[IP] Re: Apple embeds email address in DRM-free downloads

[David Farber <dave@farber.net>]

Begin forwarded message:

From: Joe Touch <touch@isi.edu>
Date: May 31, 2007 11:06:22 PM EDT
To: dave@farber.net
Subject: Re: [IP] Apple embeds email address in DRM-free downloads

FWIW, email is NOT embedded (ARS Technica never said email was, BTW);
your AppleID and billing name are.

Results of two tests are shown below.

Conclusion: your AppleID is tied to the song; the song won't play
without it.

While you can create a bogus billing name, your AppleID is tied to your
credit card info. Apple won't issue an AppleID without a valid credit  
card.

So, AFAICT, "iTunes Plus" is *not* DRM free. They're managing digital
rights if they force the tag to remain in the song, IMO.

Joe

---------

TEST 2: "Free song of the week", under "iTunes Plus" (DRM free)

I tested:
	- downloading the "free song of the week" (DRM free)

I found:
	- my AppleID
	- my name (as part of my billing address under my account)

I did not find any other information associated with my account, e.g., I
did NOT find:
	- my email address
	- my street, city, state, or zip code
	- my phone number

When I zeroed out the AppleID and name above, the song would no longer
play - iTunes was happy trying, but acted like the file was corrupt, and
played only a half a second or so.

Conclusion: "free song of the week" is not DRM-free

-----------------

TEST 2: "Free song of the week", not under "iTunes Plus" (not DRM free)

I tested:
	- downloading the "free song of the week" (not DRM free)
		NB: there is no indication that this is DRM-free

I found:
	- my AppleID
	- my name (as part of my billing address under my account)

I did not find any other information associated with my account, e.g., I
did NOT find:
	- my email address
	- my street, city, state, or zip code
	- my phone number

When I zeroed out the AppleID and name above, the song would no longer
play - iTunes reported that I needed to authorize my computer to play
songs owned by the blanked-out ID.

Conclusion: the non-DRM "free song of the week" not DRM-free
(to be fair, they never assert that it would be)

----

David Farber wrote:
> Begin forwarded message:
>
> From: "Steven M. Bellovin" <smb@cs.columbia.edu>
> Date: May 30, 2007 5:38:47 PM EDT
> To: dave@farber.net
> Subject: Apple embeds email address in DRM-free downloads
>
> According to Ars Technica, Apple's iTunes site embeds account
> information, including full name and email address, in all purchased
> songs.  This includes the DRM-free songs available starting today.
>
> http://arstechnica.com/news.ars/post/20070530-apple-hides-account- 
> info-in-drm-free-music-too.html
>
>
> (I have not yet independently verified this.)
>
>
>         --Steve Bellovin, http://www.cs.columbia.edu/~smb

--
----------------------------------------
Joe Touch
Sr. Network Engineer, USAF TSAT Space Segment


-------------------------------------------