iTunes DRM-Free Files Contain Personal Info

← Back to Stories (view on slashdot.org)

iTunes DRM-Free Files Contain Personal Info

Posted by kdawson on Monday January 12, 2009 @07:39PM from the musical-steganography dept.

r2k writes "Apple's iTunes Plus files are DRM-free, but sharing the files on P2P networks may be an extremely bad idea. A report published by CNet highlights the fact that the account information and email address of the iTunes account holder is hidden inside each and every DRM-free download. I checked, and I found I couldn't access the information using an ID3 tag editor, but using Notepad I found my email address stored inside the audio file itself."

63 of 693 comments (clear)

Seriously... by fyngyrz · 2009-01-12 19:39 · Score: 5, Insightful

I don't see the problem. I didn't want them to remove DRM so I could ignore the copyright on the music, I wanted them to remove it so I could use it on any device I wanted to listen to it on. They did that; now I can, as far as I'm concerned, we're all good now.
If you interpret the lack of DRM as permission to ignore copyright, and you end up in trouble because you did so...
Nope, don't see the problem.

....sharing the files on P2P networks may be an extremely bad idea

Good grief. "Sharing" copyrighted music files on a P2P network was always an extremely bad idea. If you ever had any fraction of an excuse for doing it (and frankly, I don't really think you did, but...) it is gone now, at least as far as iTunes purchases go. What has changed is it is now reasonable to purchase music, because you'll actually get to own it, use it on *all* your gear, back it up, etc.
The only thing I can think of that is really affected by this is your ability to legitimately resell recording of a tune you own, because you bought it. And for that issue, I give it.... maybe an hour before someone comes up with a tool to ZOT that name and email address right out of there. Maybe it'll even put the new one in. Pride of ownership and all that.

--
I've fallen off your lawn, and I can't get up.
1. Re:Seriously... by Tubal-Cain · 2009-01-12 19:42 · Score: 4, Insightful
  
  Agreed. This is a fairly reasonable compromise on Apple's part.
2. Re:Seriously... by quarrel · 2009-01-12 19:48 · Score: 4, Insightful
  
  Oh please, if you're the copyright holder are you really paying Apple and downloading it off itunes?
  No. You're not.
  GP is correct.
  --Q
3. Re:Seriously... by Thanshin · 2009-01-12 19:50 · Score: 3, Insightful
  
  So if tomorrow a file with your personal information is shared on the web and you simply don't know how is it possible, so you're fined a couple thousand bucks, I guess you won't mind?
  Or you're so sure of the infalibility of Apple's system that you're willing to bet a couple thousand bucks, in exchange for... Nothing?
  Great odds.
  P.S.: Avoid casinos.
4. Re:Seriously... by erroneus · 2009-01-12 19:52 · Score: 4, Insightful
  
  While I agree with you, here is the problem I have with it:
  Person A is the target
  Person B is the attacker
  RIAA is the litigious groups of assholes
  Person B decides to harm Person A. Person B knows Person A's email address. Person B modifies a bunch of MP3s to contain Person A's email address and then posts them to every torrent site imaginable. RIAA is famous for ignoring what "reasonable doubt" might suggest or imply and immediate goes into litigation. Even if it is later revealed that Person A was a victim in this scenario and is completely innocent of wrong doing, Person A just spend a LOT of money in the process. (It can be reasonably assumed that Person A spent a lot of money because without having spent money, a defendant most likely will lose.)
5. Re:Seriously... by NNKK · 2009-01-12 19:53 · Score: 4, Informative
  
  AAC ( http://en.wikipedia.org/wiki/Advanced_Audio_Coding ) is an industry standard, and even if it weren't, iTunes helpfully provides a "Convert to MP3" item in the context menu of non-DRM'd AAC files that does exactly what it says.
6. Re:Seriously... by Anonymous Coward · 2009-01-12 19:57 · Score: 4, Informative
  
  AAC in a a run-of-the-mill MPEG-4 container, with ID3-formatted tags stored in a separate atom (permissible in the MPEG-4 standard).
  Anything that uses libavcodec/libavformat as a base (ffmpeg, VLC, mplayer, etc) can read these files. They may not have the code to extract the ID3 tags from the atom and feed the data blob to something like libid3... but as long as the player software can read standard MPEG-4 files with basic AAC... it can play these suckers.
  The format just isn't as prevalent as MP3, but that doesn't automatically make it proprietary.
7. Re:Seriously... by amake · 2009-01-12 20:09 · Score: 5, Informative
  
  Converting from AAC to MP3 is lossy.
8. Re:Seriously... by zachdms · 2009-01-12 20:09 · Score: 4, Insightful
  
  Couldn't you correlate your purchase record, or lack thereof, to validate or disprove the claims against you in that scenario?
  It seems like a quick comparative analysis there would pretty quickly mitigate *most* of that concern.
9. Re:Seriously... by DA-MAN · 2009-01-12 20:23 · Score: 5, Insightful
  
  i seriously doubt that an email which can be easily changed in a file can be used as the sole grounds for pressing charges. It ma however bolster a case where a user has been tracked by IP and the files have his email too.
  As we're talking about purchased music, all Apple would have to do is lookup the record of the credit card used to purchase the song.
  So unless you always use iTunes redeemable gift cards, it's probably fairly easy to track a user definitively.
  
  --
  Can I get an eye poke?
  Dog House Forum
10. Re:Seriously... by lisaparratt · 2009-01-12 20:35 · Score: 5, Insightful
  
  Of course there's loss, but to imply a lack of transcoding loss is a prerequisite before anyone can use it anywhere is absolute madness.
  No one who lives outside of their mum's basement cares. Really. Your average MP3 player is not hifi, and your average consumer doesn't give two shits about the quality loss.
  Also, last I checked, Steve Jobs didn't repeatedly smash your face into a MacBook keyboard whilst pointing a shotgun at your head with his free hand until you bought music from iTunes. If you don't want it, don't buy it.
11. Re:Seriously... by myxiplx · 2009-01-12 20:36 · Score: 4, Interesting
  
  Exactly. My first thought on reading this was "sweet, somebody's finally gone about it the sensible way".
  I mean seriously, I've been waiting for somebody to implement this for nearly 10 years now. It's an obvious way to combat piracy since you can identify the source of the leak, and it's a massive benefit that digital distribution offers the record labels. Users get cheaper tracks and can download them instantly from the comfort of their own home. Record labels get to discourage piracy and have an easy way to track down the source when it happens.
  Honestly, it's such a simple solution I thought there must have been something I was missing for the record companies to not implement this. It's win win as far as I can see.
12. Re:Seriously... by asc99c · 2009-01-12 20:48 · Score: 5, Informative
  
  The English is fine, just not the information!
  Like many places, Spanish law has exemptions for private use, which probably makes removing DRM completely legal. However the owners are allowed to make copies only for private usage, with collective and lucrative uses not allowed. Sharing on P2P would definitely constitute a collective use.
  Although as with almost everywhere else, P2P itself is not illegal.
13. Re:Seriously... by mosschops · 2009-01-12 20:54 · Score: 5, Informative
  
  Converting to MP3 is lossy, regardless of the source format.
14. Re:Seriously... by Yvanhoe · 2009-01-12 21:41 · Score: 3, Insightful
  
  And this is doubly great : now if someone shares a file by putting myxiplx@slashdot.org instead of their own address, they will immediately be able to track the pirate.
  
  I mean, seriously, if you want to implement digital right protection, you either do it completely (hint : you can't) or not at all. Partial implementation like this one are completely useless.
  
  --
  The Wise adapts himself to the world. The Fool adapts the world to himself. Therefore, all progress depends on the Fool.
15. Re:Seriously... by FridgeFreezer · 2009-01-12 21:56 · Score: 4, Informative
  
  Well up the bitrate and reduce the loss - people talk a lot of shit about hi-fi but in reality a decent MP3 will be indistinguishable from anything else on 99% of gear in 99% of listening situations.
  
  --
  There is no music - home taping killed it.
16. Re:Seriously... by Silas+is+back · 2009-01-12 21:57 · Score: 4, Informative
  
  Just to note, the email address has always been part of iTunes Plus files. This in nothing new.
  
  --
  this sig is useless
17. Re:Seriously... by paul248 · 2009-01-12 22:04 · Score: 4, Insightful
  
  Well, Apple could sign the file with their private key after adding your user ID. It wouldn't stop people from blanking it out, but it would securely prevent impersonation.
18. Re:Seriously... by martinX · 2009-01-12 22:08 · Score: 5, Funny
  
  I'd whip you with my Pear Anjou cables, but I've just finished burning them in and aligning the natural resonance using my interocitor.
  
  --
  When they came for the communists, I said "He's next door. Take him away. Goddam commies."
19. Re:Seriously... by mstroeck · 2009-01-12 22:11 · Score: 5, Insightful
  
  Please... We've done blind tests with orchestra and studio musicians, and the detection rate of MP3 vs. CD on $500 studio headphones was not statistically significant. Get over it already.
20. Re:Seriously... by halcyon1234 · 2009-01-12 22:18 · Score: 5, Interesting
  
  Let me throw you a hypothetical here.
  Suppose I hated you. I see you have a link to your homepage-- many users do. That page, being an expression of personal taste, might have information about music you like. Yours does. Now, yours is a "CD collection", but it could just as easily be a list of songs you bought of iTunes (as many other users do, in a list, in their blog, etc). So I pick something from your list, say A Perfect Circle - Emotive (good choice, BTW). Google tells me your real name is Zach Robinson. One of your email addresses is zachd at microsoft dot com (obfuscated for your benefit). So I whip up a batch of itunes encoded A Perfect Circle with your name and mail address in it. I throw them on all the P2P sites I can find, wait a couple weeks, then drop a dime to the RIAA. It's trivial moments of effort for me.
  Now you have copyrighted music with a label that says "owned by Zach Robinson" floating around, and a group of lawyers looking to extort a couple grand out of you. Sure you could make up a fake name and a fake email address that you use exclusively for purchasing from iTunes-- but why should the onus of not being sued be on you? Or, why couldn't Apple instead have taken a secret internal customer id number, hashed it using the date/time of purchase as a salt, run it through a secret algorithm, and slapped that into the "owned by" field so that I couldn't reproduce it? (Until their method is cracked and we're back to square one, that is)
  Really, it all comes down to normalization. What describes a song? The artist, the album, the year of release, the genre-- all that fun stuff. Does YOUR name and email address describe the song? No. Then it doesn't belong in a song file. It belongs in your iTunes account, along with a list of songs you "own".
  So it only serves to harm the innocent, is a poor method of tracking ownership, and introduces unrelated data to a set. There is NO reason for it to be there.
  
  --
  UTF-8: There and Back Again
21. Re:Seriously... by zachdms · 2009-01-12 22:37 · Score: 3, Insightful
  
  Right, we both saw those possibilities. And then I point out that there's no record of me purchasing those tracks and it's kind of game over and I'm sad that that's an effective use of your time.
  As long as there's an actual correlation between those embedded email addresses and the purchase logs at Apple, it should be child's play to disprove "plants" like that.
  Granted you have a window of malice here, but I believe it's a lot smaller than is being suggested. Those plants could be checked by Apple without me ever having to know. Your narrow window of malice (hoping to hit a subset and NOT a superset of whatI've purchased) would be even further mitigated by them simply setting "Bar For Kicking In Your Door" to some non-tiny number. So you don't even necessarily get to waste my time. Just your own. ;)
  You might with your project succeed with redistributing music files around the net ... but that's kind of where things are now.
22. Re:Seriously... by couchslug · 2009-01-12 23:09 · Score: 3, Funny
  
  "Also, last I checked, Steve Jobs didn't repeatedly smash your face into a MacBook keyboard whilst pointing a shotgun at your head with his free hand until you bought music from iTunes."
  After THAT sort of treatment, did you really think we'd tell you anything?
  The first rule of the Steve Jobs Beat Down is "don't talk about the beat down".
  ]
  
  --
  "This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
23. Re:Seriously... by pdbaby · 2009-01-12 23:36 · Score: 3, Informative
  
  I diff'd 2 non-DRM iTunes songs a while ago... they just list your e-mail address and purchase date in the metadata. And I suspect that's done client-side to simplify their cache system.
  
  --
  Global symbol "$deity" requires explicit package name at line 2. - If only $scripture started "use strict;"
24. Re:Seriously... by pdbaby · 2009-01-12 23:40 · Score: 5, Interesting
  
  I've mentioned it elsewhere but songs are also encoded with the purchase timestamp. So if you've no access to someone's files then you've essentially zero chance of getting the purchase timestamp right, even if you get the songs they own right.
  
  --
  Global symbol "$deity" requires explicit package name at line 2. - If only $scripture started "use strict;"
25. Re:Seriously... by Weedlekin · 2009-01-12 23:44 · Score: 3, Interesting
  
  "The owners are allowed to make copies only for private usage, with collective and lucrative uses not allowed."
  It would be more correct to say that collective use is technically illegal, because it's most definitely allowed. A Spanish legal precedent was established for this at the end of 1996 by a judgement that exonerated an accused Internet file sharer on the grounds that non-commercial copying not only isn't a crime, but that it's a common social practice that should not therefore to be criminalised. This stance on the part of the Spanish legal authorities was underlined at the end of 1997 when what amounts to their chief copyright cop said that not everything which is technically illegal is a crime, including non-commercial copying via the Internet or any other means, so they have no intention of pursuing anyone who isn't involved in commercial piracy.
  The effect of the above has been to leave civil litigation as the only route open to representative bodies of copyright owners, but their efforts are severely hampered by the fact that ISPs refuse to disclose the identities of the people behind specific IP addresses on the grounds that Spanish law (which is based on EU data protection directives) only requires them to do so as part of a criminal investigation or where matters of public safety or national security are concerned. This eventually ended up at the European Court Of Justice subsequent to a request for a definitive ruling from the Spanish courts, and the ECJ found in favour of the ISP (Telefonica), thereby effectively making civil litigation against Internet file sharers almost impossible.
  
  --
  I'm not going to change your sheets again, Mr. Hastings.
26. Re:Seriously... by paanta · 2009-01-13 00:44 · Score: 5, Insightful
  
  I don't think you really addressed the compromise or reasonableness aspect of this.
  
  Apple wants DRM free stuff and RIAA doesn't. Apple stuffs personal info in there so there will be some accountability should the file get P2P'd. Sounds like compromise to me.
  
  As far as reasonableness? Your scenarios sound pretty darn unlikely. Almost as unlikely as someone stealing my iPod with my contact info in it, then deliberately leaving it at the scene of a murder in order to frame me. Or maybe space aliens will steal the music on my iPod and accidentally broadcast it back to Earth. NASA will pick it up, magically determine the email address associated with it, send spooks to pick me and perform experiments on me for the rest of my life.
27. Re:Seriously... by Schadrach · 2009-01-13 00:58 · Score: 5, Insightful
  
  How is a digital signature verifying that the file is the original provided by Apple iTunes DRM in any meaningful sense? It places no restrictions on the file in any form, doesn't prevent or limit it's usage, simply acts as verification: "My checksum matches the checksum that this signature says it should, therefore the file has not been changed since purchased from iTunes".
28. Re:Seriously... by nmg196 · 2009-01-13 01:00 · Score: 4, Insightful
  
  Listening to music on headphones while on the train is lossy but people still do it. We can't all sit in silent rooms with reference quality speakers 6 ft in front of us and £1000 amplifiers. The quality loss is totally irrelevant as it cannot be heard under normal listening conditions by the vast majority of people.
29. Re:Seriously... by sglewis100 · 2009-01-13 01:00 · Score: 4, Insightful
  
  Fair enough so long as there is no additional lossiness in the conversion.
  Why? Who cares? AAC is a valid format. They should use MP3 because more non-iPods support MP3 then AAC? Maybe they should support Ogg because it's "better" or sell music in a lossless format so that you are closer to the original.
  
  I kind of understood the complaint when it was DRM protected AAC "wahhh... I can't play it on my non-iPod even though that device supports AAC". Now you can. But there's no reason Apple should have to support MP3. To many, these high bitrate AAC files are superior to MP3. Have a non-AAC compatible player? Go to Amazon.com, they have a similar selection.
  
  There will always be a complainer until Apple releases every song ever, including bootlegs, in Ogg, MP3, AAC, Flac, and ten other formats, and change the iPod to support all of the same, and make the iPod a 3G wireless device that has a built in BitTorrent client to grab the files quicker, and they cook you dinner and do your laundry too. Maybe some of the readers here just aren't the iPod's intended audience?
30. Re:Seriously... by sglewis100 · 2009-01-13 01:03 · Score: 5, Insightful
  
  If you think $500 headphones are high quality, you're sorely mistaken.
  If you think the intended audience for things like iTunes and the Amazon MP3 store DON'T think $500 are high quality, you might be the mistaken one.
31. Re:Seriously... by Shakrai · 2009-01-13 01:19 · Score: 4, Funny
  
  If you think $500 headphones are high quality, you're sorely mistaken. http://www.stax.co.jp/ [stax.co.jp]
  I only have one question regarding those $5,000 headphones: Can I get them with a white wire? ;)
  
  --
  I want peace on earth and goodwill toward man.
  We are the United States Government! We don't do that sort of thing.
32. Re:Seriously... by Cowmonaut · 2009-01-13 01:51 · Score: 4, Insightful
  
  Note: My numbered rebuttals correspond to your numbered statements.
  1) Apple does negotiate with the RIAA about the terms of the DRM service that Apple has to maintain and run. I'm far from an Apple fanboy, but there have been stories over the years going off on how the DRM wasn't Apple's idea and so forth. There are even quotes of Steve Jobs saying that DRM is bad, and that guy sure as hell isn't the type to just take it. I seem to remember a Slashdot story telling of how they were forcing the RIAA to accept their terms, but over the years the opposite I admit has been more likely.
  Of course, the actual music execs have been saying for years that DRM is bad but the lawyers at the RIAA seem to be running their companies into the ground for them.
  2)The private info consists of the email address related to the account that purchased it. I do not believe it actually contains a lot of 'personal information' such as your name, or social security number, or bank account numbers. I don't personally buy DRM'd music (which means I've yet to buy an iTunes track) so I can't be 100% positive, but I'm fairly sure there would of been an article on Slashdot before given this is nothing new to iTunes.
  By the way, how is it any different than leaving a card or sticker with your name and phone number on an item in case you lose it so a good Samaritan (in the unlikely event your stuff is found by one) can return it to you? Honestly I think this is a non-argument.
  3)You're the kind of person that would put a kid in a bubble to keep him from getting hurt, but not thing of how to feed him aren't you? The 'private info' consists of an e-mail address. Your pedophile argument is no better than the morons who scream "think of the children" in politics, equally pointless and used as an exaggeration of a problem to prove your point.
  A pedophile isn't going to go track down someone by their bloody email address when they can just watch the school and pick their target in person. They wouldn't even know its a kids iPod until they found out who owned the email address, it could be a teacher's. Never mind the difficulties in actually associating a face to an email address when all you have to go by is the address itself and the fact they have an iPod.
  The scams are equally as bad. Worst case, you have someone use the email address on a few porn sites so they get some XXX spam mail. If you are a mature parent, you can deal with that easy enough and if you are a tech savvy parent it shouldn't be a problem anyways unless you don't supervise your kids online experience (which means ALL online aspects, not just browsing and IRC).
  So tell me. What would you do with my email address? How will you track me down with mine if I don't use it on Myspace? What if its only used on iTunes?
  I think people are knee-jerking a bit much.
33. Re:Seriously... by samkass · 2009-01-13 02:34 · Score: 5, Insightful
  
  I think the concern is the following scenario: 1. Download from iTunes onto an iPod, 2. The iPod is stolen, 3. The tunes on the iPod are uploaded to file sharing networks, 4. I get sued by the RIAA. Of course, I think the CYA thing to do is just make sure you file a report whenever your iPod is stolen, and that should make short work of any lawsuit defense.
  
  --
  E pluribus unum
34. Re:Seriously... by jkerman · 2009-01-13 03:21 · Score: 3, Insightful
  
  actually.. we are living in the world of ~12th generation mp3 players. I bet a $4 mp3 decoder chip from china sounds better than anything called "hi-fi" when the term was invented
35. Re:Seriously... by shark72 · 2009-01-13 03:32 · Score: 5, Insightful
  
  "3) Imagine how many iPods are lost at schools. How many scams can you think of that take advantage of the owner's desire to get their iPod back. Worst of all, show me a pedophile that wouldn't love to pretend to be some kid's classmate wanting to return their beloved iPod in order to lure them somewhere private. Lost iPod + email address of owner = "Meet me by the white van with tinted windows""
  Yes, won't somebody please think of the children?
  
  Pirates: "No good music is available onine! I'll stop pirating when the record labels wake up and embrace online distribution."
  
  Record industry: "Okay, our entire catalogs are online now."
  
  Pirates: "But now it's too expensive! Good god, do you think we're rich? I'll stop pirating when music is less than a buck a track. That's a fortune!"
  
  Record industry: "Okay, you win. Now by shopping around, you can find lots of music for $0.80 a track or less."
  
  Pirates: "But you still have that DRM which impedes my fair use rights! I'll stop pirating when DRM is dead. Until then, it's off to TPB for me."
  
  Record industry: "Hey, you know, you were right all along. It took us a while to realize it, but you're right. We've removed the DRM."
  
  Pirates: "PEDOPHILES! PEDOPHILES! YOU'RE ENCOURAGING AND ASSISTING THE KIDNAPPING OF CHILDREN! Because of this despicable act, I'm going to pirate TWICE as much music now!"
  
  --
  Sitting in my day care, the art is decopainted.
36. Re:Seriously... by shark72 · 2009-01-13 03:35 · Score: 4, Insightful
  
  This sort of thing has been a risk for a while. For instance, your car might be stolen, then used as a getaway car for an armed bank robbery. Witnesses make note of the license plate, and the police come to your door.
  This doesn't make license plates a bad idea.
  
  --
  Sitting in my day care, the art is decopainted.
37. Re:Seriously... by kithrup · 2009-01-13 03:51 · Score: 4, Insightful
  
  The email addresses have always been in clear-text. Even in the encrypted song files.
  Seriously, am I the only person in the entire world who runs strings or emacs on binary files just to see what might be in them?
38. Re:Seriously... by nyctopterus · 2009-01-13 04:46 · Score: 4, Funny
  
  Yes. Yes you are.
39. Re:Seriously... by jc42 · 2009-01-13 16:04 · Score: 3, Interesting
  
  Seriously, am I the only person in the entire world who runs strings or emacs on binary files just to see what might be in them?
  Yes. Yes you are.
  No, he (she) isn't. The first thing I did after reading the summary was to pick up my Mac Powerbook, cd into my Music/Itunes directory, find a couple of .m4p files, and run the strings command on them. Adding a few greps to filter out the printable binary junk, I quickly found my name and email address.
  As for someone writing a tool to replace them, I found that I already had one. Years ago, I wrote a little command-line app that just does a simple string substitution and writes the result to stdout. It's quite handy, and I use it all the time. I told it to copy one of the .m4p files, with my email address replaced by a fake email address of the same length. I then told iTunes to load that file - and it played fine.
  Then, of course, I did the same trick, replacing my name with a different name of the same length. As I expected, iTunes popped up a little window saying that it needed to check the tune's registration, showing me the name, and asking for a password. Presumably when DRM goes away, that little window will also go away, and I'll bet that the tunes will play.
  I don't think I'll bother posting the program. Any semi-competent beginning C programmer should be able to type it in under a minute. Probably most perl and python programmers can do the same, a bit faster, as could any moderately experienced emacs user. 25 years ago, when I first picked up the C bible, I wouldn't have found it a challenge after my second day with the language.
  Just make sure the replacement strings have the same byte count as the old name.
  
  --
  Those who do study history are doomed to stand helplessly by while everyone else repeats it.
hmmm by JimboFBX · 2009-01-12 19:43 · Score: 4, Insightful

so what happens when you send it to someone else in a "hey check out this song" kind of way, then that person is stupid and sticks it in their lime wire folder?
1. Re:hmmm by ozphx · 2009-01-12 20:12 · Score: 5, Funny
  
  Seriously, you're not expecting the iTunes police to come crashing through the window with guns blazing are you?
  As a member of the iTunes Police, I take strong exception to this. Firearms safety has always been a core tenet of iTP training. An iTP officer will only open fire if a copyright violation is in progress, or the officer has reasonable belief that lethal force is the only way to prevent a copyright violation.
  iTunes Police would never "come crashing through a window with guns blazing". The very thought of it!
  
  --
  3laws: No freebies, no backsies, GTFO.
2. Re:hmmm by IBBoard · 2009-01-12 21:26 · Score: 3, Insightful
  
  What if the disk also contained word processed documents? Or a backup of your emails? Or you lost your MP3 player and it had your calendar and address book on? Or even your mobile phone with its list of phone numbers? We put lots of personal data on devices that can be lost, some of which is worse from an identity standpoint than an email address.
  Besides, I'd expect most people who pick up a disk and don't hand it in to the police are likely to either a) nuke it and use it or b) look for bank details and other things they can sell, rather than music that they need to use their own bandwidth to share for no profit.
No worries by Thanshin · 2009-01-12 19:44 · Score: 5, Insightful

Never again buy anything related to music and you'll be safe.
Alternatively, you can buy music in small stores, in cash. In that case, it's better to wear sunglasses and a hat. You wouldn't want anyone to discover you're one of those people who actually are paying clients of the music industry.
1. Re:No worries by BasilBrush · 2009-01-12 23:15 · Score: 3, Informative
  
  I know many people incapable of getting music from a CD to a mp3 player but able to transfer from the web to the player.
  They must be pretty dumb then. Provided iTunes is running, it starts ripping a CD into the library as soon as a CD is inserted. And as soon as the iPod is connected, the files will get transfered to it. No keyboard or mouse interaction needed.
  (These two actions can be disabled with preferences, but I believe that is the default behaviour.)
You can see the info in iTunes by Anonymous Coward · 2009-01-12 19:50 · Score: 5, Informative

You can see the info within iTunes.
Get Info on the Song/Video/Etc
Then go to the Summary Tab, Second column.
Old news by AmaranthineNight · 2009-01-12 19:53 · Score: 5, Informative

This has been the case for AGES

http://business.timesonline.co.uk/tol/business/industry_sectors/media/article1871173.ece

Or at least for about a year and a half, I think slashdot reported on it then, too.
1. Re:Old news by halcyon1234 · 2009-01-12 21:52 · Score: 3, Insightful
  
  That'd be
  Note to editors: even if it's nearly two years old, it's still a dupe
  
  --
  UTF-8: There and Back Again
Hidden? by 1729 · 2009-01-12 19:53 · Score: 5, Informative

the account information and email address of the iTunes account holder is hidden inside each and every DRM-free download
How is this "hidden"? If you select an audio file purchased from the iTunes Store (with or without DRM), and go to File->Get Info, you'll see the following fields in the summary:
Purchased by:
Account Name:
Purchase Date:
Apple's not trying to hide anything here.
Old News by Star_Gazer · 2009-01-12 19:55 · Score: 5, Insightful

http://yro.slashdot.org/article.pl?sid=07/05/30/2014222
I think it's OK. Even if I really buy from iTunes to burn a cd as gift, at that point the account info will be gone, so what's the matter?
Not everywhere in the world has the same laws by Rix · 2009-01-12 19:59 · Score: 4, Informative

In many places, it's perfectly legal to share you music collection. Here in Canada we pay a tax on recordable media for that right.
Old story by rduke15 · 2009-01-12 20:22 · Score: 5, Insightful

This is an almost 2 year old story: Apple's DRM Whack-a-Mole (Posted by CmdrTaco on 10.06.2007 17:08)
If it bothers you to have an identifying tag in your music files, well remove it or overwrite it.
As far as I understand, it's stored in a standard MP4 atom.
And if you don't know how to do it, ask Google, or try this suggestion which explains how to use AtomicParsley for windows or mac.
Old news by phooka.de · 2009-01-12 20:27 · Score: 5, Informative

This came up when they introduced iTunes plus ages ago. It's been discussed back then. Yes, the info is there. You can simply look it up, no problem. Your ID3-Tag-Editor might not be able to chanxge it since we're not talking MP3 here. That's it.
Just use a different editor, clean out the information and start the copyrightinfringement-frenzy you seem to have been waiting for for so long. Oh no, you already do that, I guess.
Or, if you don't like finding an editor that can delete the info, just go to a record store and steal the CD.
Keep your private stuff private: keep your privacy by HumanEmulator · 2009-01-12 20:39 · Score: 4, Insightful

So... if I keep the music I purchased for private use private, I have no privacy violation? Right?
Also, despite the summary's between the lines implication that Apple is hiding the info from ID3 tag editors, the audio files are MPEG4. This means they don't contain ID3 tags. Since MPEG4 is based on QuickTime, a QuickTime atom editor will happily show you the tags and let you remove them.
You could also have guessed the purchaser info was in these files based on the fact that iTunes shows it to you if you get info on a song.
Reasonable compromise... by Joce640k · 2009-01-12 21:00 · Score: 4, Insightful

Sure, so long as they make it abundantly clear that this is what they're up to.
Is this the case? I assume it isn't, because Slashdot and others are acting all surprised about it.

--
No sig today...
1. Re:Reasonable compromise... by Naturalis+Philosopho · 2009-01-12 22:45 · Score: 5, Informative
  
  It's clear. A certain percentage of slashdotters act all surprised every time it's repeated though. Of course, most /.'ers also act all surprised every time some wack-job blames video games for violence too. At least some people are pointing out that the account information has been part of iTunes files for forever and isn't news to most people who know how to do a Google search.
2. Re:Reasonable compromise... by peragrin · 2009-01-12 23:59 · Score: 4, Informative
  
  this is the second or third article about apple putting said info into their music files over the years. It isn't surprising. Apple even states it somewhere in the fine print of the EULA's.
  Slashdot suffers from ADD and forgets what it duped yesterday.
  
  --
  i thought once I was found, but it was only a dream.
3. Re:Reasonable compromise... by jcr · 2009-01-13 00:12 · Score: 5, Informative
  
  Sure, so long as they make it abundantly clear that this is what they're up to.
  Choose any iTunes plus song, and select "get info" from the main menu. On the left side of the "Summary" pane, you'll see "Purchased By", "Account Name", and "Purchase Date". IIRC, those were there on the DRM versions too.
  -jcr
  
  --
  The only title of honor that a tyrant can grant is "Enemy of the State."
4. Re:Reasonable compromise... by cayenne8 · 2009-01-13 03:13 · Score: 4, Interesting
  
  I'm guessing this is one reason they aren't going to DRM lossless (CD quality at least) versions.
  If it were in AAC Lossless...then it would be easy I guess to convert it to FLAC with no degradation of signal...and in doing so, delete the identifying information?
  Darn...if they'd just sell me CD or better quality, non-DRM music, I'd be in line with the rest of them to buy online.
  
  --
  Light travels faster than sound. This is why some people appear bright until you hear them speak.........
5. Re:Reasonable compromise... by tlhIngan · 2009-01-13 04:50 · Score: 4, Informative
  
  I seem to recall a recent change in terms of service. My guess is that if you actually read the whole thing, it would have told you that personal info is attached to files you download.
  I'm betting 99.9999% of the folks just clicked accept without reading the new terms.
  My only gripe on these sorts of changes in terms of service is that I think they should highlight what has recently changed.
  This has always been the case since the iTunes store opened! It's not news, it's several years old. Heck, when Hymn was available (removed FairPlay from purchased music, and this was 5+ years ago), it kept the personal information to prevent people from P2P'ing the newly unlocked music.
  So the very first time you used the iTunes store years ago, personal information was attached - it wouldn't have shown up with change bars because that part has not changed. You can probably find the news articles about it from years ago, and again from a couple of years ago when iTunesPlus was started about how the AppleID of the purchaser was embedded in the file.
  People are acting like this is completely new, when it's been happening for years now.
6. Re:Reasonable compromise... by Wildfire+Darkstar · 2009-01-13 06:39 · Score: 4, Interesting
  
  iTunes doesn't sell MP3s, though. They sell lossy AAC files in an MP4 container. So it's unlikely that they'd have ID3 frames in the first place.
  I haven't purchased any DRM-free songs from iTunes, but I'd suspect that the information is stored as standard MP4 atoms, and that the iTunes editing interface just doesn't give you the ability to modify them. In which case you could presumably use a standard MP4 tool to remove the information, if you were so inclined.
  That's just a guess, of course. It's obviously not clear from TFA.
  
  --
  Sean Daugherty "I have walked in Eternity -- and Eternity weeps."
Don't see a problem here. by Renderer+of+Evil · 2009-01-12 21:37 · Score: 3, Informative

Way to sensationalize something which has been known for years. Everything that is purchased on iTunes is stamped with user account and a unique transaction ID. Apps, videos, movies, rentals, etc.
It doesn't bother me because I don't share my music on p2p networks and I'm not paranoid like some people. I dislike DRM because I want to easily play my music on whatever device I want, not because of some ideological drive to stick it to THE MAN.
This is a non-issue.
Really old news? by Nabeel_co · 2009-01-13 04:03 · Score: 3, Informative

Correct me if I'm wrong, but didn't this issue come up back when Apple first released DRM-Free songs?
To add to that, the post is misleading, it's not actually hidden unless you are a complete and utter tool. In the info window of iTunes, it clearly shows the information they have "hidden" in the file...