For Debate: Is Apple Using Steganography In iTunes Plus Songs?

[MacRumors]

Following the discovery that Apple was embedding iTunes account information in iTunes Plus songs, Erica Sadun at O'Reilly speculates that Apple may be using Steganography within the AAC portion of iTunes Plus tracks.

The conclusion came after purchasing the same iTunes Plus song from the iTunes Store using two accounts. After having stripped the files of their meta data (where iTunes would store account information, and any extraneous information), she compared the files and found 774 bytes (out of 6.7 MB) were different in the AAC data itself. Her conclusion: "Clearly some sort of fingerprinting/steganography is going on in the data itself."

The EFF has apparently also begun investigating the issue, although they do not indicate how far they will pursue the issue.

Most forum users appear to not be dissuaded by the revelations, and appear to accepting the move as a compromise allowing music companies to have some recourse against those who illegally share music, but opening the DRM restrictions for legitimate users.

Of note, Apple does not indicate that it uses such technology in its iTunes Terms of Service.

Steganography (from Wikipedia): "the art and science of writing hidden messages in such a way that no one apart from the intended recipient knows of the existence of the message." Different from cryptography in that the existence of the message itself is not disguised, but the content is obscured.

[BrianMR]

If its there, I don't see the problem with it. The point of DRM free music is so that you can use it wherever, however you want... not to share it, right?

[FleurDuMal]

I learnt a new word!

[longofest]

Originally Posted by BrianMR

If its there, I don't see the problem with it. The point of DRM free music is so that you can use it wherever, however you want... not to share it, right?

Correct.

However, if Apple is using the technique and not notifying users in its terms of service, they could be opening themselves up to lawsuits.

[nxent]

interesting... and this affects us how?

[Mydel]

I dont see the problem but Apple schuld inform us about it. That would be fair. I dont like root kits and all this kind of stuff...

[zap2]

I don't really care....still feels like we're getting cheated. I was never told about it(not that I care personal)


If you can use it however you want, who cares if your user name is in it? Unless your breaking the law

[mrkramer]

Originally Posted by nxent

interesting... and this affects us how?

it doesn't unless you are sharing you DRM free iTunes songs.

[JonHimself]

I think I'm with what people have already said here. I dont' care if my name is all over the files I download because I have no intention of sharing them. The issue is just that it appears that Apple wasn't notifying anyone of this.

[Fleetwood Mac]

This was all over the local news. Whatever..

[~Shard~]

Steganography is a very cool technology. I worked with it on a project when I was performing Top Secret military contract work for the Pentagon, NSA and CIA 7 years ago. Very cool, powerful stuff. I can only imagine how it's improved and advanced over the past several years.

As for Apple implementing it, it doesn't really bother me - they wouldn't be stupid enough to use it for evil - at least I should hope!

[mkrishnan]

I don't see that there's any impropriety in the action, even if Apple was mum about it. I'd give it some more thought, but at the moment, it doesn't seem problematic to me.

[LimeiBook86]

I don't think it's the best thing for Apple to not mention what they are doing but, of course you can always still burn your songs to an Audio CD and rip them back, sure it uses a disc, and you have to re-import it. But there will always be a way to strip it of it's new meta data.

Although I don't think it really matters, unless these files end up on a P2P network, then who knows. Say if John Doe's music files are on an illegal P2P service, somebody may download it. If Apple finds out about this, well I don't think they'd really do anything, I don't see how they could find out about it other than somebody reporting it.

I don't think they'd go as far as disabling the person's account. But who knows, maybe it's just a way to discourage file sharing. But, we've seen that people will always share their tunes with their friends and family, so I don't think this will really put a stop to that, but I don't think that's why Apple did this anyway, maybe they just wanted to simply tag it.

[Nugget]

I don't see the big deal at all. iTunes Music Store users are already aware that the files they download contain their Apple ID in them. It's apparent simply by looking at the file info inside iTunes.

The fact that your information is stored in two different ways -- both in the header as well as embedded within the song data -- is just an implementation detail. The expectation is that the downloaded tracks will be branded with your information.

[wakerider017]

I just don't get all this DRM BS and other copy protection (And in this case all your account info encrypted in the music) when they have unprotected CD's at your local music store...

In 2007 is someone really that much more likely to share music they got from iTunes vs buying a CD?

This is ridiculous and this is why I will never buy a single song from iTunes...
All of my purchases are in the from of actual physical CD's...

[HiRez]

Originally Posted by Mydel

I dont see the problem but Apple schuld inform us about it. That would be fair. I dont like root kits and all this kind of stuff...

I agree with this, I have no problem with them doing that because I'm not handing out my music files anyway, but if it's true they should just be straight about it and disclose it.

For me, I just didn't like the hassle of DRM because of the need to authorize/deauthorize devices, restrictions on the number of devices, and on burning playlists. Relating to this, it'd be nice if they allowed you to redownload tracks in case you lose them (at least once). I know I know, back up, but bad things happen to good people.

[longofest]

Originally Posted by LimeiBook86

I don't think it's the best thing for Apple to not mention what they are doing but, of course you can always still burn your songs to an Audio CD and rip them back, sure it uses a disc, and you have to re-import it. But there will always be a way to strip it of it's new meta data.

You bring up a good point. Erica points out that transcoding the two files to AIFF produces identical files, so it does look like you can remove the fingerprints that way (just a much larger file).

[joeconvert]

Originally Posted by longofest

Correct.

However, if Apple is using the technique and not notifying users in its terms of service, they could be opening themselves up to lawsuits.

How so? Lawsuits, possibly, but lawsuits with merit... No.

[kavika411]

[Yawning] I must have fallen asleep. Last thing I remember is someone talking about whether Apple would put invisible, digital fingerprints on songs. I guess that is where I grew so bored that I fell asleep.

[morespce54]

Originally Posted by longofest

Correct.

However, if Apple is using the technique and not notifying users in its terms of service, they could be opening themselves up to lawsuits.

my point too... I don't really care but if they do use this technique, I want to know it. Now, will they make itunes phone home with this info or not, that's another good question. I don't want to share my iT+ but still I want to know exactly what I'm getting into from the start.

[WestonHarvey1]

Originally Posted by wakerider017

I just don't get all this DRM BS and other copy protection (And in this case all your account info encrypted in the music) when they have unprotected CD's at your local music store...

In 2007 is someone really that much more likely to share music they got from iTunes vs buying a CD?

This is ridiculous and this is why I will never buy a single song from iTunes...
All of my purchases are in the from of actual physical CD's...

Enjoy missing out on the internet music revolution then.

No matter how hard I try, I just can't get outraged by this. Should I feel guilty?

[oldwatery]

Originally Posted by wakerider017

I just don't get all this DRM BS and other copy protection (And in this case all your account info encrypted in the music) when they have unprotected CD's at your local music store...

In 2007 is someone really that much more likely to share music they got from iTunes vs buying a CD?

This is ridiculous and this is why I will never buy a single song from iTunes...
All of my purchases are in the from of actual physical CD's...

I'm with you.
Together with the lousy bit rate this is the reason I have never and will never purchase my music from the iTunes store.
The quality of CD reproduction has increased so much in the past few years that buying crippled and encrypted music sems like a really backward step...at least to this rampant audiophile

[Marky_Mark]

BBC News Website now has this as the top story on its Technology section:

http://news.bbc.co.uk/1/hi/technology/6711215.stm

[iMikeT]

If those who wish to do illegal deeds are going to be held accountable and this is the only way to do it, why not?

[chrisgeleven]

Doesn't matter to me one bit. I don't intend to share my songs.

I'm ditching buying CD's now when there is iTunes Plus versions of songs. Why drive to the music store and pick up a CD when I can get the album on iTunes for the same (or cheaper) price?

As for quality, unless you are one of the lucky few that has golden ears AND the proper equipment AND in an environment with no background noise can tell the difference between a 256kbps AAC file and the original cd (numerous blind listening tests at hydrogenaudio.org have proven this).

Since I always rip a cd and then store the cd away never to be touched again (I don't even remember the last time I listened to a physical CD playing), why not just skip that step?