Apparently, today was a slow news day

re: Apparently, today was a slow news day

Mike Dimmick — Fri, 26 Oct 2007 10:39:19 GMT

Bruce Schneier's understanding of Windows Vista DRM came directly from Peter Gutmann who'd never seen it. While Schneier is generally great on security he can be, and was, misled.

The point about DRM is this: in order to protect the data, it is encrypted. In order to play back, you have to decrypt. That means you need the key. For convenience, the key is stored on the computer in a way that the user can retrieve. Fundamentally you have both the encrypted data and the key, so you have the decrypted data at your disposal.

All DRM systems do is try to hide or obfuscate or otherwise encrypt that decryption key in such a way that the user can't directly find it. But in the end, code the user is running has to be able to get at the original form of the decryption key to decrypt the protected data. DeCSS was an unauthorised implementation of the CSS decryption algorithm, but on its own it was useless. It needed a key to be obtained. A software player did not protect its key sufficiently, it was extracted, and that key was distributed. Because the number of keys was limited, deactivating that key would have deactivated a lot of other, non-compromised players, so the extracted key continues to work for new DVDs.

For digital media such as digital cable, DVDs, HD-DVD and Blu-Ray, the actual video+audio stream is encrypted with a single key, that key then being encrypted multiple times, with different player keys, and the multiple encrypted keys being placed on the disc or in the stream somehow. In theory that enables compromised players to be disabled without affecting non-compromised players, though of course that seriously affects people who innocently bought the player that someone else compromised.

I don't know where XP MCE DRM keeps its playback key, but I would expect it to be somewhere under DPAPI. The master key for the DPAPI store is derived from your logon password. When you change your password, the DPAPI store is decrypted using the old password then re-encrypted using the new one. If you change a password through the Reset function, you lose access to all your old keys because it doesn't have the old password to decrypt the store.

I have also had programs which managed to break the ACL on the MachineKeys store (C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys), meaning that while it continued to work for administrators, it no longer worked for standard users. support.microsoft.com/.../278381 tells you what the ACL is supposed to be. (Windows Server 2003 doesn't actually have an ACE for LocalSystem, though.)

re: Apparently, today was a slow news day

Alun Jones — Wed, 03 Oct 2007 18:01:05 GMT

Note that this was not Vista that Jesper was having problems with. This was a pre-packaged, consumer-version of XP Media Center Edition.

But I'd love to know whether a Vista install has the same, or similar, issue with Comcast On-Demand. I have DirecTV, so I can't test.

re: Apparently, today was a slow news day

Dario — Wed, 03 Oct 2007 14:58:46 GMT

Your having problems and you know what your doing, imagine what it`s like for people with no technical background. DRM infested Vista will never be installed on any of my PC`s, it to would rather go Linux.

re: Apparently, today was a slow news day

Alun Jones — Tue, 02 Oct 2007 14:28:08 GMT

Just imagine how big the story would be if they were to discover that you actually shop at grocery stores, toy and book shops that aren't owned by your current employer!

Hey, do you think I could get international news coverage next year when I take a flight that I didn't book through my current employer?

re: Apparently, today was a slow news day

kamm — Sun, 30 Sep 2007 19:45:53 GMT

Vista is one of the most egregiously overhypoed and overpriced *update* from MS - yes, an update and quite an unimpressive at it.

WRT DRM Vista is nowhere better except you will ned 2x the amount of your memory and CPU to run the *exact same* software under Vista but with more annoyance and bugs.

All this after 10 motnhs of use, keep in mind.

Vista proved that I suspected for years now: MS has NOTHING to do with invention, period.

No matter how 'honest' guy you are, Jesper, sooner or later you'll reach the same point I did:

SAY 'NO' TO DRM.

That's it, that's all you have to do. When I buy something, that copy is mine, period. I cannot multiply and sell them, it's obvious - however it'ss just as obvious that I can play it on ANY of my device, moreover on my neighbors device if I want to, just like we did with the VHS or tape or CD.

Also since nobody will pay for me if a player will scratch my DVD, I am perfectly entitled to make my own backup and keep it in my safe, digital or legacy, my choice.

These are the things you have to remember and you will say NO to any DRM after few weeks of thinking.

I've been a Windows user for more than a decade and Vista and its utter idiocy was the last straw: I will ditch Windows as soon as I can, most likely around late next year (unless something revolutionary change will happen to Vista which is highly unlikely).

I've seen two dozen of my fromer or current colleagues going down this road; some opted for linux, some for other, others simply ditched the whole electronic entertainment idea and keep separate things instead of giving in for MS or Sony or anybody else when it comes to your living room.

And it's not only good but also FEELS GOOOOOOOD! You finally won. The evil Vole or lying Steve or the uber-dictator SOny and all their coporate BS - makes no difference anymore when you simply trash their idea of restricting your rights even further, ditching the old status quo and forget DRm forever. :)

re: Apparently, today was a slow news day

Jeff Dickey — Sun, 30 Sep 2007 02:15:03 GMT

There is no perfect solution, especially on the PC platform, but the more tightly-welded the OS is to Digital Restrictions Mandate, the less stable and usable it is. There have been many articles and papers written by security professionals such as Bruce Schneier on how DRM in general and Windows DRM in specific are a) impossible to perfect in either theory or practice, b) active security threats to the user system, c) inherently anti-consumer in orientation, even if neither a) nor b) applied. The fact that the Windows-using sheeple don't pull a Howard Beale "I'm as mad as hell, and I'm not going to take this any more!", is testament to the overweening control exercised by companies clearly not acting in their customers' best interests - nor, therefore, in the long run, of their own.

re: Apparently, today was a slow news day

Charlie Bradley — Fri, 28 Sep 2007 16:21:46 GMT

Just watching the videos of windowsMCE v. LinuxMCE I would definitely pick linuxMCE. The auto detection alone is superior.

video.google.com/videoplay

re: Apparently, today was a slow news day

jesper — Fri, 28 Sep 2007 02:07:20 GMT

Cyrus, I think it would actually. I think what happened was that the DRM components got horked somehow. To make it harder to tamper with them they have been designed to prevent people from doing many modifications, which also prevents me from fixing them. However, if I flatten and reinstall they should go back to normal. That, of course, calls into question whether it is reasonable for a single component like this to necessitate a reinstall?

I haven't had the chance to do much more than disconnect the box yet, but I think I will look into a couple of options. In general, I do like Vista, and if I can stick with that I might.

re: Apparently, today was a slow news day

Cyrus Jones — Fri, 28 Sep 2007 01:04:55 GMT

I don't think Vista would be any better than your current situation. It would be a lot worse.

re: Apparently, today was a slow news day

Shan — Thu, 27 Sep 2007 22:26:08 GMT

Oh dear Jesper - whatever you do, don't let slip which you prefer, Pepsi or Coke, if you ever change your mind you'll probably get sued!!!!!

re: Apparently, today was a slow news day

Ex-MSFT — Thu, 27 Sep 2007 18:01:04 GMT

Its designed to protect content at the cost of end-user. I have no idea when Vista will decide something is premium content and not play it. What a nightmare.