iTunes 4.5 Authentication Cracked

fooishbar writes "Yesterday, Apple released iTunes 4.5, which deliberately broke the 4.2 authentication scheme, which had been successfully reverse-engineered. However, crazney has been at it again, and within 24 hours of downloading iTunes 4.5, has broken the new scheme, and added more features to this library along the way. If you want to incorporate iTMS support in your program, give libopendaap a go!" Reader ScottGant submits this story about the Pepsi/iTunes promotion: "News.com has this story about Pepsi's iTunes promotion give-away. The promotion, which is slated to end this Friday, was to have given away 100 million tracks through Apple's iTunes music site. But according to Apple on Wednesday, only about 5 million free songs have been redeemed."

Only five million?

That's way less than they anticipated. Only 5 million out of 100 knocked me flat. Since iTunes serves a pretty specific market, I guess that says a lot. Especially since the tracks are free. The question on my mind: how many of those 100 million winners actually reached folks? TFA mentioned something about distribution problems.

Also, about the new authentication crack: I am curious how this will impact their deal to offer free weekly songs, I'm assuming it's some sort of deal with the record industry. Today is a fairly uninspiring Avril Lavigne track (but free! I got it anyway! :P), but I have to wonder.

Re:Only five million?

According to a lot of posts on Macrumors.com and other Mac news sites there were a lot of posts from people in the *huge* markets like New York, LA, San Fran, etc who were posting that they never found a bottle with the promotion on it.

Personally in Raleigh, NC I never saw a 'iTunes' bottle but then again I don't drink a lot of soft drinks anyway.

Re:Only five million?

I hardly drink pepsi in the bottle, just the cans from the vending machine. The couple times I did buy bottles, the 24 ounce bottles where winners, the smaller bottles never won.

Bad thing, I never remembered to keep the bottle, I tossed it like normal. Dont know how many other people don't know, or don't care.

Re:Only five million?

Other than the moral part, there's no advantage in using itunes over anything else

iTMS is a music store. iTunes is a kick-ass audio player/organizer. It is second to none, imho. No winamp user I know who tried iTunes ever went back.

Some shortcomings, but the DB makes up for them

iTunes on Windows is slow

I believe that it was a poor design choice on Apple's part, but iTunes performance degrades quickly in the presence of shoddy video drivers. This may have been your problem. Also, if you disable SoundCheck (or just let it finish running) performance improves dramatically. SoundCheck determines the volumes of your music files and has iTunes compensate for bad rips, etc.

iTunes on Windows is slow

FairPlay is the DRM system used on files from the iTMS. iTunes could care less what you do with any of your files that were acquired elsewhere. It will even let you stream audio across your network with almost zero setup.

Winamp 2.95 is fast, convenient, and smart.

It sure is better than the 3.x version, but it has zero library management functions. It takes no time to search for a song in my library in iTunes. If I want to hear a song, I can begin to type any part of its name or its artist's name or even the album name and the song list updates live with each keystroke. It often takes just one or two characters to bring the song you want into the window. That is the one feature that sets iTunes apart from Winamp for me. I really liked Winamp and Macamp but I hated trying to find a particular song. I had to use filesystem searches, but that's not good enough.

You might want to take a second look at iTunes after you update your video drivers. Since you want it to be light weight, turn off all of the music store and sound enhancement features (turn off SoundCheck!). Then you will have an awesome music library management program. I think that if you have a significant music library that you will appreciate the search feature so much that it will eclipse iTunes other shortcomings.

Re:Only five million?

In the St. Louis area, the local Pepsi bottler ran a promo giving away free Blues tickets instead of the iTunes promo. Right about the same time as the Blues fired their head coach during a massive slump, which they pulled out of in time to reach the playoffs and be eliminated in the first round. Pepsi sure knows how to market their product...

I'll stick with Coke, thanks.

Re:Only five million?

I was activly searching my town (east la county), neighboring ones (san bernadino county) and even a few stores in Santa Barbara california. It took about 3-4 weeks before the damn LAKERS caps went away so I could buy iTunes caps. Won about 6 or 7 songs in 10 bottles.

Distribution sucked majorly.

Re:Only five million?

TFA mentioned something about distribution problems.

In the area I'm in (Downtown Long Beach, Ca), the iTunes bottles didn't reach most stores until the end of February. All of the stores were carrying Lakers promotional bottles instead.

Once the iTunes bottles started showing up, I won a few songs. When I went to redeem them, iTunes didn't have any of the specific songs that I wanted. They didn't have any Led Zeppelin songs, so I went looking for some songs off of a CD that my wife wants. They didn't have that either, so my caps didn't get turned in.

Pepsi F*CKED the distribution

End of February? You were lucky -- I was working in Anaheim since January 2004, and we didn't see any yellow iTunes caps until the third week of March, which was right before the promotion ended.

I'm still getting yellow caps now; it's a good thing Apple is still letting me redeem them (at least through tomorrow), because I've already cashed in 7 or 8, and could reap a few more between now and the end of work tomorrow.

Wasted Caps

When I went to redeem them, iTunes didn't have any of the specific songs that I wanted. They didn't have any Led Zeppelin songs, so I went looking for some songs off of a CD that my wife wants. They didn't have that either, so my caps didn't get turned in.

Ok, now that's just plain silly. These are FREE songs we're talking about. So they didn't have a specific tune you wanted. What was keeping you from downloading a track from someone you never heard of? (The previews are there for a reason.)

You could have discovered something new that you really liked, without any risk of wasting money. Be a little more adventurous...

Re:Only five million?

Especially since the tracks are free

I only got about five free songs...See, I have this odd aversion to developing type 2 diabetes that limits the amount of sugarwater I want to drink.

Re:Only five million?

I drink Diet Pepsi, so I opted for cancer instead.

Re:Only five million?

Diet Pepsi is not carcinogenic. Saccharine has not been used in either Diet Coke or Diet Pepsi since NutraSweet (a.k.a. "Aspartame") was introduced in the 80s.

There are all kinds of people (a.k.a. "kooks") who are now trying to tell you that Aspartame is bad for you. Funny how they came to that opinion just as NutraSweet's patent on Aspartame ran out, so anybody can produce a generic form of it cheaply.

I'm convinced that all this hand-wringing about Aspartame is driven by a desire to sell you on new sweeteners, like Splenda. Every time I "follow the money" on somebody issuing warnings about the Aspartame in Diet Coke, I discover somebody who's competing with it.

(Splenda and Sorbitol, by the way, often contain warning that "large quantities my cause mild diarrhea," by which they mean "even a few drops of this stuff will make you explosively burst out liquid faster than a fire hose within the hour, making severe dysentery seem healthy by comparison.")

Re:Only five million?

And like they say: If you can't give cancer to a white lab rat, you're just not trying.

Re:Only five million?

No it's not.

Fat consumption has nothing whatsoever to do with diabetes. You could eat bacon 3 meals a day and not have high glucose levels. (Your blood pressure and cholesterol levels might not be so terrific...)

Type 2 diabetes is one of two things: 1. You are not producing insulin fast enough to process large amounts of glucose in the blood.
Or 2. Your body is not absorbing the insulin fast enough to do so.

In either case, when you eat foods that are quickly turned to sugar in the blood (any foods which are high in starch or sugar, including white bread and potato products, and especially sugary foods like Pepsi) your blood's glucose level goes way up, because your body can't process it. This causes all kinds of problems. Fatty foods do neccesarilly raise your blood sugar levels. You may be confused because obesity (fat tissue, not fat consumption) slows insulin absorbtion, and is a contribuiting factor to Type 2 diabetes.

Re:Only five million?

What credit card requirement? I don't have a credit card, and I use the service just fine... Gift cards from Target and Pepsi free songs.

Re:Only five million?

I was planning to switch from Coke to Pepsi for the duration of the promotion, but as you say it's not cost-effective for heavy drinkers such as myself to buy individual bottles.

I did buy a few and I won all but one of them. I really liked the promotion and I'm sorry it's (nearly) over. There are still caps in the stores, so I think they should have extended the redemption period.

Since I wasn't able to tilt the bottle and see which bottles were winners, I thought it was interesting that I won most of them. I live in LA, and we've only had the bottles for a couple of weeks now. Perhaps they had to use up the winning caps and so a higher percentage of people here were winners.

I think they should have stuck in maybe 3 codes for each 12-pack. That would have given the heavy drinkers a chance to win. The contest as it is seems designed for light drinkers, and that's just plain silly. Why not cater to your huge customers and hope to snag a few from Coke?

(I'm afraid that I like Diet Coke in cans quite a bit more than Diet Pepsi in bottles, so from a conversion perspective this was a flop).

D

I personally got about 30 free songs

My wife and I would go out of our way to get the Pepsies with the promotion. We won quite a few times.

It wasn't a bad promotion, but many times we had to go out of our way to even find the Pepsies with the offer. They were hard to find.

Re:Only five million?

That's way less than they anticipated. Only 5 million out of 100 knocked me flat.

100 miliion is the maximum possible number of redemptions; that's the number of winning labels they printed. You'd have to expect every single winning label to be redeemed to reach that number.

Apple expected of the 100 million winning labels, about 30% would ultimately be redeemed, or 30 million. 5 million compared to that isn't good, but it's better than compared to 100 million. I blame Pepsi's rather lackluster promotion efforts in part (a brief, off-handed mention in a commercial that ran once during the superbowl).

Re:Only five million?

Agreed - like any rebate program, the redemption rates are usually quite low. And those are redemptions on 10,20 or 30 dollar rebates - the return is much more substantial than the effort invested. Though the return from this promotion is high relative to the product cost, they might have had a much higher redemption rate if they were giving away something with a higher perceived value and giving it away less frequently than 1 in 3. Though it's nice to get a 99 cent free item with a 1.29 bottle purchase, there's still the cost of remembering to hold onto the bottle cap, signing up for the service and so on to redeem it - realistically, the costs of this effort may be valued by many people at pretty close to the dollar value of the item itself.

Then, as you pointed out quite accurately, there's the system requirements, bandwidth requirements, computer-experience and application installation experience requirements, and the need to be interested in music (many people don't listen to much music, or are just interested enough to listen to what's on the radio). Frankly, I think a 5% redemption rate should be viewed as a rather decent success of this product. If they thought honestly that they'd get a 30% redemption rate, they were kidding themselves. Personally, I think I would have guessed more like 10% based on my sense of the market.

I also think the promotion would have been much more successful if it targetted regular Pepsi drinkers who drink from cans. The return from cashing in these free songs is much higher if you've collected 10-15 free songs, and I'd say the likelihood of that person getting the songs and going through the effort is much higher than the likelihood of somebody else.

I'll us myself as an example (though I'm a bad one in most ways). I am not a regular Pepsi drinker - I drink Pepsi usually only when there are no other options (i.e. no Diet Coke around). I won an iTunes cap while on the road driving from Boston to New York at a rest stop in Connecticut where they only sold bottles, and only sold Diet Pepsi. I have used iTunes and purchased probably 15 dollars worth of songs from iTunes in the past. I thought it was very cool and great that I had a bottle cap worth a dollar, and I put the bottle somewhere meaning to keep and redeem the free song. Nonetheless, I didn't really give it enough thought to be terribly careful with that bottle, and ended up throwing it out by accident when cleaning my car after the drive. Had I gotten that bottle cap upstairs and dropped it by my computer, I probably would have redeemed it at some point. So even among people interested enough, competent enough, and so on who happen to get a winning bottle cap, the redemption rate is likely to be at best maybe 50%? And that's a pretty small fraction of the population

This is annoying.

The idea that Apple is "breaking" or "crippling" this part of iTunes is misleading. It wasn't a feature that Apple provided to begin with, and any hacks to break the DRM scheme will be thwarted by Apple eventually.

If you don't like this, you shouldn't use iTunes at all and don't buy their music because this is something they need to sell music online. Last I checked, you can just buy the CD at the store that contains no DRM at all.

Re:This is annoying.

First Sale Doctorine. You can do what you want with things you purchase.

Re:This is annoying.

You did not purchase the song. Read the agreement. You purchase the right to listen to the song subject to the conditions outlined in the agreement. If the agreement is not to your liking, do not purchase the song.

Re:This is annoying.

You did not purchase the song. Read the agreement. You purchase the right to listen to the song subject to the conditions outlined in the agreement.

I have two words for you: bull, and shit.

I don't care what their agreement says. Nobody has to "purchase rights" to "listen" to a song. If I want to listen to a song that's playing out on the street as I happen to be walking along, nobody has any right to charge me for the privilege. Conversely, nobody is allowed to sign away their rights under the law. If I sign an agreement saying "I hereby grant you the right to kill me by strangulation" that still doesn't give you the right to kill me and it doesn't give me the right to commit suicide either (which is illegal in most states).

Copyright law is pretty clear and the first sale doctrine well established. If I buy a song from iTunes, it's mine and I can do what I want with it provided I don't do anything to violate copyright law. That includes stripping the DRM to exercise my rights as expressly provided in copyright law (don't forget, fair use is not some nebulous concept someone came up with on Slashdot, it is part of the actual law).

Now, you can try to quote various things from the DMCA if you want, but that won't win you many friends around here. And I don't interpret the DMCA as overriding fair use rights anyway, and neither does anyone else I know of.

Re:This is annoying.

But you knew going in that iTunes only runs under MacOS and Windows. You knew that when you agreed to the EULA. You agreed to their conditions when you signed up.

You are under obligation to abide by the terms of the agreement you entered with Apple. Apple is under no obligation to support every OS out there.

If you don't like the conditions Apple places in iTunes Music Store, including the limited number of supported platforms, don't use the service.

Re:This is annoying.

People seem to be conflating two unrelated things. iTunes can stream music from its library to other clients on the network. This is entirely independent from iTMS, the music streamed by DAAP can easily be music you ripped yourself.

So really this has nothing to do with hurting Apple, or not agreeing to a "EULA", and it has everything to do with Apple cynically attempting to manipulate network effects. Your brother sharing his CD collection on the home network using iTunes? You can't use WinAmp, WMP, RhythmBox, Muine or whatever to access that, you have to use iTunes too. Then when you share your music, it cascades onwards.

This is especially true in places like homes, student flats and college networks, like the ones crazney is on. Really, Apple have no excuse for this: restricting DAAP can only have one goal and that is to use peer-power of the type that keeps Windows entrenched to give iTunes an upper hand. As such it frankly deserves to be cracked.

I know crazney. He's a good guy. We talk often - he isn't out to screw Apple or steal music. He wants to play the music on his Mac laptop using the iTunes streaming system: this seems totally fair to me.

Re:Wrong way round

For better or for worse, DRM is a battle that content providers will lose

No [againsttcpa.com] they [cam.ac.uk] won't [notcpa.org].

Don't be surprised when Apple suddenly becomes one of the biggest supporters of "trusted" computing, and introduces a palladium technology of their own. And all the Mac zealots who were busy telling us before why Apple DRM was good, while Microsoft DRM was bad, will come back to tell us why Mac Palladium is good.

I'm not saying the coders here are doing something wrong because they are pushing Apple in that direction: if we self censor ourselves to appease the DRM monglers, then we are where they wants us anyways. Apple picked sides in this battle, and for all the bullshit their fans are feeding us about "nice" DRM, the side they chose leads only one way. Goodbye user controlled computer. Welcome Palladium controlled user.

Re:This is annoying.

Last I checked, you can just buy the CD at the store that contains no DRM at all.

The problem is that you never know what you are going to get when you buy a CD. Many CDs these days come with DRM that stops you from playing the songs on computers and even some stereos. And you don't know until you try it at which point the stores won't let you return it because it was opened. So given the choice between a useless, ~$15, round, shiny piece of sh... err... plastic or a ~$10 downloaded album that I can burn to a CD, copy to my iPod, or play on 5 different computers, I think the choice is obvious. The phrase "lesser of two evils" comes to mind.

No, it's not misleading

The authentication doesn't just prevent DRM-removal. It also cripples iTunes' ability to connect to non-iTunes music shares.

I have my entire music library--which, incidentally, is 100% legal and paid for--on a Linux server running daapd. iTunes 4.5 broke iTunes so I could no longer pay my legally purchased music on my Macintosh.

Fortunately, the maintainer of daapd worked out the fix about as quickly as the maintainer of libopendaap did, and I've been able to upgrade iTunes after all.

Make no mistake, Apple's screwing around does have a negative impact on their customers, even the ones who haven't infringed copyright.