“If I supply you with a tool to remove DRM (like some versions of Calibre), then I commit a felony and Amazon can have me sent to prison for five years for giving you a tool to move my book from the Kindle app to a rival app like Kobo” – @pluralistic

lifehacker.com/tech/you-can-re…

in reply to Molly White

I know the longterm solution is to eliminate DRM anti-circumvention laws (or at least their enforceability for such misapplications, if that's as much as is politically feasible initially), but for now: What if the publisher gives the proven ebook buyer a Kobo gift code for the same ebook, and Kobo waives the cost to the publisher of accepting that code?
This entry was edited (3 weeks ago)
Unknown parent

mastodon - Link to source

David

My semi-ridiculous idea: ship a modified and restricted browser (perhaps a LibreWolf fork), preconfigured to capture a corresponding HTTP Archive and filtered packet capture, starting after the user logs into their Amazon account, capturing only while they navigate the browser to their Kindle or Audible library (to confirm purchase), before or after visiting the "Login & Security" page (to match the account email address). Then automatically log the user out of that session (to invalidate the captured session token) when they click "Save."

The network traffic should be indistinguishable from a customer browsing their own account. Having the human drive the browser, based on a checklist of links, would be the easiest way to have the timing look human.

The captured corresponding plaintext and TLS traffic would provide a digital signature, courtesy Amazon's web servers, authenticating the contents of the customer's library and the email address associated with the customer's account. That solves the forgery problem.

I imagine the ToS now or later could prohibit capturing one's one network traffic, but I don't imagine a means by which Amazon could detect packet capturing to enforce that.

Unknown parent

mastodon - Link to source

David

My semi-ridiculous idea: ship a modified and restricted browser (perhaps a LibreWolf fork), preconfigured to record a corresponding filtered packet capture and the TLS session key, starting after the user logs into their Amazon account, capturing only while they navigate the browser to their Kindle or Audible library (to confirm purchase), before or after visiting the "Login & Security" page (to match the account email address). Then automatically log the user out of that session (to invalidate the captured session token) when they click "Save."

The network traffic should be indistinguishable from a customer browsing their own account. Having the human drive the browser, based on a checklist of links, would be the easiest way to have the timing look human.

The captured corresponding TLS traffic and session key would provide a digital signature, courtesy Amazon's web servers, authenticating the contents of the customer's library and the email address associated with the customer's account. That solves the forgery problem.

I imagine the ToS now or later could prohibit capturing one's one network traffic, but I don't imagine a means by which Amazon could detect packet capturing to enforce that.

in reply to paulasimoes

@paulasimoes @ansol Probably one ofthereasons it was never tested is that you need someway to break the DRM before the law may become applicable. Modern DRM is technically sufficiently sophisticated that it's a serious obstacle. And those working on breaking the DRM may not be protected by the law because their DRM-breaking efforts may also be used for illegal purposes ☹️
in reply to Stefan Monnier

@monnier

I'm not sure if I understand your point. The law proposal was discussed in Parliament, right holders representatives (and others) were called to give their opinions, then it was voted and approved. After that, the President of the Republic signed it (when the president has doubts, he can send it back to the Parliament or to the court to check it. He didn't have doubts in this case).
So, the law is applicable.
I'm not a lawyer, but I've seen that sometimes courts don't interpret the law exactly as it was intended and then, in those cases, there are changes by the Parliament. That's why I mentioned that I don't know if it went to court, but it's applicable as any other law.
Let me add that we worked with the definition in the law. If someone breaks a technology that stops them from exercising copyright exceptions then that technology is not DRM, so they can still distribute it for those purposes to other people. Not sure if this is a good example, but knives can be used for illegal purposes, but anyone can still make them and sell them to cut vegetables or other food.

@molly0xfff @pluralistic @ansol

in reply to paulasimoes

@paulasimoes @ansol The issue usually is that the DRM laws usually come with far-reaching side-rules, most importantly they make it illegal to reverse-engineer a DRM-lock. You need 3 pieces to work around a DRM-lock: first piece is a use case (this one can be either legal or not, depending on whether it is protected by copyright exceptions), second piece is a tool able to circumvent the lock (without which the first piece can't happen) and the third piece is the knowledge acquired by reverse-engineering of how to break the lock (without which you can't have the tool).

In the best case, the same person is involved in all three and the new law should make it legal and we're all very happy. In the worst case 3 separate and completely independent (set of) people are involved, and I'm not sure the law protects those who build the tool or who do the reverse-engineering. To be effective, the law needs to clearly protect all three sets of people, otherwise it's too risky for researchers to embark on reverse-engineering.

This entry was edited (3 weeks ago)
in reply to Stefan Monnier

@monnier @ansol Sorry to get back to this only now. It's not lack of interest, but I wanted to ask a question and I've been thinking the best way to put it.
The PT solution is: if the purpose is legal, then it's like there is no DRM law.
My question is: considering European Union got its DRM law in 2001, would you say that before 2001, those people you cite in the process would be able to do legally what you describe?

Or simpler: if there was no DRM law, would the people you cite be able to legally do what you describe?

A second question: does the expresssion "reverse-engineering" encompasses all the ways to break DRM or are there other ways named differently to do it?

(If others in this thread want to give their input, please do)

Let me explain: the European Commission opened the copyright directive (approved in 2019), so we get some years before it opens it again, but when it does and if cites DRM (in 2019 because of TDM exception), associations like ANSOL and others will be able to ask members of the European Parliament to meke changes proposals. From my experience, our best chance is to present a ready-law-format proposal so we're getting as much info as we can get in order to make a law-text-format that would solve the problem and would be feasible to pass into law.

in reply to paulasimoes

@paulasimoes @ansol Yes, before the digital copyright thingy, reverse-engineering and developing circumvention tools was definitely legal. "Reverse-engineering" just means to investigate how something works. It can be (and usually is) a necessary element to break some DRM locks, but not always, no, tho I guess you could call most other ways as forms of reverse-engineering. Also sometimes breaking DRM requires illegal acts (like going against an NDA or other contract).
Unknown parent

mastodon - Link to source

paulasimoes

@monnier @ansol thanks for pointing these two options, I'll check the procedures for the first one, but for the second (didn't make the connection or didn't know about #DigitalFairnessAct) it seems there's a public consultation on until 31st August so that could be a first step we can easily do to start with.

I leave the link to the consultation if anyone else needs it:
ec.europa.eu/info/law/better-r…