 1

      Don't know about the book payment side. I hope to find out first hand at some point

      I'm informed their book payments are pretty similar to most: c. $5-10,000 advance, with ~6% royalties. I understand the royalties on e-books are higher, but don't have a figure. This is from one of their authors who often uses a chatroom I also frequent.

  30. Nope, it's really cracked by suv4x4 · · Score: 5, Insightful

    After reading through the article I must conclude that while the author has made decoding current discs easier, AACS has NOT been "fully cracked". The key embedded in the current software may be expired in the future, rendering this method useless for discs produced after that expiration.

    In theory yes, but how easy do you believe it is to update all those specialized video players, all offline?

    Don't forget: the people who buy those already had to put up with paying premium for a HDTV, expensive players, and also make sure the TV, cable and player play together through HDMI.

    If you start demanding they are hooked non-stop to Internet so they can receive the daily patches, it may just be the thing crossing the line of tolerance.

    Also: the hard part is retrieving keys from pure hardware. The new keys come as firmware updates over the network.. it's even easier to update those HD-DVD/BlueRay rippers. After all, you have even the keys they encrypted the patches with: you have the player, don't you.

    All in all, the "super morphing update" ability of AACS seems more like a way for the AACS developers to claim "the war it's not over", when it effectively is over.

    Companies will refuse to use the new keys for their disks, since they will be incompatible with plenty of the players out there, the AACS creators will whine a bit about how "they could fix it but they don't wanna, not our fault", and this is where it'll end.

    1. Re:Nope, it's really cracked by Xugumad · · Score: 1

      > If you start demanding they are hooked non-stop to Internet so they can receive the daily patches, it may just be the thing crossing the line of tolerance.

      Not to mention, while people can understand the idea of requiring an HDMI connector on their TV to go with the HDMI connector on their HD-DVD/Blu-Ray player, and are likely to accept without asking, telling your customers that they need to update their player to play new disks is just asking for them to stop and ask why...

    2. Re:Nope, it's really cracked by BenFranske · · Score: 1

      As I understand it one of the "benefits" of AACS is that keys can be revoked through new discs. In other words, when you go buy a new AACS encrypted title and play it in your HD-DVD or Blu-ray player it will update the list of all revoked keys in the player.

    3. Re:Nope, it's really cracked by FireFury03 · · Score: 3, Informative

      In theory yes, but how easy do you believe it is to update all those specialized video players, all offline?

      You don't need the hardware to be networked in order to do key revokation - all the current discs continue to work just fine, but future discs will be encoded so they cannot be decoded with this key (this is the basis of AACS key revokation).

      This is definately not "fully broken" - fully broken is when I can use the crack indefinately *without* having to get a new player and extract a key from it every so often. i.e. it involves finding a flaw in the algorithm that allows you to decode the disc without needing to extract any data from a legitimate player to do so.

    4. Re:Nope, it's really cracked by Wesley+Felter · · Score: 1

      but how easy do you believe it is to update all those specialized video players, all offline?

      Every player has a different key. The key from a software player has been extracted, so only that player needs to be updated. Software players run on Windows PCs that are connected to the Internet, so updating keys should be easy.

    5. Re:Nope, it's really cracked by Lumpy · · Score: 1

      If you start demanding they are hooked non-stop to Internet so they can receive the daily patches, it may just be the thing crossing the line of tolerance.

      Most HD-DVD and Blu Ray players my company have installed ARE hooked up to the net 24/7 they have ethernet in the back and Pioneer as well as Toshiba got all their bugfixes out to the players that way.

      They already though of that and have the road paved for it by putting ethernet on the backs of these things.

      --
      Do not look at laser with remaining good eye.
    6. Re:Nope, it's really cracked by markov_chain · · Score: 1

      In theory yes, but how easy do you believe it is to update all those specialized video players, all offline?

      The nice thing about the DRM in HD systems is that different players have different keys. They could revoke just the key in the offending software player, and not worry about the hardware ones. I really don't understand why the heck they even let someone write a software player, how big of a market slice can that be?

      Not to say I'm defending DRM, as the hardware players can be hacked too. If they get rid of software players first, people will start doing exactly that. I'm guessing that different batches of hardware players will get separate keys to minimize the number of users affected by a revocation. Further, tamper-proof electronics will also get better. It will be interesting to see how long this arms race will keep up.

      --
      Tsunami -- You can't bring a good wave down!
    7. Re:Nope, it's really cracked by qbwiz · · Score: 1

      That system has a huge flaw: you could make your own player that ignores that list. What actually happens is that the disk is encrypted in such a way that only non-revoked keys can decrypt it. Of course, that has the problem that if you take the key of a legitimate player, then they have to revoke the key of a legitimate player (one which, perhaps, cannot be updated to a new key), but that's not quite as bad a problem.

      --
      Ewige Blumenkraft.
    8. Re:Nope, it's really cracked by HTH+NE1 · · Score: 1

      You don't revoke keys with a firmware update on a new title. You revoke keys by ceasing to encrypt new pressings using them, specifically revoking a key a particular exploited model of player needs disks to be encrypted with in order to decrypt the title with its decryption keys. You don't give an exploited player a new key which it will leak again!

      Trojaning titles with updates is how you either plug a leak in a player or replace a thoroughly exploited encryption system with a new one.

      --
      Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?
    9. Re:Nope, it's really cracked by compro01 · · Score: 1

      They could revoke just the key in the offending software player

      and then we sit back and watch a (small) mob storm movie execs because they can't play their HD movies with their brand-new $1,000 Blu-ray drives.

      --
      upon the advice of my lawyer, i have no sig at this time
    10. Re:Nope, it's really cracked by AaronPSU777 · · Score: 1

      The way I understand it is that firmware updates can be shipped with new releases. So say they decide to update the keys, they can pick an arbitrary date and all discs made after that date will include the update. When you play the disc your player is automatically updated, probably without you even aware it has occurred.

    11. Re:Nope, it's really cracked by markov_chain · · Score: 1

      I disagree, as I said above revoking keys for a software player won't disable the $1k hardware. The $1k hardware will be much harder to compromise because it probably uses tamper-resistant measures, so its keys will be left alone longer.

      --
      Tsunami -- You can't bring a good wave down!
    12. Re:Nope, it's really cracked by Anonymous Coward · · Score: 0

      I'm not leaving a device on my network which i am not in control of. Thanks for playing.

    13. Re:Nope, it's really cracked by dpilot · · Score: 1

      Maybe AACS isn't broken, but once new HD/BR DVDs with the player key revoked come out, that player is certainly broken.

      --
      The living have better things to do than to continue hating the dead.
    14. Re:Nope, it's really cracked by BenFranske · · Score: 1

      My understaning was that you needed a player key granted from the AACS people to put in that player, my guess is they would fail to give you a key if you didn't follow their specification about the device revocation list. If you developed a player anyway and stole someone elses key you could never sell it commercially or they would sue you into oblivian.

    15. Re:Nope, it's really cracked by qbwiz · · Score: 1

      You see, that's not really a problem for pirates (and legitimate users) who would use (the HD equivalent to) DeCSS or libdvdcss. That's who I assume the antipiracy protection is targeted against.

      --
      Ewige Blumenkraft.
    16. Re:Nope, it's really cracked by Joe+The+Dragon · · Score: 1

      and what about the people who only have dialup?

    17. Re:Nope, it's really cracked by Em+Adespoton · · Score: 1

      Trojaning titles with updates is how you either plug a leak in a player or replace a thoroughly exploited encryption system with a new one.
      ...except that the old player code has to be able to read that trojan code... which means the compromised system has to be able to read the trojan code. This means that any updates distributed by these means are also compromised, as it becomes relatively easy to reverse engineer the trojan and extract the keys you want, plus use it as a template for your own "custom" trojan.
    18. Re:Nope, it's really cracked by compro01 · · Score: 1

      I disagree, as I said above revoking keys for a software player won't disable the $1k hardware. The $1k hardware will be much harder to compromise because it probably uses tamper-resistant measures, so its keys will be left alone longer.

      tamper-resistant. not tamper-proof. given enough time and manpower, hardware keys will be broken. and if they try to disable that key, they're stupider than i thought.

      suddenly thousands of players won't play new movies. can you say "class-action lawsuit"?

      --
      upon the advice of my lawyer, i have no sig at this time
    19. Re:Nope, it's really cracked by Em+Adespoton · · Score: 1

      Every player has a different key. The key from a software player has been extracted, so only that player needs to be updated. Software players run on Windows PCs that are connected to the Internet, so updating keys should be easy./blockquote ...as easy as intercepting the update and extracting the new key using the already compromised old key.
    20. Re:Nope, it's really cracked by iminplaya · · Score: 1

      If you start demanding they are hooked non-stop to Internet so they can receive the daily patches, it may just be the thing crossing the line of tolerance.

      Maybe that's why they want run internet through the power cord. Then you're only way out will an online UPS.

      --
      What?
    21. Re:Nope, it's really cracked by BenJeremy · · Score: 1

      You miss the parent's point.

      If they do a key revokation, any discs produced afterward means that any players not connected to the internet are broken. This is a "worst case scenario" and is, indeed, the DRM world's equivalent of a scorched earth policy. At this point, it's a toss up if they will follow through with a revokation, given the bad feelings, all around, that will result... on the other hand, what better time to go through with this fire drill? Work out the bugs early on and see what happens!

      I don't know that I concur with the grandparent's point; like I just said, it's a toss up what they'll do. What I do think is that there are more compromised player keys out there, and even better, knowing a bunch of those keys gives the crackers more information to attack the encryption via other keys (like CSS did), so we could see an endless stream of compromised keys, with the DRM crackers laughing their asses off the whole time, pissed off customers angry that their expensive HD-DVD/BD players are constantly "broken" with new movies until an update disc arrives or a firmware upgrade downloads from the internet. This doesn't even consider those whose firmware upgrades "brick" their players accidentally (which will occur at a higher rate, with more updates).

      I'd bet the dedicated players out there have been well compromised already, to the point that updating them will merely give the crackers the new keys, anyway, even if they don't have the whole scheme opened up.

      AACS was a lost cause the minute it was proposed.

    22. Re:Nope, it's really cracked by Goaway · · Score: 1

      In theory yes, but how easy do you believe it is to update all those specialized video players, all offline?

      Trivial, as you can just stop included their keys in the key set. The AACS spec is design specifically for this.

    23. Re:Nope, it's really cracked by Goaway · · Score: 1

      One more time: You can revoke individual hardware player keys in AACS. Only the one single compromised player will be affected.

    24. Re:Nope, it's really cracked by Rich0 · · Score: 1

      Well, when they do key revocation they only revoke a key associated with the cracked player. Every model of player has a unique key. It may actually be the case that every individual player has a unique key as well - not sure about that.

      So, if you crack a software player they revoke the software player, and if it impacts multiple customers they all download updates. Hardware players aren't impacted since they weren't revoked.

      Now, if all of a particular brand of expensive hardware player shares a common key, and somebody goes to the trouble to extract that key from the hardware player, THEN you'll see some sweating executives...

    25. Re:Nope, it's really cracked by Lumpy · · Score: 1

      You are also not the type to pay someone $35,000 to build you a home theatre or add $45,000 worth of AV gear to your family room/Bar area just for watching football games on 6 42" flat panel sets. These people are richer than you can ever dream to be yet are incredibly dumb when it comes to rights, technology and understanding on how their own products will rat on them. If you try and educat them they wave their hand and say, "I dont care, what is easiest for me."

      easy for them is plugging in that HDDVD to their network so it updates silently.

      Guess what, the "I dont care, Shut up about rights" people outnumber you 30 to 1 so the corperations win.

      --
      Do not look at laser with remaining good eye.
    26. Re:Nope, it's really cracked by gordgekko · · Score: 1

      >> These people are richer than you can ever dream to be yet are incredibly dumb when it comes to rights, technology and understanding on how their own products will rat on them.

      Could be, Mr. Arrogant, they aren't doing anything that is illegal and therefore aren't worried about having their AV equipment hooked up to the Internet.

      I know, I know, you'll respond with the "Did you just imply that people who have nothing to worry about shouldn't fear their equipment being hooked to the web?" No I didn't.

      --
      You want to know who isn't running Firefox 2.x? They spell it "definately" and "rediculous".
    27. Re:Nope, it's really cracked by TheoMurpse · · Score: 1

      You don't need the hardware to be networked in order to do key revokation - all the current discs continue to work just fine, but future discs will be encoded so they cannot be decoded with this key (this is the basis of AACS key revokation).
      That was GP's point -- that a bunch of players are offline, and so there is no way to patch them to make them able to play newer discs. Thus, the offline players will not be able to play any disc pressed after X date.
    28. Re:Nope, it's really cracked by FireFury03 · · Score: 1

      That was GP's point -- that a bunch of players are offline, and so there is no way to patch them to make them able to play newer discs.

      Only if they share the same key. My understanding of AACS is that a key would apply to only a few (or maybe one) player, so revoking the key won't break lots of players that haven't been compromised. Yes, the players will still have the flaw to _allow_ them to be compromised, but it you don't take advantage of that flaw then your player's key won't get revoked. This is a key difference between AACS and CSS - CSS allowed key revokation but the key was shared between a vast number of players (e.g. all players of the same model would share the same key) so the industry never made use of the revokation feature.

      There is quite a good analysis of AACS on Freedom To Tinker that talks about this stuff.

      Of course, I would be very interested to know how many key revokations AACS can handle. Since the title keys have to be encoded so that they can be extracted by all players except the revoked ones I imagine there must be some practical limit to how many revoked players can be excluded from a single disc. Maybe it'll get to the point where there are so many revoked keys that they have to start un-revoking some of the older ones...

    29. Re:Nope, it's really cracked by bobstay · · Score: 1

      Snailmail.

    30. Re:Nope, it's really cracked by Anonymous Coward · · Score: 0

      This is how the "auto-roll" decryption software works for the satellite pirates. There are two keys in the video stream, and after a few days/weeks/months, the first key is revoked, and the second key is used instead. Legitimate recievers know about this, and the pirates eventually figured it out, too.

    31. Re:Nope, it's really cracked by Jesus_666 · · Score: 1

      Or someone figures out how to generate real-looking keys (or even real keys), thus "breaking" random players. There are some extremely bright and/or determined people among the crackers and this might just happen.

      --
      USE HOT GRITS WITH STATUE OF NATALIE PORTMAN (NAKED AND PETRIFIED)
    32. Re:Nope, it's really cracked by Rich0 · · Score: 1

      Real-looking keys wouldn't help - there isn't any kind of authentication system that you need to fool. The stream on the disc is encrypted, and you need a working key to crack it. There are probably thousands of valid ones, and probably 2^128 or 2^256 possible choices. Good luck finding one!

      The crypto system is AES - you won't crack it, and you won't brute-force the key anytime soon. The routes that might break the overall DRM system would rely on obtaining a valid key. This can be done by hacking a software or hardware player, or by discovering some weakness in how the system is implemented (as was done with CSS). If the valid keys are all related in some way you might have a chance of breaking the entire thing wide-open, but if they're just random numbers finding one won't help at all in finding others.

      The fundamental flaw in DRM is that the attacker has the key already - it is just hard to get to. That doesn't mean that you can simply guess the key - the underlying crypto is as strong as it gets.

    33. Re:Nope, it's really cracked by Jesus_666 · · Score: 1

      I'm not talking about cracking AES. I'm talking about the possibility of the real keys having properties that allow people to shrink the search space (perhaps far enough to make guessing keys feasible, thus "real-looking" keys) or someone managing to get their hands at the content producers' private keys/certs and software, thus being able to generate their own working device keys.

      I'm not really into the workings of AACS, but I think that someone being able to issue real device keys or getting their hands on a bulk listing of such keys would seriously affect AACS. Of course, that amounts to industry espionage.

      --
      USE HOT GRITS WITH STATUE OF NATALIE PORTMAN (NAKED AND PETRIFIED)
    34. Re:Nope, it's really cracked by Rich0 · · Score: 1

      I think that someone being able to issue real device keys or getting their hands on a bulk listing of such keys would seriously affect AACS. Of course, that amounts to industry espionage.

      If you could get a copy of the master key list that would obviously break open the entire system (that's what DeCSS is - just a list of all the master encryption keys - granted in DeCSS's case they could be found due to a weakness in the algorithm). As you suggested this would be difficult for the same reasons that getting Verisign's master signing key would be difficult - it is considered high-value and is undoubtedly kept very safe. Most likely no single individual has access to it. They probably have two people walk up to a terminal and ask it for a single key whenever a vendor needs one. And when a session key needs to be encrypted with every player key they would just give the computer the session key and it would spit out the encrypted packet - with nobody seeing the master key list.

      someone managing to get their hands at the content producers' private keys/certs and software, thus being able to generate their own working device keys.

      This wouldn't work. Players work by virtue of having a key inside that can be used to decrypt one of hte many encrypted copies of the session key for the disc. I doubt they even contain certificates. A disc doesn't have any kind of processing capability, so it would not be capable of authenticating any certificates that a player might contain. Software players could use a certificate when interacting with remote websites, but a disc just contains data.

      Now, apparently some kind of handshake is used by computer-based high-def DVD players. The players apparently refuse to read any content-scrabling-related content of a disc unless a handshake is performed, and that could involve some kind of certificate. Of course, since the player isn't online this is easily defeated by hacking a software player to get the cert - there would be no way to revoke them unless they start bundling firmware updates on new DVD releases...

    35. Re:Nope, it's really cracked by Anonymous Coward · · Score: 0

      Not that anyone is reading this anymore, but:
      Reading the spec it seems to me that once you play a new disk with your revoked device, the device knows. The device is required to maintain the most current revoked list in non-volatile memory. Therefore, once it knows it's revoked, it won't even play old disks. Even if you have the title keys.

      Also, it's not as crazy for the AACS-LA to revoke a device as everyone seems to think - it doesn't revoke every device of the same model. Due to the multiple device keys and the way the subset-difference method of choosing processing keys works, they can revoke just yours. Or maybe just a few. Everyone else's will still work.

  31. Here we go again... by Synesthesiatic · · Score: 4, Interesting
    Just like when the iTunes DRM was cracked, I might actually consider buying in these formats now.

    And because of that, when I put my iPod shuffle through the wash I was able to replace it with a good AAC-playing MP3 phone and flip the bird to Steve Jobs. Same thing with these...I want my media in formats I can move around and use to my liking.

    I'm not going to pay for the same content twice, ever. And if I can't get my content in a cracked DRM or DRM-free format, I'll just pirate it. That'll show 'em.

    1. Re:Here we go again... by stratjakt · · Score: 1

      I agree with you. Suddenly I'm interested in a HD-DVD drive, I could rent^H^H^Hbuy movies, encode them to HD WMV9, fill up a portable HDD and attach it to my 360, or stream across the 'net. (Poor lil fella can't play DivX and it's what's hooked to my HDTV)

      This whole "one box contains one movie" thing is so 1980s.

      There is no format war, the future is going to be streaming online delivery to secure devices like the Xbox 360. Slashbots will be aghast at my statement, and say "no way will I buy from MSFT, etc". But they will line up around the block to buy the exact same thing from Apple, and there will be a million articles about how new and innovative it is, and how awesome the rules Steve Jobs thought up about how, where and with whom you can watch a movie.

      Back to the HDDVD/BluRay disc:

      The "protection" is just a lock that you have to pick to get at your media. The action of picking that lock makes you run afoul of the DMCA. The game isnt "make it impossible to hack", the game is "make sure we can prosecute people who do".

      This is temporary, ultimately. The polycarbonate disc as a means of delivering digital content will go the way of the dodo. Well, not completely, there will always be collectors. Let's say it'll go the way of the vinyl LP. Forgotten, but not gone.

      --
      I don't need no instructions to know how to rock!!!!
    2. Re:Here we go again... by joel48 · · Score: 1

      That was my first thought exactly. I recently bought a Wii and am wanted to get a nice TV (LCD, 1080p, etc, etc) but am torn because the TV would be an expensive toy and I won't buy media that is not conducive to how I personally use it[1]. Now if I can buy high-def movies and rip/transcode them as I need, it makes that more appealing. I will specifically buy the format that has the most thoroughly defeated DRM mechanism.

      1. My personal use is all within legal copyright restrictions, even here in the US. How this doesn't seem to be enough for (most) media companies is beyond me.

    3. Re:Here we go again... by fimbulvetr · · Score: 1

      fill up a portable HDD and attach it to my 360, or stream across the 'net. (Poor lil fella can't play DivX and it's what's hooked to my HDTV)

      http://tversity.com/download/

  32. BOOM by Anonymous Coward · · Score: 0

    Headshot!

  33. The biggest Nelson laugh in the world isn't enough by Sneakernets · · Score: 1

    for this news. They will never learn!

    --
    "No freeman shall ever be debarred the use of arms." -- Thomas Jefferson
  34. Success! by FreakinSyco · · Score: 5, Funny

    The format war is over! We win!

  35. "Blurred" areas point to secrets by noidentity · · Score: 1

    I also saw that in my "corrupt" memdump the VUK, Vol ID, Media Key and the Title Key MAC were all closely clustered in memory: in the first 50kb (of the entire multi megabyte file!) but there were large empty parts around it. Almost as if it was cleaned up.

    Just like Google maps having certain areas blurred, clearing just the sensitive things draws more attention to them. Here it was just a simple matter of going back and finding what was there before it was "blurred".

  36. DRM still helps the DVD consortium by u19925 · · Score: 3, Interesting

    Steve Jobs mentioned that iTunes DRM cannot be shared with others since sharing would compromise the integrity of DRM. The DVD DRM was cracked and now the HD-DVD and Blu-Ray are cracked as well. This doesn't mean that DRM is not helping. Even though, the DRMs are cracked, the DMCA protects these cracked DRM systems and prevents commercial products from taking advantage of the cracks. Without the DRMs (even the broken ones) and DMCA, there would have been cheap legal DVD duplicators in the market.

    1. Re:DRM still helps the DVD consortium by ZachPruckowski · · Score: 1

      Wrong. There are two types of pirates. Filesharers just need to crack a HDDVD or BluRay once, and upload it to the net. And most commercial pirates are overseas, where they can acquire cheap presses to press pirate copies, just like they do know for DVDs and CDs.

    2. Re:DRM still helps the DVD consortium by zzsmirkzz · · Score: 1

      You don't need to decrypt the content to copy it. I'm still surprised they haven't released copiers (legal ones), that just create a true copy bit-for-bit. Who needs to decrypt? Leave that to the player when you want to play your copy. I realize the reason is that the industry seems to have a lock down on Drive & Media Manufacturers from letting them make writeable discs and drives that can make a perfect copy of the original....

    3. Re:DRM still helps the DVD consortium by scifience · · Score: 1

      there would have been cheap legal DVD duplicators in the market Instead, there are free, quasi-legal DVD duplicators available for anyone with two ounces of computer ability to download. Please remind me exactly what difference this makes again?

    4. Re:DRM still helps the DVD consortium by Anonymous Coward · · Score: 0

      Jobs didn't say FairPlay cannot be shared with others since sharing would compromise the integrity of DRM. He said Apple didn't want to license FairPlay because it make it easier to break and harder to apply a patch. It's more a business decision than a technical decision.

      No one is arguing that DRM is not helping. It does slow down casual sharing. You'd have to be fanatically anti-DRM to pretend that DRM does not slow down casual sharing. Ultimately, though, it's not the magic silver bullet and it fails to stop sharing like content providers want. Also, DRM takes away rights previously granted to users to use the purchased content legally. That's why any consumers should understand what DRM does and who benefits from it and who is disadvantaged by it. Until a system is devised to protect the content but not inconvenience the consumers, DRM must be opposed. However, the chance of that happening is slim since the battle over DRM is no longer about protecting content but about the control on the content which shole purpose is to take advantage of the consumers.

      You can say that DRM - even the broken ones - protects contents by the virtue of DMCA, so why bother investing in billion dollar industry when ROT13 can do the job? After all, breaking ROT13 encryption is also punishable by DMCA. Face it, copyright extensions, DRM and DMCA were pushed by the dinosaurs of the entertainment industry and do not address how media business should progress in the future. They have no vision. They are only methods to cling to the past glory.

  37. Let me be the first to say... by sanimalp · · Score: 1

    Thank you to everyone who helped with this project, and thank you to doom9 for giving these guys a home.

  38. This is not a shock by stratjakt · · Score: 2, Interesting

    The very fact that they put any sort of lock on it, means you have to pick that lock to get the content. Getting the content isnt illegal (fair use). Picking a lock is (DMCA). They still have the "legal framework" for pursuing copyright violations.

    They'd have stuck with CSS, but to attract new investors they needed a "shiney new more unhackable scheme". It's impossible to implement such a scheme without complete control over all the hardware. But, in the end, the very act of protecting the content is, legally, protection enough.

    The only good turnout for "us" (the consumer, fair use advocate, or even casual pirate) is if the industry decides it's not worth it to set the lock in the first place.

    There was never a doubt that it'd be possible to extract the data.

    --
    I don't need no instructions to know how to rock!!!!
  39. Usenet by lonechicken · · Score: 1

    So which newsgroup is "my friend" supposed to be looking at for exciting new content?

  40. security through obscurity by hAckz0r · · Score: 3, Insightful
    Yes, and just how obscure can a "standard" be? I have been harping on just how stupid the whole concept of DRM is, ever since Sony root-kitted everyone. Even after Gates makes all Windows boxes a "trusted system" we can just dust off the logic analyzers and hack the bios. If that does not work, vm's, and OS emulators will. There is no limit to the ingenuity of a pissed-off geek when they can't play what they just payed good money for, but only because of some arbitrary restriction embedded in the code. Just give a dedicated geek the binary and they will know _all_ the "secrets" about how it works. Thats a given. DRM by design can never logically work no matter how much time, energy, and money the designers throw into it. It is a flawed concept by design.

    1. Re:security through obscurity by pipatron · · Score: 1

      And when the average angry hacker can't shell out the thousands for the logic analyzers, you can bet that the chinese large scale piracy workshops will. :)

      --
      c++; /* this makes c bigger but returns the old value */
    2. Re:security through obscurity by tepples · · Score: 1

      Even after Gates makes all Windows boxes a "trusted system" we can just dust off the logic analyzers and hack the bios. Call me back when the Xbox 360 console is running Linux.

      If that does not work, vm's, and OS emulators will. But who will sign the VMs and OS emulators?
    3. Re:security through obscurity by Anonymous Coward · · Score: 0

      I'd be far more interested to see Linux running on the naked PS3 hardware without its hypervisor.

    4. Re:security through obscurity by hAckz0r · · Score: 1

      But who will sign the VMs and OS emulators?

      More like who will sign M$'s OS, which would be run within the VM/emulator that controls the simulated environment. The BIOS is what starts the whole trusted process, but you can replace that if you own it. You could do it with an Xbox as well but you first need to spend the time to figure out how it works. Emulated hardware can basically lie to the OS living on top of it, and any attempt to 'discover' it can be hooked and mitigated if you have control of the real/physical hardware. Both Xbox and PS3 will be hacked for you, give it time.

  41. Books by ragtoplvr · · Score: 4, Insightful

    We have the ability to copy books. Why do we not do that? Because books are cheap enough that it does not pay. Authors can still make a pile of money. Every other industry has went thru this phase. Content has to get less expensive, executives have to be reduced in number, pay cuts happen, then the industry can grow again. Resorting to DRM in any form, will be unsuccessful because, technology will overcome. The first company to recognize this, restructure appropriately, price appropriately, will win. Same as with book, computers, cars, even washing machines. My .02 Rod

    1. Re:Books by syousef · · Score: 1

      Not true. There are rare books that only have gone through a first edition print that are much more expensive than they should be. You'll find them on P2P networks because no one wants to pay hundreds of dollars for the third paperback in a trilogy because some fucking publisher has supposedly decided right at the end that the trilogy wasn't profitable and only done a single run of the last book.

      The problem here is the same for music and books - the publishers want to push up the price of their item by making it scarce artificially. The techniques vary from printing less copies of a book, to making a movie expire but it's all fundamentally the same. Decrease supply for an item that is in demand.

      --
      These posts express my own personal views, not those of my employer
    2. Re:Books by cdrguru · · Score: 1

      Sorry but there is no cost to copy music. Movies maybe, but probably not in the end with better tools and better pirates.

      So, the music people can just give up and say it is all there for free or they can try protecting it. Since protecting it with a computer enabled as a player is pointless, it will end up for free anyway. It will always be easier and cheaper to download music than to pay for it.

      Movies right now are arguably too big to download or too poor quality if the size is reduced. That is going to change in the next few years. We will see the end of camcorder copies and have only DVD rips. DVD rips with HD content and 5.1 sound run through good compression that doesn't compromise the quality. The end result will be that it takes 30 minutes to download a movie (over fiber) and you get the full 25GB high quality movie. Suddenly, there is no cost to copying movies.

      We get to decide as a society that it is either free or it is not. So far, the "its all for free" side is winning. I don't know anyone under 30 that pays for music and very few pay for movies. Maybe a few of them use Netflix but along with a lot of downloading.

    3. Re:Books by greed · · Score: 1

      Yup; and the main reason I want to see this DRM stuff gone from HD-DVD, Blu-Ray, and DVD is to keep the copy protection stuff off the wires between my player, my AV receiver, and my TV. MacroVision drives some of my NTSC displays batty. HDCP doesn't just fail with PlayStation 3 and Westinghouse TVs. Get that crap off the wires, it's not a problem that should have to be solved, and I don't want to deal with the defects it injects into media playback. (At least the PS3 looks fine over component video.)

    4. Re:Books by Tankko · · Score: 1

      The problem with the book analogy is that I don't want to read a book on the computer, I want to read it on my couch with a nice soft paperback.

      Music is different. CD's are nothing more than packaging these days. You *want* the music on your computer.

      Movies are a little different. Most people want the movie on their TV and most people don't have the computer hooked up to the TV, but that is changing (and fast)

      Books will always be "protected" until digital readers become the primary way to read a book. This is why Cory Doctorow giving away digital copies of his books is meaningless.

    5. Re:Books by Maltheus · · Score: 1

      We have the ability to copy books. Why do we not do that?

      People put more effort into copying books than they do CDs or DVDs. They scan them in and proofread them, putting out new versions as typos are found. This effort is more time consuming and never caught on as much. That's one reason it's not common. Another is that people prefer not to read a book on their computer and the cost of printing it out exceeds the cost of simply buying it. And then there's TV, who needs books? But this all has been going on since before DeCSS was cracked, if you knew where to look.

      As for books being cheaper, they should be. There are less people involved in the production. No actors to pay, no expensive recording studios, just booze to pay for.

    6. Re:Books by monkaru · · Score: 1

      The recording industry, whether intentionally or not, handily defeated copying for decades without relying on any restrictions. The vynil album survived highly capable reel to reel tape recorders and dirt cheap cassette tapes only becoming obsolete for mass distribution when the studios themselves pulled them for CD. How did they do it? Simple: record albums were beautiful. You had a cover large enough to frame and often posters, booklets and glossy photos inside the cover. People really, really wanted them and not just for the music they contained. People love pretty things they can hold. It's a funny old world, innit?

    7. Re:Books by syousef · · Score: 1

      That has more to do with book reading software and hardware than anything else. Book readers are typically cumbersome to hold, larger than they need to be, expensive and not very water proof. All but the last are critical shortcomings. The software also makes it hard to retain a book mark while flipping through the rest of the book. There's little in the way of a standard book format, page numbering affected by the reader for many formats. Again critical shortcomings BUT all technical and none insurmountable. It's a matter of time before a device is made that's cheap and convenient enough that people will want to use it to read. Current incarnations are pathetic.

      I carry my laptop with me and like to read books on it when I can. I deal with all of the above because it means I can carry more books on the train than I could with a small truck. Not so important for novels but for reference material it's great. I just wish there was more legally obtainable content.

      --
      These posts express my own personal views, not those of my employer
  42. Except that it's not about true piracy by caseih · · Score: 1

    DRM on a disk doesn't actually prevent copying either. It only seems to because you cannot buy blank disks that allow you to write to certain sections of the disk. In theory I could clone the HD-DVD or blu-ray disk bit for bit and produce identical pressed copies en mass. All this DRM does is allow movie companies to continue their questionable practice of price discrimination using artificial region locks and allows the media conglomerates to govern how and when you watch the content, extending copyright artificially.

  43. arms race by micromuncher · · Score: 4, Interesting

    Once upon a time I worked at a company encrypting CDs for digital data. This was over ten years ago... We too had a staged security, weak protection on key store, stronger protection on packages and data. We knew that the cost involved in high security was too high, from a functional and complexity cost POV.

    First, making the volume information secure, and file content, was pretty pointless because if you had strong security on it, it would be too slow to do anything useful. For the data, you could wait longer, but at the end of the day, all of it was moot because once either catalog or data is decrypted... its there. So, you decrypt on the fly, or use adaptive methods that attempt to hide information, it all leads to...

    The Cost of protection geometrically increases to the linear Time to break it.

    And in the end, all the protection does is buy you a little bit of time, because for every couple of guys thinking up the next best protection scheme, once it hits the world, you have 100+* the resources trying to break it.

    In the end, the best protection we came up with was something everyone hates... a hardware key that imlpemented the decryption, and sell that key with the media. Economically not viable to copy, but still does nothing once unprotected.

    --
    /\/\icro/\/\uncher
  44. The problem by nsayer · · Score: 3, Interesting

    Everyone talks about the big problem being that you have to give the key to the fellow who's going to watch the movie, but even that understates the difficulties facing DRM schemes.

    Recently, I put up a GeoCache puzzle cache. The idea was that folks would have to figure out the puzzle to find out the GPS coordinates of the cache. I was very clever and devious. I was humbled when the thing was found within 6 hours of publication.

    How was it done?

    To make a long story short, it was a "known plaintext attack." Since I am required to publicize a pair of coordinates somewhere within a couple miles of the cache (to make the geocache site's search engine work correctly - so that folks from New York won't solve the puzzle and get screwed when the cache is 2000 miles away), this lets attackers look for solutions that result in numbers "near" the posted coordinates.

    This is what makes movie DRM untenable. Since the format of the disks is publicly known (to insure that UNencrypted disks operate correctly), attackers know that they can discard solutions after decrypting very little of the ciphertext (probably just one byte).

    With sufficiently large keys, even that becomes a huge problem, but the fact that the format of the plaintext is known is still a huge advantage for the attackers.

    1. Re:The problem by owlstead · · Score: 2, Informative

      "This is what makes movie DRM untenable. Since the format of the disks is publicly known (to insure that UNencrypted disks operate correctly), attackers know that they can discard solutions after decrypting very little of the ciphertext (probably just one byte)."

      Bollocks. AES (used by AACS) and many other ciphers are pretty well protected against known plain text attacks. Furthermore, with common block sizes of 8 and 16 bytes it would be very hard to decrypt just a single byte.

  45. Funny until they mandate "Reality Filters" by spun · · Score: 1

    Just wait. We'll all be required to have "reality filter" chips installed between our optic and auditory nerves, and our brain. Only properly licensed material will be permitted to be perceived. And you'll have to license EVERYTHING, because it potentially competes with MAFIAA controlled content. I'm guessing we have it by 2025. >:-(

    --
    - None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
    1. Re:Funny until they mandate "Reality Filters" by Em+Adespoton · · Score: 1

      I can just see the headlines... "Criminal mastermind escapes by covering himself in unauthorized content and becoming invisible!"

  46. Crack authors please by rbarreira · · Score: 1

    Crack authors, as soon as you get different keys (for different players), include them all in the software. This way, if they want to revoke keys to solve the problem, they'll have to piss off a lot of people by breaking their players, which they won't...

    --

    The AACS key is NOT 0xF606EEFD628B1CA427BEA93A9CA9773F
  47. Close by Anonymous Coward · · Score: 0

    We don't copy books because books can be purchased for less than the cost of printing our own copy. CDs and DVDs can be stamped out for less than the cost of recordable media. If the **AA would price recorded CDs and DVDs at less than the cost of blank media, then there would be very little unauthorized copying! But then the studios wouldn't have as much money to promote their latest offerings -- hey, buying hookers and coke for DJs and movie critics is expensive!

    1. Re:Close by Argon · · Score: 1

      > If the **AA would price recorded CDs and DVDs at less than the
      > cost of blank media, then there would be very little unauthorized
      > copying!

      I don't know if that will ever happen in the US but something like this is already happening here in India. A blank media maker is buying a library of Indian movies and selling them at prices (about 75c per DVD) below the the cost of a DVD-R. I know you get blank media a lot cheaper than that in bulk, but in India a single (good quality) DVD-R will cost you about $1 in retail. See Moser Baer Home Entertainment for details.

  48. dark sneakernet? by way2trivial · · Score: 1

    -- use a megabyte of the next movie disc release.

    spiderman 3, now with firmware!

    if EVERY movie released, includes the list of current 'bad' keys.. then the players can use that for updating.

    no cabled network required

    --
    every day http://en.wikipedia.org/wiki/Special:Random
    1. Re:dark sneakernet? by 14CharUsername · · Score: 1

      ummm... wouldn't the pirates be able to use the same information?

    2. Re:dark sneakernet? by MasterOfMagic · · Score: 1

      Yes, please do this. Please list all of the player keys in the open that are no longer valid for this disc but might be valid for other discs. I'm sure nobody will think of using these player keys for a software hack. For the love of god someone please forward this to the AACS people, this is a wonderful idea.

      (Ironically, the captcha for this post was "plunder".)

    3. Re:dark sneakernet? by Goaway · · Score: 1

      No, you don't need to update any firmware. You simply stop including the compromised key on the disc. This is how key revocation works, and no, you don't need to revoke an entire line of players, you can revoke an individual one.

  49. one box ... by mbaudis · · Score: 1

    - This whole "one box contains one movie" thing is so 1980s. -

    actually, more like "so 2002ish"; 1980s would be CD (which was introduced in 1982). butr you are essentially right, though i am not so sure about collectors; in vinyl, you have a physical equivalent to the music (though you need very sensitive fingertips to read LPs ;-)

    1. Re:one box ... by AJWM · · Score: 1

      - This whole "one box contains one movie" thing is so 1980s. -

      actually, more like "so 2002ish";


      How quickly they forget videocassettes... Heck, I had a VCR before I had a CD player.

      --
      -- Alastair
  50. No different than us web developers by creativeHavoc · · Score: 5, Insightful

    Web Developers and Web Content-Maker-Guys YEARS ago gave the "no right click" a try. We quickly learned that if some one wants the content off the web site, they will get it, so there is no use in trying to introduce barriers that only hurt the casual user. You don't see "no-right-click" scripts anymore, but we are still producing tons of content for the web. Much of it copyrighted, and mostly the copyright honored.

    I can't help but see this as a parent who is all too restrictive with thier child, leading the child into endless rebelion that would have been avoided if moderation was used instead of a billy club.

    --
    insight through the mind
    1. Re:No different than us web developers by Anonymous Coward · · Score: 0

      Interestingly enough, Formula 1's Official Website (http://www.formula1.com/) still "disables" right clicking on images.

    2. Re:No different than us web developers by cdrguru · · Score: 1

      Sorry, but I do not agree. Look around - I get about 50 emails a day advertising cheap (pirated) software. There is no DRM or protection used on any of the packages being sold. The ones that have some sort of protection - that really works - are not being pirated.

      If you let people pirate, they will pay nothing whenever possible. This produces the effect of "everything should be free" and utterly discourages anyone from making an investment in producing something for profit. Sure, you will get people that are dedicated to their "art" that want to make music for others. And Darwin Reedy will be right up there with her recordings. What you have to decide is do you want Darwin for free or pay for someone else.

      I am pretty sure we are headed like a runaway freight train towards Darwin's singing style or anyone else's as long as it is free.

      Yes, there are some people that will diffidently say "I don't pirate. I pay for my music." Most of these people are simply deluded in their belief that the Russian mob is paying the artists or some such. Time to face reality folks - music is free today. If you are buying, it is to soothe yourself rather than actually giving money to the artists.

      Movies can be had, but usually poor quality and without effective transfer rates. This is changing with camcorder copies being replaced by DVD rips. As the ripping programs get better you will be able to download HD with 5.1 sound eventually. When that happens any pretense of buying quality at the DVD store will be gone.

    3. Re:No different than us web developers by MBGMorden · · Score: 1

      Yep. Those little scripts got on my nerves beyond belief. Half the time all I wanted to do was open a link in a new window (which I normally would right click to do). That kept me from having to reload a page when I was done looking at the new one. As soon as I saw that "Page protected." crap pop up, I was like "Oh, it's on biatch.". Of course the fact that 99.99999% of them could be defeated by turning off javascript and reloading the page didn't really help much. If that didn't work and it was an image I was trying to get, a simple screengrab and crop sufficed just fine.

      --
      "People who think they know everything are very annoying to those of us who do."-Mark Twain
    4. Re:No different than us web developers by Anonymous Coward · · Score: 0

      Those "no right click" "web developers" must be Internet Explorer users, because evey other browser, including ancient versions of Netscape had a "view source" option in the menu and possibly on a hotkey like Ctrl+U. The part I find most annoying about those "look, but don't steal" warnings is that they are also triggered by middle clicking, which I frequently use to go to another site.

    5. Re:No different than us web developers by dorianh49 · · Score: 1

      I like the parent analogy. Guilt usually works pretty well, too. To get a child to obey, parents should start a campaign where they tell their children that disobedience doesn't hurt the parents as much as it hurts little puppies and kitties. And ponies (if they're little girls or metro little boys). If the MPAA had a campaign like this, imagine how effective it would be? Piracy hurts the gaffers and grips; boohoo!

      --
      Gravity is a contributing factor in nearly 73 percent of all accidents involving falling objects. -Dave Barry
  51. Re:props to Muslix64 and hackers everywhere yeah! by kurt555gs · · Score: 1

    I think it is good, ( no sarcasm )

    I think I can decide for myself what is fair use, and what is not.

    I also prefer to be a customer to be sold, and not a consumer to be culled.

    --
    * Carthago Delenda Est *
  52. No protection, just really huge file sizes? by phouqhue · · Score: 2, Insightful

    Studios have put millions of $'s into this, and it is broken, the real protection is in file size. Imagine a 200+ gig movie, uncompressed with full DTS EX and DDHD, commentary and everything else that you could want. Now imagine trying to download that movie over the course of a few weeks or months, if your ISP allows that kind of transfer. The data rate should be high that modern computers stutter and playback is jerky. Compressing it down to a managable size would be defeating the idea of watching HD. This would suffice for today and maybe even a few years. Protection is in "an unmanagable file size" and "data transfer rate", for now.

    1. Re:No protection, just really huge file sizes? by Anonymous Coward · · Score: 0

      200GB is.. not much

    2. Re:No protection, just really huge file sizes? by Anonymous Coward · · Score: 0

      And even then, you'll have huge costs that'll eat into your profits or greatly reduce your potential market.

      Resolution and required bandwidth so high that it'd make today's high end computers stutter? Then, boy oh, boy, your player will have to be some sort of monster. But mass production will lower costs, you say! Then that hardware will surely be put to use on computer systems which, by the way, tend to get much more powerful in an awfully short amount of time.

      Uncompressed media? So what? Codecs get better. Computers get faster. HDDs and burnable disc media gain more storage. Computer technology will catch up so fast it wouldn't even be worth it. The tech-savvy will compress the media to reasonable sizes (no longer to 700MB CD size but maybe just 5.2GB DVD or whatever sizes HD-DVDs and Blu-Ray discs are).

      Remember, a lot of people put up with 128kbs MP3s. Enthusiasts might have FLAC files instead but that's still smaller than uncompressed WAV files....

    3. Re:No protection, just really huge file sizes? by onkelonkel · · Score: 1

      File size is no protection at all in the long run.

      Old guy rambling: in about '94 I wanted to download a 1 meg patch for a game (anybody remember Darklands). I connected to my local BBS with a 2400 bps modem. It took just over an hour to download 1 meg and my BBS timed out the connection after 1 hour. Not being able to resume the download, I could not get the file. I had to drive over to the computer store where the BBS was based and use a local PC to copy the patch to a floppy.

      Fast forward to today. I connect through cable and top speed is 4.5 Mbps. The patch that took over an hour to download in '93 I can get in about 3 seconds. I see 5 - 10 Gig torrents all the time. If the connection speeds continue to increase the way they have in the past 200 GB will not be a problem. I know some cable providers offer 30 Mbps, and with fiber to the home, 100 mbps may not be far off.

      Even today, all it takes is one guy to down the 200GB and compress it to some reasonable HD-worthy resolution and the file could be in the 10 - 20 GB range.

      --
      None of them can see the clouds; The polished wings don't care.
    4. Re:No protection, just really huge file sizes? by phouqhue · · Score: 1

      Do you have the time to download 200+ file size? This won't stop pirating, but slow it down. Having a High bitrate will just piss people off when they can't watch it smoothly and compressing it down defeats the prupose of HD. Everything that has to do with tech, is either small for ease of transportation or distrubution, so make distrubution un unwieldy and cumbersome and archival purposes a real pain the a$$, make todays limitations on hardware and transfer rates the copy protection. Just a thought.

    5. Re:No protection, just really huge file sizes? by danpat · · Score: 1

      I'll add to this that there is only so much quality that you need too. Look at audio files. RAW CD data, at 44khz is pretty much at the limit of human hearing resolution. There is no point in making it bigger, bigger doesn't mean better.

      I suspect at some point we'll hit the limits of human visual resolution too. At that point, any resolution above what we can actually see will be useless, and when bandwidth catches up to that amount of data, adding more data will no longer be protection (it could be stripped with no apparent loss of quality).

    6. Re:No protection, just really huge file sizes? by compro01 · · Score: 1

      and such a method would likely prevent it from being run on dedicated hardware too. the ultimate in DRM. make it unwatchable. perfect patching of a analog hole.

      --
      upon the advice of my lawyer, i have no sig at this time
    7. Re:No protection, just really huge file sizes? by harry666t · · Score: 1

      let's do some math.

      read this:
      http://en.wikipedia.org/wiki/HD-DVD

      and this...
      http://rockmetalshop.pl/go/_info/?id=6253

      quote:
      "1920 × 1080 or about 2.07 million pixels"

      this means 2 mb per frame, or 50 mb per second, uncompressed.

      multiplied by ~10K seconds of movie, makes 500G of uncompressed stuff.

      wow.

      but let's compress it.

      let's choose that discrete sine algorithm to get rid of unnecessary stuff.

      then that technique that gets only the first image, and the rest of the stuff is only what has been changed on that image, you know what i mean, i just don't remember its name.

      then let's use some lossless compression algorithm, liek gzip or bzip2 (rather the first one, the second is very cpu hungry)

      or maybe other today's best movie compression techniques.

      and we managed to pack it to 20-30 gb that MUST fit quite nicely to that blu-ray or hd-dvd disc, official specs say that you can't pack any more.

      today it's not a trouble to dl a cd iso image, 700 mb.

      yesterday it was possibly a trouble for a sec or two to dl dvd image, which has approx 4,5 gb.

      tomorrow, before we could understand what has just happened, 1mbps will be standard. 20 gb will be less than 700 mb yesterday.

      those of us who started with 14.4k modem dreamed about isdn. and now, isdn is like crap to adsl, cable. adsl's capabilities are around 6mbps. this makes one megabyte per second.

      6mbps.

      20GB.
      20K seconds. less than 6 hours.

      200GB.
      200K seconds. 55 hours. two or three days.

      what goes next? copper bites the dust. our internet connections will be faster and faster, our NXG hard disks' capacities will be counted in TBs, our ram in GBs, our movie and music libraries will grow. and nothing will stop this.

      oh, of course the world's end would.

    8. Re:No protection, just really huge file sizes? by phouqhue · · Score: 1

      It doesn't have to be better, just a space and memory and bandwidth hog. Video Bloat!!!! I just coined a new term.

    9. Re:No protection, just really huge file sizes? by danpat · · Score: 1

      Fortunately, there is an upper limit on the bloat. The eye has a resolution of about 576 megapixels over 120 degrees (i.e. most of your field of view). Once the bloat hits that ceiling, anything bigger can simply be downscaled. Sure, it might work out at around 43.2 GByte/s (24 bits/pixel, 25fps), but we'll get there one day.

    10. Re:No protection, just really huge file sizes? by phouqhue · · Score: 1

      Technology may not have the limits, but people's patience does. A stuttery video and large download time would suck, especially after waiting 3 ro 4 days just to watch a movie and finding out that the silly thing won't play back smoothly and has taken up a sizable chunk of space that could be used for porn or games (yeah that's it.....games). I personally hate wasting my time on stuff that barely runs on my computer, ie "SC Double agent". i have to upgrade my machine just to play that game at an acceptable rate and resolution. Now if that was a video file that I downloaded......delete. I wouldn't wnat to watch a DVD res movie, especially if i thought that it was a HD quality and wasted my bandwidth and time downloading. Who cares if better codecs are invented and tech gets faster, any compression simply defeats the idea of watching HD in full resolution and awesome sound for free. Peoples patience and lack of having a machine to play back such files would be a "speedbump" in piracy, it would certainly stop casual copying.

    11. Re:No protection, just really huge file sizes? by Nasarius · · Score: 1

      Yay for Darklands. I still play it with DosBox every once in a while. But by 1994, there was AOL/Prodigy/Compuserve/etc, though I don't think I ever downloaded the patch back then.

      --
      LOAD "SIG",8,1
    12. Re:No protection, just really huge file sizes? by syncrotic · · Score: 1

      That's an interesting anecdote, but it doesn't have much relevance to today's reality.

      Where I live, cable modems were first made available in 1999, and there hasn't been any increase in line speed since day one. DSL and cable providers compete on price, not speed: 80% of their customer base wants a low-cost always-on internet connection with which to browse the web quickly and use iTunes. As for the other 20%: the broadband ISPs would actually love to get rid of them; they're not profitable.

      Broadband speeds aren't increasing any time soon, and even if last-mile technology were to make a huge leap, we'd still have to deal with transfer quotas, throttling, and non-neutral pipes.

      Transfer rates aren't going anywhere.

    13. Re:No protection, just really huge file sizes? by onkelonkel · · Score: 1

      I guess it really varies depending on the market where you live. I started with my ISP (a local cable company) in early 2001. The original monthly limits were 10 GB download and 1GB upload free, after which you pay more for each additional GB. Since then they have increased the limits, first to 16 GB up 16 GB down, then to 32 GB combined up/down and just now to 64 GB up/down. Peak speeds have gone from 1.5 Mb/s to 4.5 Mb/s. No throttling of P2P. Price hasn't changed.

      --
      None of them can see the clouds; The polished wings don't care.
  53. The end of software players? by guidryp · · Score: 4, Interesting

    "I do not see a terribly effective fix for this - your key has to exist somewhere, and even in a CPU register it is still in memory more often than not."

    Ummm, how about no more new keys for software players. As long as there are software players it seems obvious that it will be possible to reverse engineer what they are doing to shake out the keys. But if the industry decides that SW players are too weak, they simply revoke keys for them and don't issue new ones. The end of software players and the end of the risk.

    1. Re:The end of software players? by John+Miles · · Score: 1

      Ummm, how about no more new keys for software players.

      There's no other kind.

      --
      Dahlmann tightly grips the knife, which he may have no idea how to use, and steps out into the plain.
    2. Re:The end of software players? by hardburn · · Score: 3, Insightful

      Lots of people already have next-gen disc players for their PC. They expect those players to play next-gen movie discs, because that's what they were advertised to do. Not allowing them to update keys would likely cause a class-action suit.

      Remember, the next-gen formats are still in their infant stages. Bad publicity now would likely kill them.

      Lastly, the entire justification for the heavy DRM in Vista is that they can play hi-def movies. If there are no more software players, that justification will be shown as bunk (it's bunk anyway, now it will just be obvious).

      --
      Not a typewriter
    3. Re:The end of software players? by Anonymous Coward · · Score: 0

      If the definition of "software player" is a player that does decryption and key handling via a traditional CPU and external memory, you are wrong. There are hardware solutions that never deal with unencrypted keys in external memory. Some chips can decrypt, decode, and reencrypt with HDCP all internally, so that there really is NO unencrypted access to keys or content. The only way to hack that is to get access to internal registers and memory of a single piece of running silicon. That is many orders of magnitude harder in knowledge, effort, and expense than the trivial hacks used to get keys from PC-based software players.

      I would not be surprised if in the future PC HD-DVD & Blu-ray players are limited to systems with GPUs capable of decrypting and HCDP reencrypting content internally (I wouldn't be surprised if the new Nvidia G80 GPUs have the processing capability do do this now...)

    4. Re:The end of software players? by harrkev · · Score: 1

      Ummm, how about no more new keys for software players. As long as there are software players it seems obvious that it will be possible to reverse engineer what they are doing to shake out the keys. But if the industry decides that SW players are too weak, they simply revoke keys for them and don't issue new ones. The end of software players and the end of the risk.
      Ummm, yeah. Everybody knows that geeks with lots of disposable income are the last ones to buy into new technologies. Kind of like shooting the goose that lays the golden eggs because it honks too much.

      Of course, the solution could be "Vista only" on all software players. Ummm, wait. Geeks are also avoiding Vista cuz' of lousy frame rates.
      --
      "-1 Troll" is the apparently the same as "-1 I disagree with you."
    5. Re:The end of software players? by guidryp · · Score: 1

      I didn't say it would be a wise move. But when do the studios make wise moves when it comes to DRM?

      The DRM on BD/HD is insane. I would consider a BD drive for my computer when they get to ~$300 except for one thing. I have DVI connected LCD display. None of my equipment is HDCP. This means I would get no picture at all. This is the reaction to the absence of ICT and digital displays. Play nothing at all.

      So as usual with the moron in the content industry, they only way I could play HD content on my current system is to seek out broken material online. Apparently BD/HD also disables your second screen during playback?? I have dual screens and I play video on one while using the other screen all the time. The point of this restriction is what??

      DRM is completely anti consumer, but the insane restrictions on BD/HD take the cake.

    6. Re:The end of software players? by Sancho · · Score: 2, Interesting

      Seems to me that the fix is obvious. Change the algorithm.

      What they need is to support public key for these things. Giving a unique key to every player, and forcing people to register their players, would mean that if a player key was cracked, they'd know exactly who did it and could file the appropriate charges. This would even help accomplish a wet dream of the MPAA--true region protection. Registration could use a variety of methods to check your location and ensure that you're using the correct region in the correct country. No one would dare sell their players to overseas folks for fear of their key being compromised.

      Well. It could work, in theory.

    7. Re:The end of software players? by Em+Adespoton · · Score: 1

      The problem with using the GPU is that, while the ABI isn't as open as on the x86 architecture, it's still possible for any software to read from and write to the GPU. This means that it is still possible to debug at the GPU level and intercept the key or the decryption stream there.

    8. Re:The end of software players? by RedWizzard · · Score: 1

      Ummm, how about no more new keys for software players. As long as there are software players it seems obvious that it will be possible to reverse engineer what they are doing to shake out the keys. But if the industry decides that SW players are too weak, they simply revoke keys for them and don't issue new ones. The end of software players and the end of the risk. Hardware players are basically just computers too. Especially devices like the PS3. It's entirely possible someone will be able to hack those as well.
    9. Re:The end of software players? by mrchaotica · · Score: 1

      Sure, until GPUs get infected with Treacherous Computing. But what then?

      --

      "[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz

    10. Re:The end of software players? by Anonymous Coward · · Score: 0

      Bunnie Huang. Vacation. Electron microscope. Bye-bye, key.

    11. Re:The end of software players? by darkmeridian · · Score: 1

      Yes. Dell, Sony, & Toshiba are going to be ecstatic over this.

      --
      A NYC lawyer blogs. http://www.chuangblog.com/
    12. Re:The end of software players? by hedora · · Score: 1

      If the MPAA puts a unique key in each player, people can still publish techniques to extract the keys from all players of a particular model. Then, people can buy the player (insecure players sell better; what a nice incentive for hardware manufacturers!), extract the keys, and share them with close friends and relatives. How's the MPAA to know that copy of the player has been cracked? They could revoke all keys for that model, but that gets them back where they started, with one key per model.

      Besides, people can still publish any non-player specific keys (per movie, or the processing key) online, and let people use those to decrypt content. This would let people buy movies without worrying about whether their DVD player / operating system has been de-authorized. The MPAA could protect against that by putting using a different set of encryption keys for each copy of each movie.

      This would still let people decrypt and share the movie online. The MPAA could protect against that with watermarking and mandatory registration of each DVD sold. Ignoring the fact that this may be prohibitively expensive (and has privacy implications), people could still decrypt the movie and put it online. When the MPAA came knocking they could claim the disk was lost or stolen.

      Unfortunately for the MPAA, it wouldn't come to that; there are no known, secure, digital watermarking schemes. In practice, DVD-rippers would simply strip the watermark before saving the decrypted content.

      In other words, this stuff has already been thought through, and mandatory registration doesn't help very much against small-scale piracy. Just like with DRM, these schemes just punish and annoy honest customers, making piracy more attractive.

    13. Re:The end of software players? by frieko · · Score: 1

      That doesn't work. No matter how many keys the player has and how much thrashing around it does, eventually it has to arrive at the key that goes to the actual data on the disc. You can't get around the fact that to play the movie, you have to decrypt the movie.

    14. Re:The end of software players? by Anonymous Coward · · Score: 0

      And then all of Microsoft's hard work on Vista's insane Rube Goldberg DRM would be for nothing. That would be awesome!

    15. Re:The end of software players? by Anonymous Coward · · Score: 0

      Hardware is just software? Great, let me know when I can download my new 8800 GTX from The Pirate Bay.

      Hacking software is actually pretty easy. It doesn't cost anything to install, duplicate, or use software tools like debuggers and emulators and so forth. Hacking hardware is a rather involved effort. When's the last time you ever heard of someone cracking open their computer, probing an integrated circuit, and going, "A-ha! I see! A cosmic ray disrupted the 492584th NAND gate in my CPU's cache controller! Well, that's easy to fix..."

      Don't fall into the trap that just because it all involves computers, it's all equally easy. Tamper-resistant key storage is impossible (or almost impossible) purely in software. Tamper-resistant key storage in hardware is in routine use today. Hardware keys are rarely compromised, if only because the economic cost of replacing broken hardware every time you brick your new shiny while trying to pry open the tamper-resistant chip package. No such barrier impedes software hacks.

    16. Re:The end of software players? by RedWizzard · · Score: 1

      Hardware is just software? Where did I say that?

      Don't fall into the trap that just because it all involves computers, it's all equally easy. I never said it was equally easy. I said it was possible. Try reading more carefully next time.

      The PS3 is the obvious target. It's quite likely that someone with access to a dev kit would be able find the PS3's key. And I really doubt Sony would revoke the PS3's key.

    17. Re:The end of software players? by melikamp · · Score: 1

      Your post advocates a

      (X) technical ( ) legislative ( ) market-based ( ) psychological

      approach to making DRM effective. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

      (X) It seeks to circumvent the laws of physics and logic
      ( ) It has been tried before and it was never shown to work
      (X) It will be cracked as soon as there is a demand for the protected content
      (X) It suffices to crack it once to obtain any number of completely unprotected copies
      (X) Consumers will not put up with it
      ( ) Publishers will not put up with it
      ( ) It is based on the optimistic assumption that people enjoy a fair deal more than an unfair freebie
      ( ) It requires immediate and total cooperation from every hardware manufacturer
      (X) It will be widely percieved as a defect or a lack of functionality
      ( ) Illegitemate copies are still cheaper

      Specifically, your plan fails to account for

      ( ) Laws expressly prohibiting it
      ( ) Laws being different in different countries
      ( ) The greed of publishing companies
      ( ) Technically illiterate politicians
      (X) The cryptographic keys being necesserily availbale to the content player
      (X) The analog hole
      ( ) MP3 and other unprotected formats being entrenched as the de-facto standards
      ( ) Chinese generic hardware

      The following philosophical objections may also apply:

      (X) Legitimate users will still be harmed
      ( ) The publishers have nothing to gain from it
      (X) It will stop copying for two weeks and then we'll be stuck with it
      ( ) People hate paying more than they feel is fair even if they like you
      (X) Sharing culture should be free
      ( ) Feel-good measures do nothing to solve the problem
      (X) We don't want the government or the publishers to control our electronic devices

      Furthermore, this is what I think about you:

      (X) Sorry dude, but I don't think it would work.
      ( ) This is a stupid idea, and you're a stupid person for suggesting it.
      ( ) Nice try, assh0le! I'm going to find out where you live and burn your house down!

    18. Re:The end of software players? by mgblst · · Score: 1

      This is a great point, and probably the only thing saving software playes is the very fact that annoys most of us - two different formats. For the first one to deny software players, will be cutting there marketshare, giving a boost to the other. A tricky situation for the organisations behind each format.

    19. Re:The end of software players? by asuffield · · Score: 1

      But if the industry decides that SW players are too weak, they simply revoke keys for them and don't issue new ones. The end of software players and the end of the risk.


      You appear to be assuming that nobody can break a pure-hardware 'protection' scheme, even when they have motivation to do so. The existence of many modchips (and even chipless hacks) for the PS2 and xbox systems disproves this. Just because software engineers don't normally know how it's done does not mean that reverse-engineering hardware is any harder than reverse-engineering software.
  54. So the format wars are over :) by Tru-One · · Score: 2, Interesting

    Now I can buy any format and just rip it to another one, great idea for sure!

  55. Print 'em up! by Dunbal · · Score: 4, Funny

    Now it's time to print up all those T-Shirts with the Processing Key:

    09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0...

    Available for just $19.95 ;)

    --
    Seven puppies were harmed during the making of this post.
    1. Re:Print 'em up! by HTH+NE1 · · Score: 2, Interesting

      I think it would look much better arranged thus:

      09 F9 11 02
      9D 74 E3 5B
      D8 41 56 C5
      63 56 88 C0


      though preferably with a font that won't confuse Ds with 0s, Bs with 8s, Es with Fs, and As with 4s due to fading. Using lowercase letters you only have confusion between bs and 6s:

      09 f9 11 02
      9d 74 e3 5b
      d8 41 56 c5
      63 56 88 c0


      Then a few variant forms depending on the direction your language traditionally reads, but also allows for other glyphs with less confusion.

      (Interesting that there are no As in the key.)

      If the key changes, we could refer to this key (and disks encoded with it) with the shorthand FDebDCC, named for the alphabetic hexits in the key. Other keys' alphabetic contributions should be sufficiently random for reference.

      --
      Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?
    2. Re:Print 'em up! by Anonymous Coward · · Score: 0

      09 f9 11 02
      9d 74 e3 5b
      d8 41 56 c5
      63 56 88 c0

      Then a few variant forms depending on the direction your language traditionally reads, but also allows for other glyphs with less confusion.


      The "right direction" is top-to-bottom then left-to-right since this is a 128 bit AES key. They order it that way because the algorithm is oriented toward 32-bit hardware, so the key reads left-to-right as expected, except each column is a 32-bit word. See FIPS 197 for details.

    3. Re:Print 'em up! by Anonymous Coward · · Score: 0

      09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0...

      Hey! I have exactly the same combination on my suitcase!

    4. Re:Print 'em up! by Jesus_666 · · Score: 1

      If the key changes, we could refer to this key (and disks encoded with it) with the shorthand FDebDCC, named for the alphabetic hexits in the key. Other keys' alphabetic contributions should be sufficiently random for reference.

      If someone creates a new container format for HD-DVD/Blu-Ray rips, using 0xFDEBDCC0 as the magic number would be a nice touch.

      --
      USE HOT GRITS WITH STATUE OF NATALIE PORTMAN (NAKED AND PETRIFIED)
  56. Its all about the average Joe by PPalmgren · · Score: 3, Insightful

    There is a reason for DRM, even if it inherently flawed in design: to keep the average Joe buying your stuff. If they stop fighting completely, you'll end up with a flopped industry. The bigger the investment they put into DRM, the more returns they get from sales, because not everyone is computer literate. The more technical they make their schemes, the more people they get buying their product instead of stealing it. Gross value goes up, even if net stays the same. Lawsuits and copyright protection are designed to scare the AVERAGE consumer away from illegal activity and narrow the possible copyright infringement targets down to a manageable size, so they can treat it exactly like cops treat druggies: go for the dealers. Copyright protection in some form or another will never die out, because if it does, a larger percentage of the population will steal the product and it will cease being a manageable problem for them.

    1. Re:Its all about the average Joe by Anonymous Coward · · Score: 0

      I think you're missing the point.

      Once the movie is decrypted, it's on the net. And, trust me, average Joes who want to get the wares for free already know where to look for mp3s and divx.

      You can't lock up all the (many) hackers with the capability and the willingess to crack DRM systems.
      You can't scare the average Joes from getting the stuff for free on the net if he wants to.

      That's why DRM is a complete waste of money.

    2. Re:Its all about the average Joe by Kjella · · Score: 1

      That works as long as Joe Average is bound to his own medium. If he wants to swap&copy DVDs with his friends, DRM works. Want to download it off the Internet? No problem, the DRM is long since removed. There are enough examples around the world to know that we can deliver >10MBit broadband to large parts of the world at reasonable prices if there's solid competition. At that point, you're fighting on legal threats and convienience. Legal threats hardly ever function when there's such a mass disregard, and DRM won't help either. All they can really pray for is that noone finds a way to only hook Joe Average up with releases from serious release groups, but I think they're in trouble there already...

      --
      Live today, because you never know what tomorrow brings
    3. Re:Its all about the average Joe by senatorpjt · · Score: 1

      I'd think it would work the opposite way. Say you hear someone playing a song. If the song were free to be copied, you could just get a copy of the song from the person playing it. If the song has DRM, you have to get it off a P2P network. Then, all of the band's other songs show up in your search. So, if you might have bought the album in the first case, you already have their entire catalog in the second. As to the drug dealer analogy, it's the difference between allowing pot to be sold legally, versus having people buying pot from drug dealers that also sell crack. Allowing person-to-person transfers of tracks in this way keeps them from having to go to the P2P networks in the first place.

    4. Re:Its all about the average Joe by Godman · · Score: 1

      I gotta say this (no idea if its been said)

      There's 3 types of people when it comes to media like this...

      1) Grandma Wilson, who buys everything legally, thinks a torrent is a large amount of rain, and wouldn't know an AVI file if it bit her in the ass.

      2) Joe Sixpack, who pirates his media, but either lacks the technical skills to rip Grandma Wilson's DVD collection for his own use, or the will too (he can get it easier off The Pirate Bay or wherever)

      3) Joe Hacker, who tags himself online with along with a bunch of other guys with names like Xor or NoTV... these are the guys stealing the DVDs outta the pressing plant, ripping them, and putting them out before the retail DVD even gets shipped. It works its way down to The Pirate Bay, where Joe Sixpack downloads it.

      Now in this scenario, Grandma Wilson is the only one giving money to the content owner. Your argument that DRM will prevent Joe Sixpack from "stealing" the content because he lacks the technical skill to rip a Blu-ray disk is about as valid now as it is for DVDRips now... the average guy doesn't know how to rip a DVD and make it into the 700 meg AVI file he torrents. Same with Blu-ray/HD-DVD... we've seen that Joe Hacker fixed it so he can rip em.... he's the one what's gonna turn it into whatever file he puts up on the topsites before it filters down so Joe Sixpack can grab it. Nothing changes, except that maybe Joe Sixpack goes "huh, Batman Begins in isn't up in HD yet, wtf" and waits a few months for it to be cracked.

      NOTHING has even remotely changed. Even if you make DRM the most hardass thing you can.... all Joe Hacker has to do is crack it, and rip it. Now EVERYONE can steal it.... DRM does abso-fucking-lutely nothing except make it more difficult for Joe Sixpack or Grandma Wilson to back up their rightful purchase.

      --
      I have this really funny quote that I like to put here. Unfortunately, there's this really annoying thing called a char
  57. Can anyone clarify how it works? by Kadin2048 · · Score: 1

    I believe that you're correct (and Wikipedia agrees with you at the moment, saying "the fully automated solution for decrypting HDDVD/BluRay is yet to be done with this approach"), however I've yet to see a really good explanation of how today's crack actually works. There seems to be a lot of conflicting terminology at work; VUK, "processing key," "media key," etc.

    My understanding of AACS, gleaned from Wikipedia and other sources, is as follows: the whole thing begins with several keys. One is a title key, which is generated for each movie (or one pressing of a particular movie), and is actually used to encrypt the video stream. Then, there is a Volume Identifier, which is basically a serial number on each pressed disc, located on a part of the disc which can't be written to by consumer disc writers (just like on DVD discs). The Volume ID and the title key are combined (or hashed); I think this combination of the two is what's being called the "Volume Unique Key" (VUK).

    In order to make sure that only approved players can decrypt this whole thing, the VUK is encrypted using a randomly generated, per-title key provided by the AACS people. This key (the one used to encrypt the VUK) is called the Media Key, and it's not provided on the disc in the clear at all. It's provided as part of a "Media Key Block," which is the Media Key, encrypted with all the current player keys (so, it's there several hundred times at least, one for every model of approved player).

    On the receiving end, the player reads the disc and extracts the Volume ID, the encrypted VUK (which the AACS documentation refers to as the Encrypted Title Key), and the Media Key Block. It gets the Media Key from the Media Key Block by using its secret Device Key, and then uses the Media Key and the Volume ID to decrypt the Encrypted Title Key, and get the Title Key. And from there, plays the video.

    What I don't quite get, though -- and it would be great if anyone could fill me in, here -- is how today's crack fits into this whole scheme. What the crack seems to provide, is a way of producing a VUK for any disk, given the Volume ID, which is transmitted from the drive to the host computer in the clear (and is stored on the disc in the clear). But I don't see how this is possible, since the VUK also depends on the Title Key -- and if you know the Title Key, you're already done.

    Anyone want to take a stab at explaining how the whole thing works, in something approaching understandable (or at least consistent, defined) terms? The Wikipedia article is not a lot of help right now.

    --
    "Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
    1. Re:Can anyone clarify how it works? by 91degrees · · Score: 1

      Thank you for the excellent summary of how AACS works.

      As far as I understand it, this hack gets the VUK. Now, I'm guessing that this will only work for any disc that the specific software player will play. It's simply that the hacker now know where to look in memory for the key. This is quite nice because it means that if they keep the player that produced the key secret, the AACS people can't revoke the key for a specific player (because they don't know which one was compromised). It also means that for any other software player, they have a reference code so they know where it's stored, or where the pointer is, or where the pointer to the pointer is...

  58. Awesome! by Anonymous Coward · · Score: 0

    That means Miss Congeniality 2 will be availble in HD to download soon...

    1. Re:Awesome! by Anonymous Coward · · Score: 0

      Yes, but it still means you are thief and you should burn in hell for it.

    2. Re:Awesome! by Anonymous Coward · · Score: 0

      Yes, but it still means you are thief and you should burn in hell for it.

      I'm an Athiest. Stop pushing your pious religeous beliefs on me.

  59. Books are very different by Anonymous Coward · · Score: 2, Interesting

    -It is more expensive to print out or photocopy most books than it is to buy them.
    -Prints are inferior because they are hard to bind well.
    -Electronic copies don't appeal to most readers because the display is uncomfortable (though I'm fine with it.)

    In the few areas of book publishing where book prices exceed the cost to print up a tolerable copy, or where the original is incovenient to buy, book piracy is common. Most university textbooks and many reference volumes are available online. You can download complete archives of many comic book series.

    Piracy aside, book publishers aren't exactly doing well in our economy. What the music industry can do that the book industry has trouble with is convince millions of people they have to own *this CD*, not any other CD. What has music industry execs terrified is the fear that the children who are five years old today will have too many choices available from their PCs in seven years, and they won't enter into the teen music mentality that dominated the late 20th century and trained most adults to keep buying RIAA titles. Restricting choice through DRM or whatever else they can dream up is their only hope.

  60. Microsoft and Apple DRM too? by hey · · Score: 1

    What about the beloved Microsoft and Apple DRM?
    Is it cracked too?

  61. Close...minded. by Anonymous Coward · · Score: 0

    "But then the studios wouldn't have as much money to promote their latest offerings -- hey, buying hookers and coke for DJs and movie critics is expensive!"

    So Peter Jackson was snorting cocaine instead of making a multimillion dollar movie.

    "CDs and DVDs can be stamped out for less than the cost of recordable media. If the **AA would price recorded CDs and DVDs at less than the cost of blank media, then there would be very little unauthorized copying!"

    All I have to say is you guys are fools! Period.

    "We don't copy books because books can be purchased for less than the cost of printing our own copy."

    There's also the time and effort to getting a perfect copy

    "CDs and DVDs can be stamped out for less than the cost of recordable media. "

    And code can be cranked out cheaply too. Now why do we pay all you programmers so much? Oh, right. Cost of creation. Maybe we all should pay you what you're really worth. The price of one thin CD.

    1. Re:Close...minded. by Em+Adespoton · · Score: 1

      Hey! I've got the perfect solution for movie publishers! Do what book publishers do... provide the movies as flip-books :)

  62. Good by nurb432 · · Score: 1

    Now i can watch the movies that I freaking paid for, on any device i want.

    The whole concept of keeping me from the content i paid for is ludicrous, and is why i dont support IP of any kind now.

    --
    ---- Booth was a patriot ----
    1. Re:Good by Anonymous Coward · · Score: 0

      Yeah, but are you stingy? Or do you share? See, I want your movies too. I shouldn't have to pay for them, that's what the Internet is for - so you can share them with me.

      After all, if you can play them anywhere, what's wrong with playing them on my machine?

      What part of sharing do you not get here?

  63. Is it just me... by Siener · · Score: 1

    ...or does every single DRM related story of the past few weeks deserve a big fat OBVIOUS tag a la fark.

  64. A future without industrial movie by viking2000 · · Score: 0

    Not to sound like a spokesperson for the movie industry, but their only options are:
    1. Agressivley protect their content with DRM and lawsuits
    2. Go out of business

    They will probably go out of business anyway, and are stuck between a rock and a hard place.

    The way it will look in some years is probably:
    1. Few movie budgets over say $1M. Just no ROI
    2. No mega rich movie stars.
    3. No mega rich rock stars.
    4. most content is direct from producer to you. See youtube

    This is probably overall good and will not kill the music or movies. We will probably see an exponential growth in sophisticated works of art available for a fair price. See http://allofmp3.com/ for example

    1. Re:A future without industrial movie by Anonymous Coward · · Score: 0

      2. Go out of business

      Care to explain why?

      Everybody has had the possibility to get their wares (and the RIAA's) for free for 5 years, and more have had the capability than haven't. Last I heard, they're still around. So's the music business.

      There's 3 reasons they're still pushing DRM:
      - they want to prevent pricing arbitrage. This doesn't require DRM.
      - they have wet dreams about pay-per-view/pay-per-play schemes that (they believe) DRM could make possible.
      - it's easier to go to the shareholders and blame the 'net and look manly, fighting tooth and nail and all that than it is to start getting the axe and sort out their industry.

    2. Re:A future without industrial movie by slim · · Score: 1

      Not to sound like a spokesperson for the movie industry, but their only options are:
      1. Agressivley protect their content with DRM and lawsuits
      2. Go out of business Nonsense. It's been trivially easy to copy DVDs for years. Have the studios gone bust? No.

      Many people like to go to the cinema.
      Many people like official packaging.
      Many people like to feel honest.
      Many people would prefer to spend money than fiddle with DRM workarounds.

    3. Re:A future without industrial movie by Erwos · · Score: 1

      From what I've read, AllOfMP3 isn't actually compensating anyone for much of anything. Claiming that it's a fair price is a bit disingenuous - I'm sure consumers love it, but no one actually consulted the artists or publishers about it. Fair typically connotes some sort of "agreement", which is not really what happened.

      As for "we will probably see an exponential growth in sophisticated works of art available for a fair price.", that seems rather unlikely. If everything's just totally free and legal to trade around, who's going to pay for anything? What's my incentive to produce these works, period, let alone something that's going to cost a million bucks? Ego only goes so far, and ego-driven art doesn't usually produce great results (seen Rocky Balboa?).

      I'm not a big DRM fan, to say the least, but these giant industries didn't come into being because no one wanted them. Clearly, there was and is demand for these huge blockbusters and big musical artists. I'm not sure how we're advancing the arts when it seems like we're regressing in renumeration and funding.

      --
      Plausible conjecture should not be misrepresented as proof positive.
    4. Re:A future without industrial movie by SaDan · · Score: 1

      If they go out of business, is that really a bad thing?

      Sounds just what we need to get rid of the crap we see on the big screen these days, and get smaller studios competing with original content and better actors.

    5. Re:A future without industrial movie by whitis · · Score: 1

      You give the industry bean counters far too much credit. If you (for reasonable values of "you") go down
      to the store and movies are priced at $6 each, you walk out with 5, spending $30. If they are
      priced at $20 each, you walk out with one ... or zero - spending an average of say $10. So, if they
      price the movie reasonably, they get half of $30; if they overprice it, they get half of $10.
      If movies are overpriced, consumers rent, share, copy, buy used, have movie parties, watch the same movies repeatedly, do without, choose a more cost effective mode of entertainment, or simply do without. Also, in much of the world they buy bollywood instead of hollywood. Meanwhile, they have to spend big bucks on marketing (including big bucks on brand name stars) to recoup a fraction of the market they have killed.
      And because of the big bucks, they are afraid to take any risk and so turn out the same old formulaic shit.

      The added profits of raising the price, preventing copying, etc. are an illusion. They love to multiply the number of copies by the retail price of the movies and call that lost profits but the underlying assumption that the copiers had both the money and the inclination to purchase an original is wrong in the majority of cases. They also look at profit per copy sold and neglect the effect of price on number
      of units sold.

      Meanwhile, they fail to give an upgrade price (i.e. trade in) for DVDs or VHS which, along with the copy protection hassles, not only discourages people moving to HD formats it makes people somewhat reluctant to buy DVDs today. One company came out with double sided combo disks with DVD on one side and HD on the other; warner has announced they will be using that format (saves space on retailer shelves, too). At current rates of adoption, HD-DVD and Blu-ray may well be superceded by holographic or polarization based disks before they are a widely adopted, while those may offer diminishing returns for movies (at least originals) they are a lot better for backing up your computer.

      The ability to copy doesn't substantially hurt sales of reasonably priced products. Books are still sold. VHS movies sold well in spite of being trivial to copy. Stupidity and greed hurts sales. The ability to copy keeps corporations honest. We have seen the great lengths corporations will go, implementing copy protection and buying politicians, just to avoid being honest. Look what happened to US automakers when they resorted to buying politicians instead of producing fuel efficient cars; their sales tanked.

      And the much feared "perfect digital copy", that is the basis of much corrupt policy, doesn't seem to be much of an issue in the real world. I suspect an order of magnitude more DVD's have been copied compressed onto single layer media ($0.30) than double layer media ($2.00). This tells us a lot about the perceived worth of a copy, the discretionary income of the copiers, and/or the perceived worth of the movies that are copied rather than purchased. In many cases, it also is an indication that the copy is just a stop gap measure until one can afford the original. Copiers often happen to movie buffs who provide value to the movie industry by promoting those movies which are actually worth promoting. And I think we will see a lot of HD movies copied onto single layer DVDs as well. Yeah, you get "perfect" copies of single layer disks; that just means the original was an imperfect copy to start with.

      You are right that the art of movie making will survive, even if there were real actual profits to be lost. I have seen perfectly good movies made for as little as $4000 and there are a lot of good movies made for under a million. The more modest budgets even force people to solve problems artistically rather than just throwing money at the problem. There are some types of movies that actually require expensive special effects such as the Lord of the Rings trilogy, Perfect Storm, a lot of science fiction, etc. to t

    6. Re:A future without industrial movie by Anonymous Coward · · Score: 0

      Audio cassettes were extremely successful, and copying them was trivial. CDs are easy to copy these days as well, and the sales don't seem to be plummetting as much as you'd expect considering the alternative to buying them is free.

      Most people don't copy movies. Hell, most people don't even seem to bother with multi-region DVD players.

  65. All TPM implementations will be broken. by Anonymous Coward · · Score: 0, Informative

    Then I guess you better call up IBM and tell them just how much smarter than them you are. I'm certain they would have never thought of an acid bath, or an electron microscope.

    BTW to the poster who asked: when will media companies give up? I'll ask, when will people stop trying to get content without paying for it?

  66. usually 5 minutes after the devices go on sale by swschrad · · Score: 1

    they'll be cracked. FairPlay (apple iDRM) contravention may even be a retail product Real Soon Now. at least in the nordic countries.

    the only way to make this stuff secure is to put it in a vault, fill the vault with hydraulic concrete, cut off all the wires into the vault and push 'em through the holes before the stuff cures, and site crew-served weapons all around the vault.

    then it doesn't work. but it's secure.

    you know, maybe HelliWood might just decide that since you can't duplicate analog to 200 generations, they'll bring back vinyl LPs, film, and they'll get their evil satisfactions by owning all the needle and projection-bulb companies.

    until they do go retro, all they are doing with DRM and magic security boxes are royally pissing off the Joe Sixpacks out here that they want to sell stuff to. uhh, make that "rent limited private usage rights to." the only way you buy entertainment is with the suits on one side of the boardroom and the artists on the other side. history says the artists get the short end of the straw no matter what the media or the ultimate usage of the product.

    --
    if this is supposed to be a new economy, how come they still want my old fashioned money?
  67. Economics 101 (was: Cue Nelson) by mandelbr0t · · Score: 1

    AACS took years to develop, and it has been broken in weeks. The developers spent billions, the hackers spent pennies. Ah, another Robin Hood story. Does the heart good, it does. Unless you're working for Dick Cheney. Seriously though, given that many of the political struggles surrounding DMCA are bordering on economic warfare, this is a clear victory for the Good Guys!
    --
    "Please describe the scientific nature of the 'whammy'" - Agent Scully
    1. Re:Economics 101 (was: Cue Nelson) by CyberLord+Seven · · Score: 4, Insightful
      I consider it a victory though I don't have, nor plan to have, a High Definition player. I have an HD TV, and an XBox 360.

      Why won't I buy the $200.00 HDDVD player from MicroSoft?

      Well, I've said it before, and it bears repeatin'...

      I'll buy new content when those ASS-WIPES in Hollyweird stop putting advertisements in front of the movies on DVDs! GODDAMN, I'm SICK of wading through bullshit ads for movies that stopped playing in theatres years ago when I watch an old DVD.

      Pull out your Matrix DVD or your 2001: A Space Odyssey DVD and insert it into your DVD player or PS2. What happens? THE MOVIE starts to play, doesn't it?

      Now try that with any DVD you bought in the last three or four years. Pisses you off, doesn't it? Yeah, me too.

      They can KISS MY ASS! Even though I'm not buying their HD disks I'm still laughing my ass off at this and looking forward to more penetrations of their security. (Hey, this is Slashdot. We gotta' have pron! Just not HD Pron. Pimples and hairs where they shouldn't be. YEECH!)

      --
      We have always been at war with Eurasia!
    2. Re:Economics 101 (was: Cue Nelson) by ZarkOmicron · · Score: 1

      A DVD I recently watched had an add for either HD-DVD or Blu-Ray (I believe I've seen one of each and I'm not sure which this was) that mentioned as one of the selling points that it would play the movie immediately.

    3. Re:Economics 101 (was: Cue Nelson) by MyOtherUIDis3digits · · Score: 1

      I'll buy new content when those ASS-WIPES in Hollyweird stop putting advertisements in front of the movies on DVDs! GODDAMN, I'm SICK of wading through bullshit ads for movies that stopped playing in theatres years ago when I watch an old DVD.

      Just click the "Jump directly to movie" checkbox in ripit4me when your next Netflix shipment arrives! Fscking sweet!

      Oh, wait... You aren't actually buying them, are you?

      --
      Ignore anything I said above, I actually agree with everything you believe - mod accordingly.
    4. Re:Economics 101 (was: Cue Nelson) by encoderer · · Score: 1

      In other words, it said "Upgrade and you won't have to sit thru any of this shit!"

      I saw it, too. it's for HD.

      The bitch is that you KNOW they could do that with standard DVD. Like the extra 30GB of storage somehow unlocks the ability to immediately begin playing the move as soon as you spin the disk.

    5. Re:Economics 101 (was: Cue Nelson) by russ1337 · · Score: 1

      My DVD player actually does this - its an LG something. It's in the setup - It just finds the longest track and plays that. Great for movies, but if you're watching a series it'll play the longest episode unless you remember to press the menu button.

    6. Re:Economics 101 (was: Cue Nelson) by brandond1976 · · Score: 1

      This was actually one of the considerations taken into account when designing HDDVD, and you can rest assured that your pet-peeve will probably cease to be a problem within the next year. The specification is designed so that content can be referenced from the disc or the network. The idea was that studios could include trailers from the network, that way when you watch the movies (even in 10 years) you will see trailers for upcoming movies.

    7. Re:Economics 101 (was: Cue Nelson) by butane317 · · Score: 1

      It is for this reason that I actually prefer to burn my own copy of a movie than to own the original. I use DVD Shrink (on Linux :) to rip ONLY the movie off of the disk and burn it. No menu, no nothing, you put it in and it just starts playing. Why would I want any of that other shit? My girlfriend works at a movie rental place, so we get free, unlimited movie rentals. If there's one we really like and want to keep, we just burn. It's simple economics, if a customer isn't satisfied with a business they're not going to buy anything from them. The movie and record businesses haven't figured this out yet, and think that it's just people trying to cheat them out of money. No, if the original was worth having (which it is in many situations) consumers would buy it.

    8. Re:Economics 101 (was: Cue Nelson) by statusbar · · Score: 1

      Why are all the responses to your post truncated???

      --jeffk++

      --
      ipv6 is my vpn
  68. "...trying to get content without paying for it?" by Anomalyst · · Score: 5, Insightful

    I have paid for every single DVD I own. No good deed goes unpunished, I am repeatedly subjected to unskippable previews, FBI warnings, commentary disclaimers and the same fscking flying logo and equally annoying jingle at 4 places before actually getting to the content I purchased. If I were stupid enough to buy into HD/BR I additionally lose my control over the resolution I want. This isn't about Imaginary Property rights, it's about THEIR control of MY property.

    --
    There is no right to feel safe thru security vaudeville at the expense of everyone's freedom, privacy and tax money.
  69. Titanic by Overkill+Nbuta · · Score: 1

    I cant belive they keep making things that are forsure. This DRM is uncrackable. This ship is unsinkable. I just hope this DRM has enough lifeboats to save everyone from this stupidity. Give up trying to make uncrackable. Save the money, lower the prices of DvD's and im can tell you if my DvD's were 5 bucks cheaper i would be alot more enticed to go out and buy a copy compared to watching a lower quality ripped version. Give up now there will always be something that will break you.

  70. Non-TPM boxes by burndive · · Score: 2, Interesting

    Not to mention the fact that someone is going to realize there is going to be a _HUGE_ market for NON TPM boxes...

    The problem will be that they stop releasing HD players for non-TPM boxes. They will simply drop support, and tell you that if you want to play HD movies, to "upgrade" your hardware to their satisfaction. The only thing that will stop them from doing so is if they realize that the customers are on to them, are specifically avoiding TPM hardware, and that there are enough of them out there that they are cutting into the bottom line in a way that significantly comprimises their long-term market position.

    The record companies, for example, are taking the long view of DRM for music: they are willing to wait for the CD to become obsolete while forcing DRM on the next generation (digital distribution), even though forcing DRM on digital distribution severely hampers adoption of digital distribution. The only thing that will change their strategy is if they realize that the market will *never* go digital enough for them to not have to release their content on CD until they drop DRM.

    I doubt that the market for non-TPM boxes will be "_HUGE_" enough for the MPAA to abandon their plan to require it unless every-day consumers feel the sting of DRM in their every-day use.

    The best way for this to happen is for devices to proliferate the market wich take advantage of the crack-ability of CSS: players that take ripped DVDs, store and organize them, and are as simple and intuitive as Apple products: it has to be an appliance.

    --
    ...because "hacker" sounds way sexier than "code drone."
    1. Re:Non-TPM boxes by demallien2 · · Score: 1

      No. DRM on video will never work. Ever.

      Why not? Simply because flatscreen monitors are quickly replacing CRT screens, and consumers will not accept going back. This means that anyone that is willing to replace each little LCD pixel with a recorder will be able to faithfully record the entire program.

      Cost? One cheap LCD screen, + soldering gear + salary of one bore Russian hardware hacker for 3 months~= $10000

      Admittedly, there will be a very small loss in quality, but this isn't the bad old days of analog VHS. Once we have the slightly degraded copy, it's encoded digitally, and there will be no further loss.

      Furthermore, the price is sufficiently low that someone will do it just to annoy the MPAA.

      The attack is always against the weakest point of the system. Flatscreen display technologies are inherently digital in nature, and hence inherently capable of being recorded digitally. As no-one is going to give up flat-panel displays, video DRM is dead before it's even really got started.

      Which of course brings us back to the starting point of all DRM discussions: what's the point? It won't stop the pirates. But it will stop honest users from being able to transfer the media they have paid for to a new platform. No, no, no, you have to pay again!

      One of these days, the public is going to figure this out, and DRM will be banned by law. Until then, I for one will be buying my DRM encumbered media, and then legally (as I have already paid for the media) downloading an unencumbered copy off the Net...

      What a waste of time for nothing.

  71. i don't know what you are trying to say by circletimessquare · · Score: 1

    maybe that you are an eMule user?

    --
    intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
  72. the information in this case by way2trivial · · Score: 1

    being encryption keys to no longer allow.
    real useful.

    --
    every day http://en.wikipedia.org/wiki/Special:Random
  73. No, I'd pay cash for my copy. by HornWumpus · · Score: 1

    What you suggest requires more fundamental changes in the world.

    --
    John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
  74. BD+ anybody? by DuBois · · Score: 1

    Hmmmm.... Cracking AACS is just the first attack on Blu-Ray. They have BD+ held "in reserve", right? Or was BD+ left out of the final spec? I have a feeling that the fine folks behind Blu-Ray (those rootkitting folks from Sony) knew AACS was gonna bite the dust quick, so they put BD+ in there as backup insurance.

    --
    The IPCC has purposely engineered a massive scientific fraud.
    1. Re:BD+ anybody? by Harik · · Score: 1

      BD+ is just a method of small-batching production. Hundreds or thousands of disks per content key rather then millions. If I buy two copies of King Kong, they may not have the same key... but it doesn't help, since content ripped once is content ripped forever.

  75. Nope, it's really busted. by Anonymous Coward · · Score: 0

    "and then we sit back and watch a (small) mob storm movie execs because they can't play their HD movies with their brand-new $1,000 Blu-ray drives."

    Is there some reason the obvious keeps passing you all by? Is dick-waving really that important to you? All they have to do is take the disk back to point of purchase, and get a new one with new keys. What you all also forget is that the world has changed markedly since the days of crackable games. Always-on (or nearly) are widely available. Being intouch is much easier. Computers courtesy of Moore's law have more power, are getting smaller, and storage is doubling each year. A scheme that keeps the majority honest is quite possible. It's how it's managed that seems to be the problem. Not technological issues (note that most schemes that have been broken is due to human failure).

  76. What's the bandwidth of a van full of HD movies? by Anonymous Coward · · Score: 0
    Whenever I rent a DVD I make 10 copies or so on principle.

    So when does HD-shrink ship?

  77. NOW... by cosmocain · · Score: 1

    ...they got something for their news-page.

  78. 2400 bps, Luxury! by HornWumpus · · Score: 1

    You don't want to know.

    --
    John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
  79. Question for you by tacokill · · Score: 1

    As smart as "they" are in building TAMPER resistant chips, explain to me how the TPM chip knows whether or not it is in virtual environment?

    Tell me why a software version of the TPM chip is not possible.

    If you can explain that, I might agree with you more than the parent you replied to. However, until I hear an answer, I am decidedly with the parent post. Given enough time, even the TPM can be reverse engineered.

    1. Re:Question for you by dpilot · · Score: 1

      The TPM chip alone doesn't really do spit. It needs to be combined with a TPM-aware BIOS, so that "trust" is established prior to any possible running of "external" software, including virtualization. I suppose even this doesn't save you if you replace the BIOS chip. Before you say "reflash" I would suggest that the BIOS/TPM link would have been engaged prior to being able to flash, giving the opportunity for either integrity checks or retaining an un-flashable TPM area.

      I suspect getting past a software-only attack is the highest priority, and with a TPM chip and TPM-aware BIOS you can have that.

      --
      The living have better things to do than to continue hating the dead.
    2. Re:Question for you by Anonymous Coward · · Score: 0

      > explain to me how the TPM chip knows whether or not it is in virtual environment?

      Because the hardware boot sequence initializes it in a way that the software boot sequence cannot. If it finds itself replaying the boot sequence, it knows it's being emulated. Resetting the TPM requires halting it entirely, which means it has to be cold booted again.

      You really do have to dig it out of the chip, either with a scanning tunneling microscope, or through fault analysis, both of which require just a little bit more than the usual degree of physical access, and have unfortunate tendencies to destroy the chip itself.

    3. Re:Question for you by Anonymous Coward · · Score: 0

      A homebrew scanning tunnelling microscope is a high-school science project nowadays.

  80. Did too! by Ungrounded+Lightning · · Score: 1

    Trains put buggy makers out of work, did the governments do anything?

    Yes, they did: Laws like: "When two trains approach each other at a track crossing, each must stop until the other is clear." (Not an error: A deliberate attempt to make it impossible to run the railroad legally.)

    Similarly (when automobiles were putting buggy makers out of work): Laws like the one requiring a man with a red warning flag to precede the auto.

    Of course they didn't work. B-)

    Things like DMCA are the same thing revisited.

    --
    Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
  81. NOW I'll upgrade by Anonymous Coward · · Score: 0

    MPAA take note: Now that we have fair use back, I will upgrade to HD-DVD and buy media. Well, as soon as blank media for legal backups becomes cost effective.

    Arnezami, you have the appreciation and admiration of many legitimate consumers of media around the globe. Thank you for your efforts.

  82. Not upgrading PowerDVD will NOT beat revocation by Anonymous Coward · · Score: 0

    This is a rampant misunderstanding; it's the other way around: AACS *doesn't* do revocation by *adding* revocation lists to content. AACS actually encrypts the volume keys separately for *every valid player key*. When a player key is revoked, that player can no longer decrypt the volume keys, and consequently can't decrypt the content either.

    So the way AACS works, the new PowerDVD will be the only one that "works" after the predicted key revocation. If folks want to keep using it to crack disks, they'll have to get past whatever walls the programmers put around the key storage mechanism.

  83. MOD PARENT Up! by tacokill · · Score: 4, Informative

    This is the real story here. Mod parent up.

    Essentially, what he is saying is this: while the crack is temporary, the method of attack is unassailable under the current model.

    That's whats important here. If keys get revoked, its a trivial matter to go get them again. The hard work has been done. Now all you have to do is follow procedures and -voila- you can crack AACS too.

    Despite other comments on this board, AACS IS cracked.

    1. Re:MOD PARENT Up! by Furry+Ice · · Score: 4, Insightful

      This is assuming the MPAA decides to allow software players to receive the new key. Granted, it would be seriously evil of them not to do so, but we *are* talking about the MPAA after all.

    2. Re:MOD PARENT Up! by Goaway · · Score: 1

      Only if you assume the player code will be unchanged and will not be tightened up to prevent this (very trivial) attack. Which is an extremely naïve assumption.

    3. Re:MOD PARENT Up! by rew · · Score: 1

      AACS is cracked!

      Not true. As long as they keep giving out keys to software players on PCs, yes. If they only allow tamper-proof hardware player to own keys this will hold up much longer.

    4. Re:MOD PARENT Up! by xenobyte · · Score: 2, Informative

      Actually they cannot refuse providing the new key to all licensed software players... the producers of these have a contract that - if broken by the MPAA - guarantees a major lawsuit for damages and loss of income. MPAA will be financially wiped out by just denying a new key to one major software player, let alone all of them.

      But then, hardware players can also be debugged just like a software player - it's a bit more cumbersome but it can be done or there would be no hardware players.

      --
      "For every complex problem, there is a solution that is simple, neat, and wrong." -- H.L. Mencken (1880-1956) --
    5. Re:MOD PARENT Up! by Jesus_666 · · Score: 1

      Also, if they locked out all HTPCs etc. they'd make their own media less attractive than streamed video - after all that doesn't magically not work even though the player is hardware compatible.

      The format war isn't just between HD-DVD and Blu-Ray.

      --
      USE HOT GRITS WITH STATUE OF NATALIE PORTMAN (NAKED AND PETRIFIED)
  84. Blu-Ray's number 1 fan by heroine · · Score: 1

    Now that you don't need a $2000 player and $10,000 plasma to play these things, it's time to say goodbye to DVD and splurge on BD.

  85. You can't open an integrated circuit. by TerranFury · · Score: 1

    The encryption is crackable only so long as there is not special hardware doing the decoding. Once the keys are hidden in embedded ROM inside integrated circuits, you won't be able to get to them without delaminating the IC -- which nobody but a chipmaker has the facilities to do.

    We will only succeed at cracking DRM so long as it is done in software, or we can look at the signals on PCB traces. Once this stuff happens inside a single chip, we really are screwed.

    1. Re:You can't open an integrated circuit. by Anonymous Coward · · Score: 0

      you won't be able to get to them without delaminating the IC -- which nobody but a chipmaker has the facilities to do.

      This: Tamper Resistance - a Cautionary Note, is specifically about smartcards, but it has interesting examples of non-invasive and invasive chip analysis. Sample:

      Functional tests with pay-TV and prepaid phone smartcards have shown that EEPROM content is not affected by hot nitric acid. No knowledge beyond school chemistry is necessary; the materials are easily available in any chemistry lab, and several undergraduate students have recently reported the successful application of this method on an Internet mailing list dedicated to amateur smartcard hacking. Fuming nitric acid is an aggressive oxidant and should be handled carefully (especially when using flammable liquids such as acetone), but it does not affect silicon, silicon oxide, silicon nitride, or gold as used on the chip and its contacts. The aluminium used in the metal layer of the chip is covered at once with a thin oxide layer and is also unaffected. Nitric acid is commonly used anyway to clean chip surfaces during manufacture.

  86. And Sales Skyrocket by Nom+du+Keyboard · · Score: 1

    Sony was just touting that BluRay was outselling HD-DVD by 2:1. Now watch sales skyrocket!

    --
    "It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
  87. Its all about the rock and hard place. by Anonymous Coward · · Score: 0

    I don't know if you've read Alvin Toffler but you'd think that a room full of people that makes it's living with information would have. This issue is MUCH, MUCH bigger than just movies, or music, or even games. The very foundation of the information economy could be indermined by the attitudes that drive piracy. At least with the industrial age, there were natural barriers to how much damage greed could do. Not with digital. Combine that with the overall breakdown in social mores, and you have a recipe for disaster, because we can't go backwards, and forwards is playing right into societies failures. Something to keep in mind as we all gloat over our "victory".

  88. Mission Accomplished! by tacokill · · Score: 1

    Mission Accomplished!

  89. Excuse me. I can't let that go. by Xodmoe · · Score: 1

    The more technical they make their schemes, the more people they get buying their product instead of stealing it.

    Please stop that.

    Sharing, whether un-authorized or otherwise ought not to be mis-characterized as stealing. It is not stealing anymore than murder or rape.

    ...or consumption of forbidden fruit - which seems to be closer to the MPAA's worldview these days.

    My karma and my firstborn are now forfeited, aren't they?

  90. It's what I left behind in your mom. by FatSean · · Score: 1

    You know, an ass load! Duh!

    --
    Blar.
  91. mnb Re:Books by Anonymous Coward · · Score: 0

    But we do copy books.
    The bookz scene is alive and well, thank you very much.

  92. Um... by Anonymous Coward · · Score: 0

    We have the ability to copy books.
    No, the average consumer has the ability to copy pieces of paper. Most people don't have doccutech machines in their basement capable of spitting out a paperback. There's a difference.

    Why do we not do that? Because books are cheap enough that it does not pay.
    No, because most book margins are so narrow that to make a "pirate" copy of a book (no, not a photocopy of a book, a functionally identical book) wouldn't be worth it.

    Authors can still make a pile of money.
    They can, but the vast majority do not. The JKs and the Stephen Kingss are the incredibly rare exceptions. Most authors don't make mad coin from their stuff.

    The experience of reading a book versus reading either photocoped paper or a computer screen differs significantly, unlike listening to a digital copy of an analog song. Saying that books have survived piracy is like saying CDs survived the radio - yes, they're similar in ways, but the experience is vastly different to make comparison unfair. And you should read up a little more on the publishing industry and exactly how great the money is there.

  93. Re: TPM tamper resistance by Anonymous Coward · · Score: 0

    TPMs chips are not tamper resistant, they are in the price range where adding effective tamper detection is impractical. You would need low-level physical access to get their secrets, but they are within reach of a bored grad student. Remember, some say the only hardware immune to tampering is on satellites. TPMs are not really designed against professional attackers, only interested amateurs ("Class 1 attackers" or even less).

    Tamper resistance would be implicitly enhanced considerably if the TPM functionality would migrate to the inside of larger chips. There are signs of this happening, but the TPM chips found in current machines are easy targets. (I work on tamper-resistant hardware; usually, something else breaks before you have to resort to physical violence against a secure module.)

  94. Re:Close and closer by onkelonkel · · Score: 1

    To pirate a movie I need to find a decent torrent of what I want to watch, d/l it, burn it and I'm good to go. Call it 2 hours start to finish. Now while most movies are pretty good rips and play just fine, you still run the risk of getting a crappy cam video with peoples heads in it, or some weird codec that won't play or maybe it's the wrong language.

    Or, I can walk 2 blocks to my local video store and rent a movie for $5 (2 for $5 on Tuesdays or whatever). They have a freakin huge selection. They always play, and you get all the extras on the disc. For me the rental thing just is a better value for my time and money. (For as long as these numbers apply! Jack up the rental price to $8 and maybe I'll d/l movies. Sell the DVD's for $8 and maybe I'll just buy them.)

    --
    None of them can see the clouds; The polished wings don't care.
  95. ...aren't allowed to exist. by mrchaotica · · Score: 2, Insightful

    The best way for this to happen is for devices to proliferate the market wich take advantage of the crack-ability of CSS: players that take ripped DVDs, store and organize them, and are as simple and intuitive as Apple products: it has to be an appliance.

    Speaking of Apple products, have you ever wondered why iTunes can't rip DVDs just like it does with CDs? It's due to a thing called the DMCA, which makes it illegal for Apple to provide such a function regardless of how technologically easy (and valuable for Apple) it would be to do. And that's why we'll never see what you suggest happen -- at least, not as long as the DMCA still stands.

    --

    "[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz

    1. Re:...aren't allowed to exist. by burndive · · Score: 1

      I never implied that it would be Apple that brings this about. I merely used their hardware products (computers, iPods, etc.) as an example of making a "device" into an "appliance" by making it simple enough for joe six-pack who doesn't need to know how it works to use. This is a requirement because as long as the only customers that won't accept DRM are a small portion of the total population, they can be ignored without cutting into the market too much. You cannot ignore Joe Six-pack, however.

      The fact is that there are such products out there for pretty much every operating system. What I was suggesting is that there needs to be an ecosystem of products that make it so convenient to rip DVDs that it becomes a necessary feature to the everyday user. Once that happens, DMCA or not, the MPAA will have no choice but to stop trying to take this fair use right from their customers. It needs to become a selling-point.

      --
      ...because "hacker" sounds way sexier than "code drone."
    2. Re:...aren't allowed to exist. by 75th+Trombone · · Score: 1

      Ripping DVDs will never be a necessary feature to the everyday user, because the everyday user couldn't care less about ripping DVDs to their computer to do anything legal.

      There a few reasons to put music on your computer: 1) to listen to it on the computer, 2) to save it to media (think mix CDs), or 3) to put it on a portable playing device. None of these uses is nearly so lucrative for movies as for music.

      Take #1 above. Most people couldn't care less about watching movies on their computers. They may care about listening to music, because they can do that WHILE they do all the other stuff they do on their computer. But watching movies is, for most people, something they curl up on their couch and do in front of their big TV.

      So what about #2? Most people don't really have much of a use for mix DVDs of movie clips. They may want to make a copy of the DVD to give to someone else, but most of the time this is illegal, therefore beyond Fair Use, therefore beyond any chance of making the MPAA budge on DRM.

      Then take #3. This has potential, I guess, but they already make DVD players just about as portable as most people need a movie to be. (Insert here the whole debate about whether most people actually have a use for iPod's video features.)

      there needs to be an ecosystem of products that make it so convenient to rip DVDs that it becomes a necessary feature to the everyday user.

      No; what there needs to be is a mainstream killer app for DVD ripping that falls under Fair Use. We don't have that yet. I don't think we ever will, but at least until we do, no number of products is going to have any effect on enough consumers to make the MPAA change their stance on DRM.

      --
      The United States of America: We do what we must because we can.
    3. Re:...aren't allowed to exist. by burndive · · Score: 1

      No; what there needs to be is a mainstream killer app for DVD ripping that falls under Fair Use. We don't have that yet. I don't think we ever will, but at least until we do, no number of products is going to have any effect on enough consumers to make the MPAA change their stance on DRM.

      That ecosystem of products I was talking about is the same thing as your "mainstream killer app" idea, although seen from a slightly different angle. You apparently envision a single innovator blitzing the market; I envision a broader phenomenon. My statement erroniously assumed that product=market, which is not, in fact, the case. Good catch.

      --
      ...because "hacker" sounds way sexier than "code drone."
    4. Re:...aren't allowed to exist. by mrchaotica · · Score: 1

      Ripping DVDs will never be a necessary feature to the everyday user, because the everyday user couldn't care less about ripping DVDs to their computer to do anything legal.

      Are you sure about that? I would imagine the market of people who would want to rip DVDs would be exactly the same market that would want a video iPod or an AppleTV, or who would buy videos from the iTunes store (of course, that might be part of why Apple hasn't done it -- it doesn't want to disrupt its own movie revenue).

      No; what there needs to be is a mainstream killer app for DVD ripping that falls under Fair Use. We don't have that yet.

      DVD killer app? Media servers. There are people who've invested thousands of dollars into big DVD jukeboxes, just so they don't have to go find the particular disc when they want to watch a movie. Stuff like MythTV (or AppleTV, or Windows Media Center -- although the latter two wouldn't be as good because they're proprietary) would let these people store their whole movie collections on a server in their closet and access them through a pretty on-screen interface, which would be a great improvement -- if only it were legal.

      Also, movie download services will make normal people start to see the advantages of keeping movies on the computer, which might drive them to start wondering why they can't do the same with all the DVDs they already have as well.

      --

      "[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz

    5. Re:...aren't allowed to exist. by 75th+Trombone · · Score: 1

      Actually, I don't see a single innovator blitzing the market. When I said "killer app," I didn't mean "application" as in computer application. I meant "application" as in "the act of putting to a special use or purpose." As in a REASON TO DO IT. There has to be a legal, Fair-Use reason for millions of folks to want to rip DVDs to their computers. That reason will be DVD-ripping's killer app, as it were.

      I don't see that happening any time soon. To whatever extent video manipulation is mainstream, it's not video that comes from DVDs. It's music videos that come straight from artists' Myspace pages, or guys taping themselves dancing on treadmills, or people's frankly disturbing homespun animations or something.

      But even in those cases, it's, like, one ten-thousandth of the population actually manipulating the video; everyone else is just watching it in Flash Player.

      I just don't see where millions of people are going to want to rip video to their computers, and want it badly enough to make MPAA change its attitude toward DRM. It'll be ten years from now just like it is today: the people who want to get at the bits on a disc will be able to with some amount of trouble, the rest of the population won't be able to and won't care to. It's a totally different thing from music, where if some CD tries to keep itself from being ripped all hell is raised by lots of people until the studio gives in.

      Video just != audio, and what the vast majority of people want from one will always be different from what they want from the other.

      --
      The United States of America: We do what we must because we can.
    6. Re:...aren't allowed to exist. by 75th+Trombone · · Score: 1

      DVD killer app? Media servers. There are people

      Stop. Until you can insert the words "millions of" before the word "people" there, there is no chance of what follows having any bearing on MPAA's attitude towards DRM.

      Also, movie download services will make normal people start to see the advantages of keeping movies on the computer, which might drive them to start wondering why they can't do the same with all the DVDs they already have as well.

      Ehhh, maybe. But I wager that the primary benefit for most people of downloading movies is not that the movies are now on a computer; it's rather that the movies are now anywhere in the house without having to 1) leave the house or 2) wait for Netflix to deliver it. In fact, that scenario will cause the converse problem: people wanting to bypass the downloaded DRM to burn the movie to a disc, so they can take it over to the TV where they actually WANT to watch it.

      Yes, there will always be early adopters and geeks and folks who want the bits on the disc on their hard drive, but I don't yet see the scenario where millions of people --- the required number to influence the MPAA --- want them there.

      --
      The United States of America: We do what we must because we can.
    7. Re:...aren't allowed to exist. by Builder · · Score: 1

      Apple could license that from the CSS consortium instead of reverse engineering it. The DMCA has nothing to do with why you can't rip DVDs in iTunes.

      You can't rip DVDs in iTunes because of commercial pressure.

    8. Re:...aren't allowed to exist. by julesh · · Score: 1

      Apple could license that from the CSS consortium instead of reverse engineering it. The DMCA has nothing to do with why you can't rip DVDs in iTunes.

      They can license whatever the hell they like, they still can't legally distribute a tool that enables users to bypass an effective copy-prevention measure.

  96. You misspelled MAFIAA by Dion · · Score: 1

    The RIAA probably doesn't care about movies getting cracked...

    --
    -- To dream a dream is grand, but to live it is divine. -- Leto ][
    1. Re:You misspelled MAFIAA by Hes+Nikke · · Score: 1

      but movies have music in them too! i'm sure the RIAA cares at least a little bit. /me thinks it would be funny if the RIAA went to the MPAA and said "you can't use our music anymore, your DRM was cracked." See Steve Jobs' thoughts on DRM and the agreement apple has with the RIAA.

      --
      Don't call me back. Give me a call back. Bye. So yeah. But bye our, well, but alright we are on a shirt this chill.
  97. You know, you have to laugh. by Harik · · Score: 4, Insightful

    AACS/CSS/Security through telling people "don't do that" is trivial to implement, for as good as you can possibly get it (fundamental flaw in the design) and they STILL managed to fuck it up.

    Basic concept: Encrypt a disk with a key that only the player has. If the player key is compromised, all disks are cracked.

    "fix" #1: Encrypt the disk content a random key, encrypt that disk thousands of times with a library of pre-generated keys. Assign each player a key, quit putting that key on the disk when it's found to be compromised. Of course, you now have to re-encrypt thousands of keys for every title released, leading to possible exposure of the master database.

    "fix the fix": Randomly create a single "production key", encrypt it with every player key, and give the 'blob' to every HD-DVD production facility. Now exposure is limited to one key that can be changed without exposing the master keylist.

    Except someone was terminally lazy, and only did it ONCE. So EVERYONE USES THE SAME PRODUCTION KEY. Way to go! If you gave each studio their own, then compromises would be limited to a single studio's works (that were produced before the key was changed).

    Worse, you introduce an attack vector to your management that effectively hides it's origin. Any hardware or software player could be compromised, or you could have an inside leak of the key. As long as the exploiter doesn't say "I got this key from Sony's HD-501 player" you have no idea how they aquired it. Basically, they completely and utterly shat on the key-revocation scheme, with no possible solution.

    Whoops.

    Dear MPAA: Please contact me before starting your next hairbrained content protection scheme. You can pay me millions rather then billions and I'll give you one that's not so embarassingly horrible. I'm no cryptogropher, but goddamn, it's not like you hired any security people for anything you've done yet anyway.

    1. Re:You know, you have to laugh. by GovCheese · · Score: 1

      I'm not in principle against a rational rights management. But how DRM is implemented is unpredictable to the consumer and that's why we'll see market failure for the devices (unless it's improved). Not a good example regarding Blu-Ray and HD but for instance, I downloaded (paid) an archived baseball game from MLB.com to watch and savor. BUT. DRM prevented me from burning the download to a disc so I could enjoyably pop it in my player and watch it on a big screen. Unpredictably to this consumer, I was forced to watch it on my CRT and I was pissed I had paid money for a product that was crippled. So I as an otherwise Average Joe who really had no previous views on DRM was alienated by a simple experience that has left me hostile to the idiots who are implementing DRM with no real thought about the consumer. If DRM implementation for B-Ray and HD-DVD is going to similarly tangle up the consumer in ways that are entirely unexpected to him, and all it takes is once, there will be predictable backlash. The consumer wants a toaster. Key matching or revocation implementations to brown a slice of bread laughably introduces complexities that will become multiple points of failure and the market will reject it unless it is down sensibly.

      --
      "He's using a quantum encryption scheme! That'll take hours to break!"
    2. Re:You know, you have to laugh. by Harik · · Score: 1

      Since I can't edit: Whoops! I'm wrong. Duh. While the production key does make the disk cracking processes easier, I realized that DURR there can be only one content key, no matter how many player keys. So if the pirates simply release the content key it also hides the compromised player key used to achieve it.

  98. Demographics and Long-term Objectives by abb3w · · Score: 1

    I really don't understand why the heck they even let someone write a software player, how big of a market slice can that be?

    I believe you forget the studios' objective; they want a more pirate-resistant successor to the current standard DVD. Ergo, they must be able to displace the current DVD market. A sizable minority of college students use a Windows PC with DVD drive (and perhaps tuner card) in lieu of a TV and DVD player to conserve space in cramped dorm rooms. While there is a trend away from desktops to increased laptop usage, USB tuners and large LCD external monitors are common enough and easily available, almost all current laptops come with drives that read DVDs (at least), and (looking ahead again) LCD projectors are getting cheaper and correspondingly more common. Due to the disposable income levels, the college and immediately post-college crowd is THE target demographic to hook, and while a gaming console is a luxury, a computer is considered just short of a necessity.

    The software player market is not one they can yet afford to ignore.

    --
    //Information does not want to be free; it wants to breed.
  99. And what if I run my own virtual computer? by A+nonymous+Coward · · Score: 1

    What if I write my own virtual computer which reads the program code, the actual machine instructions, and executes them entirely in software? I can pass whatever I want back from the TPM instructions, I can fake any memory contents I want, I can fake any I/O inputs I want.

    Given how fast computers are now, I suspect I could write a virtual computer which, when run on the fastest machine, looked about as fast as the slowest machine. By "fast" and "slow", I mean reasonable commercial home machines, ranging from cheap notebook to gamer's overclocked screamer. I would not be surprised if such a program could fake the entire boot process at a slow but reasonable speed, and I only have to do that to extract interesting data from the software being run.

  100. Re:I disagree to your dissagreement. by Anonymous Coward · · Score: 0

    The full key does not necessarily need to be present in memory: See http://en.wikipedia.org/wiki/Nonce_(cryptography)

    If the key is stored as an obscured algorithm and the disc selectively requires portions of the key, the full key is never given out. Next time you try and give the disc the same key portion as before, it will refuse.

    I just hope this wasn't implemented with HDs and BlueRays.

    Lil' rant!:
    Dear big corporations, Give me high quality audio files and high quality video files for download and keeping and I will happily pay.
    BUT WHY THE HELL MUST I DOWNLOAD MEDIA ILLEGALY!?!?!
    You simply give me no other options!

    DRM is not an option, If you don't trust your customers look to yourself, it is obvious that customers don't trust you!

    On the side note: I've been looking for an online "blockbuster" where you can stream movies over the web legally... still didn't find it (not with well known movies at least).. does this exist or have I simply been looking for something that cannot be made legal?

  101. Nobody told them that... by alexhmit01 · · Score: 1

    The most amazing thing is to go and see speakers come to a university talking about the entertainment industry. The industries brought people in to discuss DRM, and the experts all explained to them that what they wanted was mathematically uncertain. Cryptography is designed to get a message from Alice to Bill where only Bill can read it, and Bill knows that it was sent by Alice. Cryptography CANNOT be used by Alice to make certain that only Bill can get a message, but that Bill can't make a copy of the message.

    The data HAS to be unencrypted at the end source, and the industry knows this. They have been told this. Congress has been told this.

    The people working on the DRM solutions told them that they are attempting the mathematically impossible. They don't care, they just keep trying this solution.

    In Apple's case, the quasi-solution is that they can require you to update your player (iTunes) when things get compromised. They can't stop the old system from being used, but they can agree to only sell new material. I'm sure that some WANTED to require phone/Internet access to all HD/BR DVD players... which would have KILLED ANY chance for adoption, as DVD players, like VHS decks before them, get used all over the place where that is impractical... in cars, on airplanes, embedded in televisions that get thrown in little used guest rooms, converted garages, finished basements, etc.

    But the executives were all WELL informed that it was a waste of money, they simply felt that they could get "secure enough" and that the experts were pointed headed academics.

  102. Is less poor possible? by tepples · · Score: 1

    What was broken was a poor implementation of a decoder. Can you prove that it is possible to implement a decoder that is not just as poor on commodity Lenovo-compatible PC hardware?
  103. Are you all THAT suprised? by Xatticus · · Score: 0

    This was bound to happen, no matter how tight someone makes a security feature. There is always a way to break it. Besides, it's not like one format is going to win over another. The funniest thing about this format war, is the fact of seeing which movies will come out on HD-DVD, which ones will come out on Blu-ray, and then knowing the fact that EVERYONE will buy the normal DVD version.

  104. 20 years ago you needed a studio to make a CD by HornWumpus · · Score: 1

    Today you don't even need to make the CD.

    People will continue to make music of that I'm completely confident.

    If the record executives aren't driving Ferrari s to their meetings with Clear Channel's program directors to talk about getting the next Van Halen CD to maximum saturation then so much the better. Fuck them all.

    Bands make money putting on shows and selling CDs personally. What they can't do is get any radio play without selling their souls.

    --
    John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
  105. ATTN RIAA - how to fix your problem! by zygotic+mitosis · · Score: 0

    You have to develop a hardware decoder. A PCI card. Once it's on the market, revoke ALL software keys. You get bonus money from hardware sales, and diminished piracy! Go RIAA!

  106. Same as DIVX (the players not the codec). by HornWumpus · · Score: 1

    I got sold one (because it didn't cost a penny more then a DVD player).

    Then never plugged it into the phone line. (a DVD player talking to someone about my viewing habits? Uh, no.)

    I understand fully 50% of the players they sold never called home for the first time. They should have learned.

    --
    John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
  107. Screen size vs. device size by tepples · · Score: 1

    What happens when 10 years from now mobile HD video players are just as common as MP3 players

    Sony's PSP and several PDAs have 480 pixel wide screens, and they push the limit on how big a handheld device can be. Can you fit a 1280 pixel wide screen into the same package? Would you want to, given the focusing limits of the human visual system?

    Think also about pocket radios vs. pocket TVs. Watching a movie takes much more concentration and for a longer time than listening to a song. So where would such a device be useful outside of the back seat of a car, train, bus, or plane on a two-hour trip?

    1. Re:Screen size vs. device size by bitMonster · · Score: 1

      I'm pretty sure it is for watching pr0n in the bathroom.
      I don't have one, so I'm just guessing.

  108. Trusted Platform Module by tepples · · Score: 1

    Or is there something in the modern versions of MS Windows that prevents using a debugger? No, but there is something in Windows Vista that allows applications to choose not to load if a debugger or VM is detected.
  109. Or don't even bother with that by Sycraft-fu · · Score: 1

    You can debug Windows on a kernel level. You hook it up to another computer via the serial port and you can step one instruction at a time if you want. Not really anything a program can do about that. In theory I suppose you could check to see if the kernel debugger was active and refuse to run, but that's easy enough to patch around.

  110. terabytes by spacemky · · Score: 1

    This is *very* good news for Seagate, et al.

    --
    640YB ought to be enough for anybody.
  111. Not true at all... by Lanoitarus · · Score: 5, Funny

    The IRS perfected it years ago... Ive been trying to decode my goddam tax return for the past two weeks and I still cant crack it.

    We should just let them handle music distribution... "Put the song title from box 34 into this box, but only on a leap year that ends in an odd number...."

    1. Re:Not true at all... by aaza · · Score: 2, Funny

      "What is your mother's maiden name? What? How do I know, I always called her 'ma'." begins writing "Ma. Possibly deceased." -- Bernard Black, filling out a tax form.

      --
      In theory there is no difference between theory and practice.
      In practice, however, there is.
  112. ...and that's why by ProfessionalCookie · · Score: 1

    You'll see more and more companies doing this kind of thing!

    1. Re:...and that's why by mrchaotica · · Score: 1

      Que?! How the heck is that legal?!

      --

      "[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz

    2. Re:...and that's why by ProfessionalCookie · · Score: 1

      Because it keeps the encryption intact. Granted I still thing DRM is wrong.

    3. Re:...and that's why by mrchaotica · · Score: 1

      Oh, weird. How does it do that? And, aside from the region locking, what "good" (from the MPAA's perspective) does retaining the CSS do? I mean, the CD is already copied, and presumably the image file can be copied too and read just like any other CSS-encrypted DVD...

      --

      "[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz

  113. Every existing software player will likely... by Windcatcher · · Score: 1

    ...be broken in very short order. Now that the processing key is known, people know what to look for in RAM. How many versions of HD-DVD players are out there? I don't have an HD-DVD drive so I'm not up on the scene, but I'd guess a great deal. Each and every one of them (and perhaps some standalone ones, too) can now be scanned for the processing key in memory. We're talking about MAJOR instantaneous breakage. I'd imagine that the hacker groups will now be racing to break every player they can get their hands on, and they'll keep that list of players a closely guarded secret. It's death by a thousand cuts, all happening at once. Vaunted DRM...just wow. Talk about your spectacular failures.

  114. One thing's for sure... by reacocard · · Score: 1

    DRM just ain't all it's cracked up to be.

  115. Some "rights" will be broken. by Anonymous Coward · · Score: 0

    "Then the industries wil have 'won', and freedom will have 'lost' ( since this is much larger then just being able to watch a DVD, its about the basic rights of freedom of information )."

    No it isn't. You still can call up your representative and call him/her an asshole. You can still post on slashdot how much you hate things. You can grab either a digital camera, or a camcorder and make home movies. You can write the great american novel and print it out on your laserjet. What you CAN'T do is violate other people's copyright. Sucks to be unable to mass copy and distribute under the guise of "my rights", but you all declared this war, now you're going to have to suffer under it.

    1. Re:Some "rights" will be broken. by pallmall1 · · Score: 1

      You still can call up your representative and call him/her an asshole. You can still post on slashdot how much you hate things. You can grab either a digital camera, or a camcorder and make home movies. You can write the great american novel and print it out on your laserjet.
      Only with permission.
      --
      3 things about computers: they're alive, they're self-aware, and they hate your guts.
  116. [Offtopic] Please forgive me... by empaler · · Score: 1

    ... for using this very off-topic space to say thank you.

    You probably don't remember, but you made my life easier, and now that I am fiddling with it at work as well, that extra knowledge came in very handy.
    It's one of those cases where I meant to thank you but never got around to it... Well, finally, the thanks you deserve :)
    (hopefully you read this)

  117. Cool, so it's ok to buy HD-DVD and blu-ray now? by Anonymous Coward · · Score: 0

    If this is true then I guess that means HD-DVD and Blu-ray are now no worse than standard DVDs. Surely this would have to be good news for disc sales?

  118. It is all about the average Joe, but not like that by jgoemat · · Score: 1

    There is a reason for DRM, even if it inherently flawed in design: to keep the average Joe buying your stuff.

    Very true, but not just to keep the average Joe from making illegal copies. It also prevents the average Joe from doing other things with your product, or from making backup copies. Media eventually goes bad. If an average Joe has his media go bad, he must go buy another copy. Without DRM he could make a copy himself. Without DRM, the average Joe could rip a movie to his computer or media center computer (MythTV, Windows Media Center, Sage TV, or other) and watch it anytime he wants without having to find the media. Wihout DRM the average Joe could probably even (or buy a program to) remove the 10 minutes of commercials that Disney DVDs force you to watch before watching your movie. Without DRM it would be easy for a media center appliance to record HD TV shows, as the supreme court decided in Sony v. Betamax that citizens had a fair use right to do (I know it's possible, but there are heavy restrictions especially on encrypted cable content when you need a CableCARD).

    DRM is all about control. If you want to do something else with the movie you bought (that fair use says you should be able to do with it), the studio wants money for it. The problem is, they do not innovate in those areas and the control is so tight that these things really aren't available, the studios couldn't make money from them because people rightly don't think they should pay with them, and therefore there is neither supply nor demand. DRM may protect movies from some illegal copying, but for the most part I believe it stifles innovation in the hardware and application arena and leads to a much poorer experience. Take the Tivo Series 3 (HD) for instance. The Series 2 had the ability to link multiple units in the house so you could not only record multiple shows, but watch them from any unit and even link them to your computer and download shows to portable players like the iPod or store shows on your computer. With the Series 3 that is all gone because of CableCARD. In order to license the CableCARD specifications, Tivo had to do away with all of that. The Series 3 even includes a cutting-edge eSATA port for adding an external hard drive, which is nice since HD shows take up A LOT of space. Guess what... That is disabled because CableCARD wouldn't allow it. I would have two Tivo Series 3 in my house right now if it had the functionality of the Series 2 and the eSATA port worked.

    If media companies had their way, you would not only have to buy the media, but you would have to pay every time you watched it. They tried to do that with DIVX (Digital Video Express, not the DivX codec). Consumers didn't want that and now it's gone. Not only that but they would probably like to charge you extra for viewing the "bonus features" and using extra functionality like chapter skip, pause, and rewinding. If media companies had their way, your house would be fitted with microphones and your would have money deducted from your account every time you sung a copyrighted song in your shower. Media companies have fought against nearly every new technology that has come along since they couldn't control it, even if it made them more money. Examples: Radio, Tape Recorders, Video Tapes, MP3. They haven't fought against Blu-ray and HD-DVD because they actually made protections and restrictions stronger, and because it would force people that have already purchased DVDs to spend more money to upgrade for high-definition. Back when people started playing music on the radio, media companies fought against it. It turned out that radio exposure vastly increased the sales of their albums. It didn't matter, they want money from every avenue available. They initially fought against tape recorders, then ended up turning it into a huge business. They fought against video tapes, even though the video tape rental business and sales lead to record profits. They fought ag

  119. 5C protection by Anonymous Coward · · Score: 0

    All we need is someone to break 5C protection...hopefully in time for Sopranos

  120. Nope,it's really cracked-Faith. by Anonymous Coward · · Score: 0

    "tamper-resistant. not tamper-proof. given enough time and manpower, hardware keys will be broken. and if they try to disable that key, they're stupider than i thought."

    Such faith you "I'm not hurting anyone, because I never would have bought it anyway" have in someone else doing all the hard work so you can enjoy free content. Now why would they do that, unless they can get the money you all are too "principled" to pay to the artist in the first place.

    1. Re:Nope,it's really cracked-Faith. by compro01 · · Score: 1

      Now why would they do that, unless they can get the money you all are too "principled" to pay to the artist in the first place.

      because they like a challenge? i haven't heard of DVDJon receiving any godly sums of money.

      yes, i realize this guy is likely a troll.

      --
      upon the advice of my lawyer, i have no sig at this time
  121. The best thing currently protecting HD content... by The+Master+Control+P · · Score: 1

    Who the hell wants to download a twenty gigabyte file, and how many can you store on your hard drive? This protection will in fact be more effective than the DRM, possibly deterring many users for as long as a few years before connections get faster.

    I join Ignignokt and rest of the online world in flipping the bird at the MAFIAA as hard as I can.

    Oligatory fuck the MPAA song link.

  122. Yes, someone pray us through this. by Anonymous Coward · · Score: 0

    *shrug*

    Welcome to a combination of technofaith (in other words with technology all things are possible)*, and ignorance. One how many people here really understand electron microscopy well enough to say what it can and can't do? Bet it's a smaller number than the one's getting modded +5. How many here understand economics? That ties in to any pirate solution.

    *You have humanism to thank for that.

    1. Re:Yes, someone pray us through this. by Goaway · · Score: 1

      I'd settle for people actually knowing how AACS works before making all kinds of bold claims about it, but that's asking a bit much, I guess.

  123. The end of anonymous players? by Anonymous Coward · · Score: 0

    [other poster]
    "Unfortunately for the MPAA, it wouldn't come to that; there are no known, secure, digital watermarking schemes."

    I wouldn't bet on that.

    "Seems to me that the fix is obvious. Change the algorithm."

    Or simply make all hardware players (remember even software players need hardware) watermark all copies. Copyright violations is about being anonymous.

    Sounds like someone has a similiar idea. Notice how smooth it went down with the slashdot crowd?

  124. Re:"...trying to get content without paying for it by FritzTheCat1030 · · Score: 4, Funny

    I have paid for every single DVD I own.

    Me too, every one.

    Usually in spindles of 100.

  125. My Property by Anonymous Coward · · Score: 0

    "This isn't about Imaginary Property rights, it's about THEIR control of MY property."

    No, YOU don't get it. It's NOT YOUR PROPERTY, you RENT IT FROM THEM.

  126. iTunes does illegally rip CDs by quenda · · Score: 1

    Speaking of Apple products, have you ever wondered why iTunes can't rip DVDs just like it does with CDs? It's due to a thing called the DMCA, which makes it illegal ...
    It is illegal to rip commercial CDs in Australia, due to copyright law, but iTunes does it anyway. If Apple really cared about the law (rather than just about being sued or charged), they could easily disable CD ripping in countries where it was not legal.
  127. *Cheer* by Frequently_Asked_Ans · · Score: 1

    "And the evil enemies of the binary revolution were defeated...again, but they'll be back..."

    now if i owned a HD-DVD or a Blu-Ray player i'd be set....

    --
    "Stallman says add to this code and you are one of us. Gates says use this code and you belong to us."
  128. Steve Job is right by Anonymous Coward · · Score: 0

    I think Digital Right Management is dead. For most law abiding citizens will buy legitimate media from their appropriate sources and pay for it and don't want to worry about the CD/DVD police knocking on their door. However for those who love a challenge of doing something illegal no matter what so they will always find a way to bypass these things. It is waste of time for companies to make more complicated DRM so they can "generate" revenue.

  129. Cracked..... by IHC+Navistar · · Score: 1

    Yarrr, matey! A thousand gold dubloons will be paid to the scalleywags who bring me the first release of a Blu-Ray or HD-DVD ripper! Yo ho and a bottle of Yoo-Hoo!

    Signed,
    Blu-Beard The Pirate

    --
    Knowing Google's lust for data collection, the Soviet Union is still alive and well inside the psyche of Sergey Brin....
  130. DRM still has a place: by cgenman · · Score: 1

    Not to sound too pedantic, but DRM of some form still has a place. DRM should be there to discourage casual copying by non-geek people. For example, the DRM on DVD's is functionally useless against anyone who has spent an hour looking things up on the internet. But my sister still doesn't know how to burn duplicate DVD's for her friends... it's just not worth the effort to her to find out.

    And maybe I have some not-so selfless interest in the subject, but old PS1 games had a light degree of copyprotection that ensured players who weren't savvy with a soldering iron couldn't copy games, and the ones who really wanted to, could. But those are the ones who still can anyway, despite massive expenditures and the closure of many legitimate retailers / gamers / hobbyists.

    DRM needs to be put into proper perspective... it's a deterrent, not a lock. It's a mild annoyance like those old "register your shareware now" messages that keep ordinary people from slipping into bad habits. It's not an excuse to install a backdoor on everyone's machine, it's not a reason to throw kids in jail, it's not a good use of 20 million dollars of RnD. It's a mild deterrent.

    In proper position in the overall ecosystem, DRM can be quite useful. Just keep it light, and you'll get 90% of the goodness for just 5% of the annoyance.

    1. Re:DRM still has a place: by Flodis · · Score: 1

      Not to sound too pedantic, but DRM of some form still has a place. DRM should be there to discourage casual copying by non-geek people. For example, the DRM on DVD's is functionally useless against anyone who has spent an hour looking things up on the internet. But my sister still doesn't know how to burn duplicate DVD's for her friends... it's just not worth the effort to her to find out.
      I'm all for DRM that is used to prevent casual copying. However, DRM isn't actually used that way now. It isn't even the main purpose of the DRM efforts of lately.

      DRM is approximately equal to format, and whoever owns a format has a big chance of earning a lot of money from either licensing the format to others (Hence the Blu-Ray/HD-DVD format war), or selling proprietary gadgets that can use the format (Apple). Neither of these benefit the customers.

      Instead, it drives costs up and forces you to buy specific hardware to play music/movies that could play just as well on regular/old hardware - if it weren't for the DRM. And it locks the content and stops you doing 'normal' things with it, such as building a HTPC with all content on an array of harddrives.

      If DRM were used the way you describe, I don't think there would be any issues. And if the companies *really* wanted DRM to be used only for that purpose, we'd see a lot more effort put into DRMs based on 'watermarking'. Apple could do that on Itunes *today*.
    2. Re:DRM still has a place: by Eivind · · Score: 2, Insightful
      Not to sound too pedantic, but DRM of some form still has a place. DRM should be there to discourage casual copying by non-geek people.

      Which is the oposite effect from the one the RIAA claims to want:

      • It hurts the family-mother wanting to make copies of the overused childrens-DVD to avoid having to buy it anew next time it gets scratched.
      • It hurts the non-technical customer who just wants to listen to his music bougth for player-X 5 years later after player-X broke and he bougth player-Y.
      • It harms the fully legal customer who wants to listen to his music-CD in the computer at work.
      • It harms the tourist that wants to buy some Japanese DVDs as souvenirs from his travels in Japan.
      • It harms the customer who for whatever reason needs to get a new computer. (yes, I know, there are ways -- but it's extra hassle)

      Meanwhile:

      • It has no effect whatsoever on those that get their music from p2p.
      • It has no effect whatsoever on the large professional comercial pirates. (those that copy and *sell* copyrigthed material)
      • It has no effect whatsoever on the cracker-team that get a kick out of being the first to "release" whatever new music or movie to various p2p-networks. It may even *add* to their prestige.

      I don't see how this adds up to "90% of the goodness", nor how it amounts to "5% of the annoyance".

      More like 90% of the annoyance for 5% of the benefits.

    3. Re:DRM still has a place: by cgenman · · Score: 1

      It hurts the family-mother wanting to make copies of the overused childrens-DVD to avoid having to buy it anew next time it gets scratched.
      Resurfacing disks is cheap and easy.

      It hurts the non-technical customer who just wants to listen to his music bougth for player-X 5 years later after player-X broke and he bougth player-Y.
      This is a problem with the overbearingness of current implementations. With a "deterrent" implementation, this shouldn't be an issue.

      It harms the fully legal customer who wants to listen to his music-CD in the computer at work.
      Again, shouldn't be an issue. You should never have to pair a physical media with a playback device.

      It harms the tourist that wants to buy some Japanese DVDs as souvenirs from his travels in Japan.
      Now you're talking about regional lockout, the arguably illegal practice of artifically subdividing a market. Again, shouldn't be there.

      It harms the customer who for whatever reason needs to get a new computer. (yes, I know, there are ways -- but it's extra hassle)
      I don't know... I've brought steam over from machine to machine, and that's pretty easy. Just log in.

      Meanwhile:
      It has no effect whatsoever on those that get their music from p2p.

      So? They weren't going to buy it anyway.

      It has no effect whatsoever on the large professional comercial pirates. (those that copy and *sell* copyrigthed material)
      So? A: that's what law enforcement is for and B: that's a pretty damned tiny group in the west anyway.

      It has no effect whatsoever on the cracker-team that get a kick out of being the first to "release" whatever new music or movie to various p2p-networks. It may even *add* to their prestige.
      Again, so what? Let them wag their things.

      Look, most existing implementations of DRM are completely screwed. But the concept is valid. The best implementation of this I've seen has to be Steam (now that it doesn't crash every few minutes). Sure, it manages to a degree what you can and can't do with your games. But it also improves the end-user experience by removing trips to the store and allowing you to take your games with you to whatever PC you happen to be on. Assuming your network connection is reasonable, that's actually really nice. Or the gamecube's alternative disk format... which was just different enough that the physical media was unduplicatable. Or how you are free to duplicate VHS tapes, but the quality degrades with each subsequent generation... you can make a great copy for your friends, and they might even make an OK copy for their friends, but it won't go much beyond that.

      I get the feeling that most people get an intrinsic sense that we should have SOME system in place to discourage casual copyright violations. By refusing to engage in the discussion about exactly what form that discouragement should take, we're letting Macrovision, Sony, and the RIAA set that standard for us.

    4. Re:DRM still has a place: by Chode2235 · · Score: 1

      Why should geeks have rights to use and view their content that others don't have? You either need to have unbreakable DRM (unlikely) or no DRM you can't create classes and segment your users. I hate how geeks feel like they are better than everyone else because they can circumvent systems.

    5. Re:DRM still has a place: by Eivind · · Score: 1
      Look, most existing implementations of DRM are completely screwed. But the concept is valid.

      That's precisely where we disagree. You claim, in principle, it migth be possible to make a system that is less obnoxious, and this migth actually have some desirable qualities.

      I claim, in *practice* those implementing DRM, those doing the development-work, those deciding which DRM to implement have not ACTUALLY developed and implemented such non-obnoxious DRM. Instead they've implemented DRM with all of the problems I mentioned, and many more. Yes, in *principle* they could act differently in the future, but their interests are fundamentally not aligned with those of consumers, so I consider it likely there'll always be a conflict. (and they'll continue to choose DRM that aids *their* interests first and the interests of normal consumers second (if that))

      Resurfacing disks is cheap and easy.

      Let me guess, you don't have many children ? Ever tried "resurfacing" a disc after your kid stepped on the DVD *with* shoes on *with* sand under those shoes ? Here's a hint: if the data-layer is damaged, no recovery is possible.

      This is a problem with the overbearingness of current implementations. With a "deterrent" implementation, this shouldn't be an issue.

      Yes. I freely admit to talking about ACTUAL problems experienced by ACTUAL people buying products that are ACTUALLY on the market today. If you want to go wandering off, defending DRM on the basis of some hypothethical non-obnoxious DRM that has the chief disadvantage of not actually existing (or being extremely rare), go ahead.

      It harms the fully legal customer who wants to listen to his music-CD in the computer at work. Again, shouldn't be an issue. You should never have to pair a physical media with a playback device.

      Again: "shouldn't be" an issue. So you say. But in actual real life it IS an issue. I talk of reality, not dreamland.

      Now you're talking about regional lockout, the arguably illegal practice of artifically subdividing a market. Again, shouldn't be there.

      Ok, so we agree this is fundamentally wrong. (nevertheless it's there -- and DMCA et al make it harder to figth it)

      It [drm] has no effect whatsoever on those that get their music from p2p. So? They weren't going to buy it anyway.

      But the stated point of DRM is to curb piracy. If it fails that (its claimed primary mission!) then what's the point supposed to be again ? It has no effect whatsoever on the large professional comercial pirates. (those that copy and *sell* copyrigthed material) So? A: that's what law enforcement is for and B: that's a pretty damned tiny group in the west anyway.

      It's a small group, but the damages are large. Also the stated point of DRM is to curb piracy. If it fails that (its claimed primary mission!) then what's the point supposed to be again ? Why have DRM at all if you admit up-front that it is unlikely to influence piracy ?

      The best implementation of this I've seen has to be Steam (now that it doesn't crash every few minutes). Sure, it manages to a degree what you can and can't do with your games. But it also improves the end-user experience by removing trips to the store and allowing you to take your games with you to whatever PC you happen to be on. Assuming your network connection is reasonable, that's actually really nice.

      Ok, so let's make steam your 'benchmark' non-obnoxious DRM. Steam has, atleast unless I misunderstood something, the following problems (there's bound to be more, these are just of the top of my head)

      • You can only access content protected by it as long as the steam-servers are up and reachable.
      • You're forced to reveal your identity when buying and using content.
      • First sale is fucked -- you can't easily resell a steam-game you're tired of.
      • It requires an active internet-connection.
      • It allows a private company incredible det
    6. Re:DRM still has a place: by Eivind · · Score: 1
      I never said they should. Infact I said the oposite: current DRM has the effect of stopping the non-technical user while having little or no effect on the geek. I find this strongly objectionable.

    7. Re:DRM still has a place: by cgenman · · Score: 1

      This is your example of good DRM ?
      Yes, yes it is. And in a previous version of this response, I went through the points and refuted them one by one with the reality of the system and game development in general.

      But that's not the point.

      The point is, and I can't emphasize this enough, if you refuse to enter the discussion about what DRM should be, you're not going to get any input into what it will be.

      Actual digital movie piracy is about 4 years old. Actual music piracy is about 7 years old. Those are babies. Gaming piracy is about 26. Sure, the MPAA may never have tried other copyprotection methods, but in gaming we've tried everything from that Starforce slime to serial dongles to physical police dossiers to manuals with scratch-n-sniff symbols. And it has been painfully obvious, and tried again and again, that shipping without any form of copy protection at all will hurt your sales. I've seen many many numbers throughout the years, and they're pretty iron clad.

      But we've gone overboard. And if you've ever gone through the experience of fighting against your game getting wrapped up in that macrovision crap, only to watch it become this unusable vector for slime, you'll know how far we've gone overboard. And if you've ever gone through that experience, you'll know that you'd better have a good answer when the director of your company asks "what should we use instead?" He's seen the numbers on non-protected games. He knows the numbers aren't good. He knows exactly how much of a percentage revenues increase to expect from going from donationware to nagware to timed demos. He knows exactly how many hundreds of thousands of dollars sales will drop off if you strip off the layer of copyprotection from the retal "product." He's translating that into a number of artists and programmers he won't be able to hire on the next project, because we didn't get that windfall from this one.

      He wants an answer. And I want to be able to give him a good answer when I'm going on one of my frequent crusades against overly restrictive copy protection. Saying "all copy protection is bad" just ensures that he's going to go with the company with the most restrictivs, slimy, and buggy stuff, because they offered him the only real answer.

      So please, give me an answer. Assuming "no DRM" is not going to fly in practice, what is the least objectionable copyprotection scheme? What should we do?

    8. Re:DRM still has a place: by Eivind · · Score: 1
      Different media are infact different. Your assumption "no DRM is not going to fly in practice" is not generally valid.

      Music for example. Up until very recently *all* music was sold completely without any sort of DRM, and it flew just fine. Then companies started introducing DRM of various kinds trying to make CDs "unrippable". A year ago, all of the major record-companies in Norway, for example, used some kind of DRM on their CDs.

      It didn't, infact, actually fly all that well. There where *TONS* of problems. There where *TONS* of complaints. There was *NO* measurable decline in piracy whatsoever. One after one they gave it up. A month ago the last of the record-companies gave it up. They're now (all of them!) back to selling plain old unprotected CDs. Now there's talk of starting a unencumbered (plain old high-quality mp3 and flac) online music-store. Research shows that 70% of all record-company-execs believe that people would buy more music online if the music was in an unencumbered format. I know that obnoxious "anti-piracy" measures on games have completely put me off buying PC-games. I also know that pretty much all current PC-games are widely pirated. It seems to me it's pretty much a battle lost. The main hope seems to be online games where you pay not for the game but for access to servers. If they can succeed in making online-gaming attractive for other audiences than the WoW-addicts, I think this offers a lot of hope.

  131. NeTrek by Anonymous Coward · · Score: 0

    I do not see a terribly effective fix for this - your key has to exist somewhere, and even in a CPU register it is still in memory more often than not.
    A lot of people have mentioned that software players may be banned outright, and I actually find it pretty amazing that Hollywood even authorized software players this time around to begin with, considering what a weak vector they are for key compromise. The first CSS break was due to the exact same thing: extracting the keys from software players. (Although in the case of CSS, key revocation was impractical, and in any case, the algorithms were fatally flawed enough to compromise even without knowing an existing key.) I suppose the vendors convinced some Tinseltown execs that things would be different this time.

    There's another option to having the key exist in a register or a memory location, though, assuming eliminating software players (or eliminating them on anything but Vista x64; that ought to make Microsoft happy) is out of the question. The old NeTrek clients used "software RSA blackboxes" to try and prevent hacked clients. While I'm sure there's plenty of holes to poke in that (blessed binaries were more of a stumbling block for the technically inept than a bulletproof protection), the idea is still sound: Instead of having the key exist in a memory location for someone to stumble across with a debugger, the key exists as code, with the algorithm already configured. This avoids compromising the key, although it's still somewhat trivial just to take that lump of code and use it to do your decoding. But it at least gets around the problem of exposing the key itself, if that were somehow important. You'd have to disassemble the binary to reconstruct the key, and that is definitely a hard problem. In fact, it's a theoretically impossible one, though it's not usually so hard in practice.
  132. I don't think it matters... by Uzik2 · · Score: 1

    I believe they actually want them to be cracked. Here's my reasoning:
    Once they have vista and AACS in place they can revoke the ability to play a DVD on a per title basis.
    Then when a "nasty pirate" cracks the DVD code they can revoke the code for all copies of that DVD.
    Now all copies of that DVD will not play, or will only play at poor
    quality (correct me if I misunderstood this part).

    The revocation for their protection, to prevent piracy, of course! All the legitimate
    users are now just the owners of an expensive coaster instead of a movie. Hey, they might even offer an
    exchange program, for a discounted fee of course. ;) It completely destroys the ability for legitimate
    users to own DVDs. Everyone will be forced to rent DVD's instead of owning them, because of the "rampant
    piracy". And as a side effect, their sales go up because you pay every time you watch a movie, not just
    once.

    --
    -- Programming with boost is like building a house with lego. It's a cool but I wouldn't want to live in it
  133. A BIOS inside the CPU die by tepples · · Score: 1

    The BIOS is what starts the whole trusted process The TPM watches the BIOS as it starts up.

    but you can replace that if you own it. Unless the BIOS is contained within the CPU die itself, as seen in all Nintendo handheld systems.
  134. Exactly by ProfessionalCookie · · Score: 1

    And, aside from the region locking, what "good" (from the MPAA's perspective) does retaining the CSS do?
    Exactly. The only benefit is that it has some legal merit (IANAL) and the only reason it might keep the MPAA happy is that the css keys are kept secret by Drive In (in the [crackable] same way that the keys are secret on the DVD so that if someone were to upload the DVD image downloaders would still not have the key. So yeah. DRM is stupid, but capitalism works more than one way,
  135. Why bother by frambris · · Score: 1

    There! You see? You don't need to spend millions developing a DRM scheme. Sooner rather later it *will* be broken. That money could have been spent on unifying the HD formats to one. Stupid lard brains!

  136. fax modems are old now? by RMH101 · · Score: 1

    ..I'm only 33 and I can remember using a 300 baud modem BITD...

  137. imagine... by RMH101 · · Score: 1

    ...if the RIAA revoked, say, WinDVD's key and declined to provide them with a new one on proof of "better" coding. Joe Public sees his WinDVD cease to work and promptly raises class actions left, right and center against the shop that sold him his DVD, the company that sold him his PC, the media companies themselves, the individuals that broke the encryption - it'd be mayhem.
    the only people who'll win out of this are the lawyers. want to know why lawyers need such big salaries? IT'S BECAUSE THEY'LL BE THE ONLY ONES SPENDING ALL THEIR CASH ON ORIGINAL HD-DVD MOVIES.

  138. Re:"...trying to get content without paying for it by Jesus_666 · · Score: 1

    Hey, if your piracy story doesn't check out you just make sure to alienate your customers so much that it's actually less of a hassle to risk legal problems and download a DVD image with the ads removed. Bam, suddenly your piracy story works...

    Seriously, the studios seem to be pretty desperate to keep people from buying their products.

    --
    USE HOT GRITS WITH STATUE OF NATALIE PORTMAN (NAKED AND PETRIFIED)
  139. Programming the PS3 by bhima · · Score: 1

    So, has anyone managed to program the PS3 to decrypt a Blu-Ray movie disk yet?

    --
    Nothing in the world is more dangerous than sincere ignorance and conscientious stupidity.
  140. no surprise by v1 · · Score: 1

    If the player can play it, it can be broken. The only thing you can do is make it difficult. It's like preventing software piracy. For every month of development time for copy protection, you delay a determined and knowledgeable attacker for maybe an hour. This is just another fine example of that truth. If they'd have spent 10 years and 2 billion dollars instead it would have just taken an additional two weeks to break. Don't they get it? This will never change.

    As long as the DRM has been properly broken before I buy the unit, I'm happy. Kudos to you, keep up the good work.

    --
    I work for the Department of Redundancy Department.
  141. HD-DVD isn't region locked by Fezmid · · Score: 1

    "All this DRM does is allow movie companies to continue their questionable practice of price discrimination using artificial region locks and allows the media conglomerates to govern how and when you watch the content, extending copyright artificially."

    That'd be well and good, but HD-DVD has no region locking... You can buy an HD-DVD from anywhere (and lots of people do - mainly because there's a lot of titles that are Blu-Ray exclusive in the States that are being released on HD-DVD in Europe, such as Rambo, Saw, etc. not to mention the fact that you can get Harry Potter Goblet of Fire on HD-DVD in the UK, but not in the states (yet).

  142. Don't be a n00b by Anonymous Coward · · Score: 0

    Dude, if you have a High Def TV, and an XBox 360, and either Vista or Media Center edition of windows you can stream those Ripped HD DVD's or Blue Ray DVD's you downloaded to your 360 over your home network in high def...therefore you are correct in your assessment that you do not need the HD DVD player or be a sucker that got the betamax of 2007, however, you can enjoy the benefits right now...you may need Transcode 360 which I still can't get to work.

  143. Parent is on the right track! by Anonymous Coward · · Score: 0

    I think the end goal for the MPAA would be something like forcing your DVD HD BR whatever player to be connected to the Internet and you must register your player SN and each DVD SN. Then, the unique key from each DVD would be registered to your specific player. (if we are lucky, we can register more than one player) Then on top of that, the use of Public and Private keys would *authorize* the player to allow you to start playing the disk. For extra security, they could require you to use social security or some other private number as a password to encourage you to not share it.

    Please note that I don't have all the details worked out for the above scenario, but if they REALLY, REALLY want to lock down use, then this would be the way to go. Alternatively, if Broadband speeds greatly increase over the next 5-10 years we could see everything go to download based with time sensitive usage (4-8hr). No more disks. If everything used to encrypt the disk is on the disk, it doesn't matter what type of technology they *secure* it with, someone will break it.

    Mike

  144. Nah... flawed already.. by denzacar · · Score: 1

    You would just need to find what kind of HD-video content Guido is into (my guess... German lederhosen-latex porn), distract him with it and then hit him on the back of the head with a lead pipe.

    Don't worry. Guido's are just genetically engineered, they are not real people, so its not murder. But it still is breaking the copyright protection.

    --
    Mit der Dummheit kämpfen Götter selbst vergebens
  145. Flat Earth proponents. by jotaeleemeese · · Score: 1

    Global Climate Change deniers.

    DRM supporters.

    The same bloody side of the coin.

    --
    IANAL but write like a drunk one.