“If I supply you with a tool to remove DRM (like some versions of Calibre), then I commit a felony and Amazon can have me sent to prison for five years for giving you a tool to move my book from the Kindle app to a rival app like Kobo” – @pluralistic
lifehacker.com/tech/you-can-re…
You Can Remove DRM From Your Digital Books, but It's Probably Illegal
There should be a legal way to back up the books and audiobooks you've purchased.Pranay Parab (Lifehacker)
David
in reply to Molly White • • •David
Unknown parent • • •My semi-ridiculous idea: ship a modified and restricted browser (perhaps a LibreWolf fork), preconfigured to capture a corresponding HTTP Archive and filtered packet capture, starting after the user logs into their Amazon account, capturing only while they navigate the browser to their Kindle or Audible library (to confirm purchase), before or after visiting the "Login & Security" page (to match the account email address). Then automatically log the user out of that session (to invalidate the captured session token) when they click "Save."
The network traffic should be indistinguishable from a customer browsing their own account. Having the human drive the browser, based on a checklist of links, would be the easiest way to have the timing look human.
The captured corresponding plaintext and TLS traffic would provide a digital signature, courtesy Amazon's web servers, authenticating the contents of the customer's library and the email address associated with the customer's account. That solves the forgery problem.
I imagine the ToS now or later could prohibit capturing one's one network traffic, but I don't imagine a means by which Amazon could detect packet capturing to enforce that.
David
Unknown parent • • •My semi-ridiculous idea: ship a modified and restricted browser (perhaps a LibreWolf fork), preconfigured to record a corresponding filtered packet capture and the TLS session key, starting after the user logs into their Amazon account, capturing only while they navigate the browser to their Kindle or Audible library (to confirm purchase), before or after visiting the "Login & Security" page (to match the account email address). Then automatically log the user out of that session (to invalidate the captured session token) when they click "Save."
The network traffic should be indistinguishable from a customer browsing their own account. Having the human drive the browser, based on a checklist of links, would be the easiest way to have the timing look human.
The captured corresponding TLS traffic and session key would provide a digital signature, courtesy Amazon's web servers, authenticating the contents of the customer's library and the email address associated with the customer's account. That solves the forgery problem.
I imagine the ToS now or later could prohibit capturing one's one network traffic, but I don't imagine a means by which Amazon could detect packet capturing to enforce that.
paulasimoes
in reply to Molly White • • •(AFAIK this new law was never tested in court)
Stefan Monnier
in reply to paulasimoes • • •paulasimoes
in reply to Stefan Monnier • • •@monnier
I'm not sure if I understand your point. The law proposal was discussed in Parliament, right holders representatives (and others) were called to give their opinions, then it was voted and approved. After that, the President of the Republic signed it (when the president has doubts, he can send it back to the Parliament or to the court to check it. He didn't have doubts in this case).
So, the law is applicable.
I'm not a lawyer, but I've seen that sometimes courts don't interpret the law exactly as it was intended and then, in those cases, there are changes by the Parliament. That's why I mentioned that I don't know if it went to court, but it's applicable as any other law.
Let me add that we worked with the definition in the law. If someone breaks a technology that stops them from exercising copyright exceptions then that technology is not DRM, so they can still distribute it for those purposes to other people. Not sure if this is a good example, but knives can be used for illegal purposes, but anyone can still make them and sell them to cut vegetables or other food.
@molly0xfff @pluralistic @ansol
Stefan Monnier
in reply to paulasimoes • • •@paulasimoes @ansol The issue usually is that the DRM laws usually come with far-reaching side-rules, most importantly they make it illegal to reverse-engineer a DRM-lock. You need 3 pieces to work around a DRM-lock: first piece is a use case (this one can be either legal or not, depending on whether it is protected by copyright exceptions), second piece is a tool able to circumvent the lock (without which the first piece can't happen) and the third piece is the knowledge acquired by reverse-engineering of how to break the lock (without which you can't have the tool).
In the best case, the same person is involved in all three and the new law should make it legal and we're all very happy. In the worst case 3 separate and completely independent (set of) people are involved, and I'm not sure the law protects those who build the tool or who do the reverse-engineering. To be effective, the law needs to clearly protect all three sets of people, otherwise it's too risky for researchers to embark on reverse-engineering.
paulasimoes
in reply to Stefan Monnier • • •@monnier @ansol Sorry to get back to this only now. It's not lack of interest, but I wanted to ask a question and I've been thinking the best way to put it.
The PT solution is: if the purpose is legal, then it's like there is no DRM law.
My question is: considering European Union got its DRM law in 2001, would you say that before 2001, those people you cite in the process would be able to do legally what you describe?
Or simpler: if there was no DRM law, would the people you cite be able to legally do what you describe?
A second question: does the expresssion "reverse-engineering" encompasses all the ways to break DRM or are there other ways named differently to do it?
(If others in this thread want to give their input, please do)
Let me explain: the European Commission opened the copyright directive (approved in 2019), so we get some years before it opens it again, but when it does and if cites DRM (in 2019 because of TDM exception), associations like ANSOL and others will be able to ask members of the European Parliament to meke changes proposals. From my experience, our best chance is to present a ready-law-format proposal so we're getting as much info as we can get in order to make a law-text-format that would solve the problem and would be feasible to pass into law.
Stefan Monnier
in reply to paulasimoes • • •paulasimoes
Unknown parent • • •@monnier @ansol thanks for pointing these two options, I'll check the procedures for the first one, but for the second (didn't make the connection or didn't know about #DigitalFairnessAct) it seems there's a public consultation on until 31st August so that could be a first step we can easily do to start with.
I leave the link to the consultation if anyone else needs it:
ec.europa.eu/info/law/better-r…
European Commission - Have your say
European Commission - Have your say