For Debate: Is Apple Using Steganography In iTunes Plus Songs?

[johnee]

I'm not convinced by MR's investigation. the only thing they are somewhat confident in is that there is no info hidden in the actual data (true steganography). I would still like to see a comparison of the meta data, with valid translation.




Can anyone do that?

 

[Porchland]

I don't understand your argument, and I'm responding to it because it looks like a strawman fallacy.

Why would a person buy a CD to "share" if they can just download the tracks from somewhere?

It's a volume issue. The more the market tips in favor of (hypothetically) watermarked downloaded tracks and away from CDs, the more likely you are to get busted downloading marked tracks.

How do you think all those tracks get "somewhere" ? People rip the discs and put them out on P2P networks. This behavior is rewarded on those networks, for example people who upload more stuff can get better download times.

What he said.

Also, a strawman argument is one set up to fail on purpose, and a fallacy is a mistaken belief; a strawman fallacy -- mistaken belief set up to fail on purpose -- makes no sense.

 

[Maccus Aurelius]

"Fair use" doesn't mention friends and family....

But anyway - if your friend listens to and keeps the song that you bought, rather than buying his own copy - it's the artist that suffers from not being paid for her effort.

The "Zune" model of limited replay is better, and is like the shareware software model. Try it for free, but if you like it, you should pay.

For every mega-star with millions of bucks, there are hundreds of talented people trying to make each month's rent payment....

I donate about $10K per year to a couple of non-profit (and tax deductible) organizations in the Bay Area that support the performing arts, especially music. I buy the CDs at concerts, and feel obligated to ensure that any musician that I enjoy is compensated for her effort.

People who listen to (steal?) the music without paying the artist disgust me....

I think it's a bit of a stretch to think that people who listen to music provided by a friend or family member is some artist killing parasite. There are people far worse off than the starving artists, and while I won't steal their content, my heart is not so ready to bleed for them, since they're still generally doing pretty well for themselves. I'm willing to bet that the ones that are struggling the most are not actually suffering from piracy or CD sharing.

To quote the Chihuahua from Disney's "Oliver & Company": "If this is torture, chain me to the wall."

 

[oogje]

I'm not convinced by MR's investigation. the only thing they are somewhat confident in is that there is no info hidden in the actual data (true steganography). I would still like to see a comparison of the meta data, with valid translation.

Can anyone do that?

See post #169 this thread and let me know if there's other information you're looking for.

brian

 

[Digital Skunk]

Totally Agree

I think it's a bit of a stretch to think that people who listen to music provided by a friend or family member is some artist killing parasite. There are people far worse off than the starving artists, and while I won't steal their content, my heart is not so ready to bleed for them, since they're still generally doing pretty well for themselves. I'm willing to bet that the ones that are struggling the most are not actually suffering from piracy or CD sharing.

To quote the Chihuahua from Disney's "Oliver & Company": "If this is torture, chain me to the wall."

An old friend of mine let me listen to her Evanescense CD for a few days. Loved it! When she took it back I went out and bought the CD myself and got a bonus track that she didn't have. Artists whine a bit too much about pirating music, when it came to CDs (that were way too freaking expensive in the first place) I would either copy it then give it back to my friend, or buckle down and buy the album myself.

With digital tracks and albums, it is still the same way. If I hear a song on a friends iPod or computer, I will either copy the tracks to my thumb drive, or download the album. If I copy the songs and really like the band, then I am more likely to buy their next albums.

 

[clevin]

If its there, I don't see the problem with it. The point of DRM free music is so that you can use it wherever, however you want... not to share it, right?

yes, but doesn't mean u need to report to apple

 

[Maccus Aurelius]

An old friend of mine let me listen to her Evanescense CD for a few days. Loved it! When she took it back I went out and bought the CD myself and got a bonus track that she didn't have. Artists whine a bit too much about pirating music, when it came to CDs (that were way too freaking expensive in the first place) I would either copy it then give it back to my friend, or buckle down and buy the album myself.

With digital tracks and albums, it is still the same way. If I hear a song on a friends iPod or computer, I will either copy the tracks to my thumb drive, or download the album. If I copy the songs and really like the band, then I am more likely to buy their next albums.

I did the exact same thing. A friend of mine let me borrow her radiohead Pablo Honey CD a while back. I ripped it into my library, then I went out and purchased The Bends, Amnesiac, OK Computer, and Kid A. I think the artists can actually afford friends swapping their stuff with each other.

 

[archurban]

what's matter about it? before DRM-free music, it's already embeded protected AAC in itunes store. what will you try to upload DRM-Free music into bittorrent or something? people misunderstand its concept. DRM-free doesn't mean copy free.

 

[Swift]

Probably okay, if--

Amazing how paranoid people are, and how willing to believe the worst.

Two things. Without the id in protected files, there would have been no easy upgrade to iTunes +, right? If I have a track I pullled from a CD. It doesn't have my name. The .30 upgrade is not offered, and fairly so.

Quick, somebody, copy an iTunes+ file to a friend. If he can play it in his iTunes, then the ID doesn't hurt it that way, but maybe in future upgrades, or features like the lyrics being included. Could happen, right? Why shouldn't Apple add the lyrics to your purchased files, but not to the CD rips or those with another ID? Just askin'.

Then, change the name and appleID strings. See if the file refuses to play then. My thought is, it won't. You may need to know grep and and all that before somebody hacks together a name & ID changer.

If the change of user name and apple ID makes the file unplayable, boo. But it won't. And if it can be changed easily, it's not a tag to ID your contributions to Pirate Bay, and it couldn't be used for the RIAA to fine you. Easily spoofed, right?

 

[MikeTheC]

I disagree. Any time Apple drags the music industry kicking and screaming in a better direction, Apple deserves our outrage and fury for not dragging them further

As for Apple saying "prove it's stolen"... two things: a) Apple won't care, it's the RIAA, and b) You are innocent until proven guilty, not the other way around.

Interesting scenarios though I would prefer if Apple stated something in their fine print (which makes a better deterrent anyway) but I can think of a million things I care about a lot more, like getting more labels on board with iTunes Plus.

Well, the biggest issue I have with that particular comment is that when it comes to the RIAA, MPAA and now in the era of the DMCA (Hmm... each of these acronyms end in "a". I think it may be a Canadian conspiracy) it would seem frequently you're considered a potential criminal before the fact, after the fact you're considered guilty by default, and then you have to fight to prove your own innocence.

Regarding iTMS and Steve Jobs, at least Apple's trying to push the industry in the right direction. However, I hate that industry more than you can know, and more than words can express. And especially after the whole rootkit CD debacle with Sony (to simply site a case in point) I will never buy another CD of ANY artist when it comes from Sony. Apple may well one day join that list, especially if this scenario eventuates badly.

As The Doctor says, "Time will tell. It always does."

 

[bmb012]

Sorry about that, I have no problem with the people here who actually have a valid concern, I was only mocking the 'that makes files harder to share, Apple FTL!' comments.

I think it all depends on how much information is stored on these files. Only your username? What can an identity thief do with that? Also, if Apple really is encoding user names in these, they should tell the customers, that way if someone loses an iPod, they can treat it like losing a wallet and report the account being on the loose.

 

[MacAnkka]

Meh.. As long as they understand that copying music for family members/close friends is considered fair use in some countries and therefore won't do anything that would harm them, I'm not that much concerned about this.

 

[sirdir]

By the way, thanks god there are still plenty of countries where it is perfectly legal to copy a CD to a family member or even a close friend…

[EDIT]: Oops, MacAnkka was quicker

 

[miniConvert]

For the record, I believe Apple absolutely should write purchaser information into iTunes songs in a hidden and unremovable way. Preferably data that could only be used by Apple to identify the owner, rather than actual personal details, but whatever.

DRM-Free music has to be about the owner being able to use it however they see fit. It absolutely must not assist illegal sharing or copying.

Buy a song, own a song. Share a song illegally, get caught.

 

[Wonder Boy]

I'm ditching buying CD's now when there is iTunes Plus versions of songs. Why drive to the music store and pick up a CD when I can get the album on iTunes for the same (or cheaper) price?

social interaction.

 

[JeffDM]

Sorry about that, I have no problem with the people here who actually have a valid concern, I was only mocking the 'that makes files harder to share, Apple FTL!' comments.

Who said that?

I think it all depends on how much information is stored on these files. Only your username? What can an identity thief do with that? Also, if Apple really is encoding user names in these, they should tell the customers, that way if someone loses an iPod, they can treat it like losing a wallet and report the account being on the loose.

None of my concerns are around identity theft - that part doesn't make sense because of the reasons you state and others. I am more concerned about what happens if the RIAA gets tracks that weren't shared by the original owner. but someone sharing files from a lost or stolen iPod.

Nagromme's point of innocent until proven guilty isn't a very good point because that is for criminal law, civil suits don't have a very strong requirement like that. The RIAA can try to bleed you dry in a civil court to make an example of you, even if you've done nothing wrong, they have tried this several times before.

 

[johnee]

See post #169 this thread and let me know if there's other information you're looking for.

brian

cool. Here is post #169 :

Yes, that's because the information is in the meta-data of the file, not the audio stream. That is not steganography as the info is not obscured or hidden. It's clear text located in the header along with the title, artist, etc.

$ strings 14\ Ber-Bop-a-Lula.m4a > ber.strings
$ strings 14\ Bub-Bop-a-Lula.m4a > bub.strings
$ diff *.strings
...
< name<ber's name here>
---
> name<bub's name here>
...
83c82
< <ber's store name here>
---
> <bub's store name here>
105c104
< 2007-06-02 03:09:28
---
> 2007-06-02 03:03:51

was this a comparison of the orig $1.29 files which were not converted?

What is the EXACT meta data for each one, and where are they different?

the strings command looks for printable strings (ascii characters i'm guessing?)

 

[crackpip]

None of my concerns are around identity theft - that part doesn't make sense because of the reasons you state and others. I am more concerned about what happens if the RIAA gets tracks that weren't shared by the original owner. but someone sharing files from a lost or stolen iPod.

Nagromme's point of innocent until proven guilty isn't a very good point because that is for criminal law, civil suits don't have a very strong requirement like that. The RIAA can try to bleed you dry in a civil court to make an example of you, even if you've done nothing wrong, they have tried this several times before.

I think that this becomes the major piece of why Apple should disclose watermarking if it decides to use it. How much liability are you taking on by buying watermarked tracks? With lost/stolen iPods and hacked computers, certainly the amount of music stolen from people will go up as more and more people increase their digital music collections.

Tracking via watermarks creates this new issue since previously the non-DRM'd tracks couldn't be traced back to the original owners, and Apple assumes liability for cracked DRM associated with shared DRM'd files.

As JeffDM stated, in the US civil court, the bar is much lower. There isn't the doctrine of reasonable doubt. With the watermarks, defendents will find themselves in the unenviable postion of guilty until proven innocent. The question to ask yourselves is if some of your tracks get unintentionally leaked out onto the net, do you have the thousands of dollars laying around to defend yourself against an RIAA suit, or would you just say you were guilty and settle for the tune of $3000, assuming the RIAA doesn't increase their settlement fee?

crackpip

 

[oogje]

was this a comparison of the orig $1.29 files which were not converted?

yes

What is the EXACT meta data for each one, and where are they different?

The data is the "Purchased Date", "Purchased by" and "Account Name" as you would see in Get Info from iTunes - I don't want to provide that all here. They are different like "John Doe" and "Joe Public". Similarly the Account Names are like "user13@mac.com" and "grouchy".

the strings command looks for printable strings (ascii characters i'm guessing?)

Correct. And I replaced some non-text data that was also different in that area of the file with ellipsis.

 

[strangelogic]

'news' Radio = Call your iPod ''iSpy"

Just heard a news story on WTOP news radio in Washington DC - the areas number one radio station... and that was their teaser -- you can call your iPod - I SPY.

I wish the story was on their web site - it was pretty ridiculous and over-the-top implying that ''Apple is big-brother'' and with the click of a mouse they are tracking your every move... Sounded like they were sourcing the EFF post in the original post here, but i thought they were making it sound like Apple is going to sell your first born.

btw - your iPod gets stolen, and you are worried about RIAA coming after you (assuming that the thief has the brains - or will - to steal and re-distribute your music - when odds are they just want a new iPod, or they want to sell an iPod) - file a police report, and while you are at it - contact apple itunes support.

 

[crackpip]

btw - your iPod gets stolen, and you are worried about RIAA coming after you (assuming that the thief has the brains - or will - to steal and re-distribute your music - when odds are they just want a new iPod, or they want to sell an iPod) - file a police report, and while you are at it - contact apple itunes support.

This helps to alleviate some of your liability for the one case, but it doesn't mean that you are in the clear. This is civil court where plenty of ridiculous lawsuits have been upheld. Even with a filed police report, the deep-pocketed, not-very-reasonable RIAA will lean on you to settle with them. You may still have to go to court to defend yourself, and risk losing even if you hire a lawyer for the additional expense.

crackpip

P.S. It doesn't take much in the way of either brains or will to distribute stolen music.

 

[lemikam]

The only reason it's ticking me off is that it's mucking up my ability to organize my music!

There's definitely some information locked into these songs permanently (so permanently that it survives conversions, library data wipes, even burning onto cds and re-importing), and I have no beef with Apple and music makers having some way of keeping tabs to make sure I don't do anything illegal...

But why on earth is iTunes reading this data and letting it affect how it works?! I thought the whole point of this steganography mess is that you're not supposed to know it's there! Something isn't letting me change the single of the week's album name in any real way (I posted what happened to me a little ways back - I think it's on page 7).

If Apple's gonna put this stuff there, that's fine. Just make it so that I never have to deal with it. As soon as it becomes an inconvenience (which it already has) it becomes un Apple-like and deserves to be complained about.

 

[Swift]

Some people just don't get it.

Why should we now have to put up with companies surreptitiously tagging legally purchased digital tracks with personally identifiable information?

This is without doubt a sea change in the way business is conducted.

We must draw the line here. Our right to privacy is worth much, much more than the right of some greedy, nosy company to check and see if we have somehow "misused" our property. And a music track IS our property - we paid a dear price for it.

----

However as I and others stated earlier, there is not yet any proof or evidence that Apple IS placing personally identifiable information on iTunes tracks.

Every bit of data sent on the Internet has individual identification built into it. It's the nature of packet networks. You can fake things, but the IP address is not easily fakable.

To sell a track, DRM or not, requires ID. What iTunes plus does is keep the same structure as before, with the user ID and the name of the purchaser not used as the basis of a hash, which recognizes accounts and the computers it's authorized on, but it drops the hash.

If you just copy a track to give to a friend, I doubt that it makes any difference. You might not get upgrade offers, maybe. If you didn't pay for the original track, why should you get the offer of a .30 upgrade, for instance?

I really doubt that there is any permanent mark in the files. I think joe@mac.com allows you to copy a file to bill@mac.com, it will still play as before. It won't have various services though.

If you put your iTunes plus music on Pirate Bay, and you're too stupid to change the ID first, then you deserve everything you get. Just because DRM is gone at EMI/Apple doesn't mean that p2p is any more legal than before.

 

[bmb012]

I think that this becomes the major piece of why Apple should disclose watermarking if it decides to use it. How much liability are you taking on by buying watermarked tracks? With lost/stolen iPods and hacked computers, certainly the amount of music stolen from people will go up as more and more people increase their digital music collections.

Tracking via watermarks creates this new issue since previously the non-DRM'd tracks couldn't be traced back to the original owners, and Apple assumes liability for cracked DRM associated with shared DRM'd files.

As JeffDM stated, in the US civil court, the bar is much lower. There isn't the doctrine of reasonable doubt. With the watermarks, defendents will find themselves in the unenviable postion of guilty until proven innocent. The question to ask yourselves is if some of your tracks get unintentionally leaked out onto the net, do you have the thousands of dollars laying around to defend yourself against an RIAA suit, or would you just say you were guilty and settle for the tune of $3000, assuming the RIAA doesn't increase their settlement fee?

crackpip

Like I said, if there is data in the tracks, Apple should let you know the gravity of what is in these tracks then, so if you lose an iPod, Apple can shut down your account and give you a new one, sort of like loosing a credit card.

Is the RIAA that strict though? Didn't someone win a case by saying it was someone else on his open wireless networks sharing music and not him?

 

[Doctor Q]

Which excuses will we hear after people share DRM-free iTunes over the net?

"Somebody stole my music/computer and posted it on the Internet."

"My friend/parent/child/sibling did it, not me."

"I posted it by accident."

"I thought I was allowed to share it since it's DRM-free."

"I thought I was allowed to share it since it was a free single of the week."

"I did it while I was drunk/hypnotized/possessed."

"I had a printout of the license terms but my dog ate it."​