Slashdot Log In
iTunes 4.5 Authentication Cracked
Posted by
michael
on Thu Apr 29, 2004 11:40 AM
from the powered-by-mountain-dew dept.
from the powered-by-mountain-dew dept.
fooishbar writes "Yesterday, Apple released iTunes 4.5, which deliberately broke the 4.2 authentication scheme, which had been successfully reverse-engineered. However, crazney has been at it again, and within 24 hours of downloading iTunes 4.5, has broken the new scheme, and added more features to this library along the way. If you want to incorporate iTMS support in your program, give libopendaap a go!" Reader ScottGant submits this story about the Pepsi/iTunes promotion: "News.com has this story about Pepsi's iTunes promotion give-away. The promotion,
which is slated to end this Friday, was to have given away 100 million
tracks through Apple's iTunes
music site. But according to Apple on Wednesday, only about 5 million
free songs have been redeemed."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Only five million? (Score:5, Interesting)
Also, about the new authentication crack: I am curious how this will impact their deal to offer free weekly songs, I'm assuming it's some sort of deal with the record industry. Today is a fairly uninspiring Avril Lavigne track (but free! I got it anyway!
Re:Only five million? (Score:5, Interesting)
Personally in Raleigh, NC I never saw a 'iTunes' bottle but then again I don't drink a lot of soft drinks anyway.
Parent
Re:Only five million? (Score:5, Interesting)
Bad thing, I never remembered to keep the bottle, I tossed it like normal. Dont know how many other people don't know, or don't care.
Parent
Re:Only five million? (Score:4, Funny)
I'll stick with Coke, thanks.
Parent
Re:Only five million? (Score:5, Interesting)
In the area I'm in (Downtown Long Beach, Ca), the iTunes bottles didn't reach most stores until the end of February. All of the stores were carrying Lakers promotional bottles instead.
Once the iTunes bottles started showing up, I won a few songs. When I went to redeem them, iTunes didn't have any of the specific songs that I wanted. They didn't have any Led Zeppelin songs, so I went looking for some songs off of a CD that my wife wants. They didn't have that either, so my caps didn't get turned in.
Parent
Pepsi F*CKED the distribution (Score:5, Interesting)
I'm still getting yellow caps now; it's a good thing Apple is still letting me redeem them (at least through tomorrow), because I've already cashed in 7 or 8, and could reap a few more between now and the end of work tomorrow.
Parent
Re:Only five million? (Score:5, Funny)
Parent
Re:Only five million? (Score:5, Funny)
Parent
Re:Only five million? (Score:5, Insightful)
There are all kinds of people (a.k.a. "kooks") who are now trying to tell you that Aspartame is bad for you. Funny how they came to that opinion just as NutraSweet's patent on Aspartame ran out, so anybody can produce a generic form of it cheaply.
I'm convinced that all this hand-wringing about Aspartame is driven by a desire to sell you on new sweeteners, like Splenda. Every time I "follow the money" on somebody issuing warnings about the Aspartame in Diet Coke, I discover somebody who's competing with it.
(Splenda and Sorbitol, by the way, often contain warning that "large quantities my cause mild diarrhea," by which they mean "even a few drops of this stuff will make you explosively burst out liquid faster than a fire hose within the hour, making severe dysentery seem healthy by comparison.")
Parent
I personally got about 30 free songs (Score:4, Interesting)
It wasn't a bad promotion, but many times we had to go out of our way to even find the Pepsies with the offer. They were hard to find.
Parent
Re:Only five million? (Score:4, Insightful)
100 miliion is the maximum possible number of redemptions; that's the number of winning labels they printed. You'd have to expect every single winning label to be redeemed to reach that number.
Apple expected of the 100 million winning labels, about 30% would ultimately be redeemed, or 30 million. 5 million compared to that isn't good, but it's better than compared to 100 million. I blame Pepsi's rather lackluster promotion efforts in part (a brief, off-handed mention in a commercial that ran once during the superbowl).
Parent
Re:Only five million? (Score:5, Interesting)
Then, as you pointed out quite accurately, there's the system requirements, bandwidth requirements, computer-experience and application installation experience requirements, and the need to be interested in music (many people don't listen to much music, or are just interested enough to listen to what's on the radio). Frankly, I think a 5% redemption rate should be viewed as a rather decent success of this product. If they thought honestly that they'd get a 30% redemption rate, they were kidding themselves. Personally, I think I would have guessed more like 10% based on my sense of the market.
I also think the promotion would have been much more successful if it targetted regular Pepsi drinkers who drink from cans. The return from cashing in these free songs is much higher if you've collected 10-15 free songs, and I'd say the likelihood of that person getting the songs and going through the effort is much higher than the likelihood of somebody else.
I'll us myself as an example (though I'm a bad one in most ways). I am not a regular Pepsi drinker - I drink Pepsi usually only when there are no other options (i.e. no Diet Coke around). I won an iTunes cap while on the road driving from Boston to New York at a rest stop in Connecticut where they only sold bottles, and only sold Diet Pepsi. I have used iTunes and purchased probably 15 dollars worth of songs from iTunes in the past. I thought it was very cool and great that I had a bottle cap worth a dollar, and I put the bottle somewhere meaning to keep and redeem the free song. Nonetheless, I didn't really give it enough thought to be terribly careful with that bottle, and ended up throwing it out by accident when cleaning my car after the drive. Had I gotten that bottle cap upstairs and dropped it by my computer, I probably would have redeemed it at some point. So even among people interested enough, competent enough, and so on who happen to get a winning bottle cap, the redemption rate is likely to be at best maybe 50%? And that's a pretty small fraction of the population
Parent
Re:Only five million? (Score:5, Interesting)
I did buy a few and I won all but one of them. I really liked the promotion and I'm sorry it's (nearly) over. There are still caps in the stores, so I think they should have extended the redemption period.
Since I wasn't able to tilt the bottle and see which bottles were winners, I thought it was interesting that I won most of them. I live in LA, and we've only had the bottles for a couple of weeks now. Perhaps they had to use up the winning caps and so a higher percentage of people here were winners.
I think they should have stuck in maybe 3 codes for each 12-pack. That would have given the heavy drinkers a chance to win. The contest as it is seems designed for light drinkers, and that's just plain silly. Why not cater to your huge customers and hope to snag a few from Coke?
(I'm afraid that I like Diet Coke in cans quite a bit more than Diet Pepsi in bottles, so from a conversion perspective this was a flop).
D
Parent
This is annoying. (Score:4, Interesting)
If you don't like this, you shouldn't use iTunes at all and don't buy their music because this is something they need to sell music online. Last I checked, you can just buy the CD at the store that contains no DRM at all.
Re:This is annoying. (Score:5, Insightful)
Parent
Re:This is annoying. (Score:4, Informative)
Parent
Re:This is annoying. (Score:5, Insightful)
I have two words for you: bull, and shit.
I don't care what their agreement says. Nobody has to "purchase rights" to "listen" to a song. If I want to listen to a song that's playing out on the street as I happen to be walking along, nobody has any right to charge me for the privilege. Conversely, nobody is allowed to sign away their rights under the law. If I sign an agreement saying "I hereby grant you the right to kill me by strangulation" that still doesn't give you the right to kill me and it doesn't give me the right to commit suicide either (which is illegal in most states).
Copyright law is pretty clear and the first sale doctrine well established. If I buy a song from iTunes, it's mine and I can do what I want with it provided I don't do anything to violate copyright law. That includes stripping the DRM to exercise my rights as expressly provided in copyright law (don't forget, fair use is not some nebulous concept someone came up with on Slashdot, it is part of the actual law).
Now, you can try to quote various things from the DMCA if you want, but that won't win you many friends around here. And I don't interpret the DMCA as overriding fair use rights anyway, and neither does anyone else I know of.
Parent
Re:This is annoying. (Score:4, Insightful)
Last I checked, you can just buy the CD at the store that contains no DRM at all.
The problem is that you never know what you are going to get when you buy a CD. Many CDs these days come with DRM that stops you from playing the songs on computers and even some stereos. And you don't know until you try it at which point the stores won't let you return it because it was opened. So given the choice between a useless, ~$15, round, shiny piece of sh... err... plastic or a ~$10 downloaded album that I can burn to a CD, copy to my iPod, or play on 5 different computers, I think the choice is obvious. The phrase "lesser of two evils" comes to mind.
Parent
Re:This is annoying. (Score:5, Insightful)
You are under obligation to abide by the terms of the agreement you entered with Apple. Apple is under no obligation to support every OS out there.
If you don't like the conditions Apple places in iTunes Music Store, including the limited number of supported platforms, don't use the service.
Parent
Re:This is annoying. (Score:5, Insightful)
So really this has nothing to do with hurting Apple, or not agreeing to a "EULA", and it has everything to do with Apple cynically attempting to manipulate network effects. Your brother sharing his CD collection on the home network using iTunes? You can't use WinAmp, WMP, RhythmBox, Muine or whatever to access that, you have to use iTunes too. Then when you share your music, it cascades onwards.
This is especially true in places like homes, student flats and college networks, like the ones crazney is on. Really, Apple have no excuse for this: restricting DAAP can only have one goal and that is to use peer-power of the type that keeps Windows entrenched to give iTunes an upper hand. As such it frankly deserves to be cracked.
I know crazney. He's a good guy. We talk often - he isn't out to screw Apple or steal music. He wants to play the music on his Mac laptop using the iTunes streaming system: this seems totally fair to me.
Parent
Re:Wrong way round (Score:4, Interesting)
No [againsttcpa.com] they [cam.ac.uk] won't [notcpa.org].
Don't be surprised when Apple suddenly becomes one of the biggest supporters of "trusted" computing, and introduces a palladium technology of their own. And all the Mac zealots who were busy telling us before why Apple DRM was good, while Microsoft DRM was bad, will come back to tell us why Mac Palladium is good.
I'm not saying the coders here are doing something wrong because they are pushing Apple in that direction: if we self censor ourselves to appease the DRM monglers, then we are where they wants us anyways. Apple picked sides in this battle, and for all the bullshit their fans are feeding us about "nice" DRM, the side they chose leads only one way. Goodbye user controlled computer. Welcome Palladium controlled user.
Parent
4.5 busted sharing with previous versions (Score:5, Interesting)
Upgrade the other machines! (Score:5, Informative)
Parent
Only 5 million songs is no surprise (Score:5, Informative)
Maybe someone forgot to ship these things to places where people actually would use them?
Pepsi Redemption Rate (Score:5, Interesting)
I wonder what the typical redemption rate is for the Pepsi, Coke and other softdrink give aways. I know for paper coupons [cnn.com] the redemption rate is about 2 percent. Granted alot of those coupons go straight into the trash. However, when people print coupons from the web only 20 percent are redeemed. And if someone is going to print them, you would think they would use them.
My point, is the Pepsi-iTunes rate of 5 percent unexpected?
I'm sure Apple doesn't care. (Score:5, Insightful)
- The De-Fairplay utilities don't have public development sites, and instead are forced to be these little files passed around on USENET and P2P and slashdot like they're some sort of contraband, well out of the public eye
- The way things work change just *SLIGHTLY* with every minor release of iTunes, causing all the De-Fairplay utilities to have to be updated with every minor release
Then, well. The slashdotters get to keep their de-Fairplay utilities and use them as much as they want; and from the RIAA's perspective, Apple's "doing something" about piracy, because there's no longer a publically visible way to crack Fairplay, and so they don't revoke Apple's license to sell music. Everybody wins! Except our civil liberties.
Free iTune download (Score:4, Informative)
Get 'em while they're hot--er, or before they melt?
Why so few redeemed songs... (Score:5, Insightful)
But I think more importantly, the vast majority of people simply don't know much about iTunes (or don't even know what it IS). I dug a lot of "one free song" bottle caps out of the wastebaskets in our office because people didn't have a clue what they were...however, once I showed them how to redeem them, their reaction was usually something like "I can get any song I want?!? COOL!". This leads me to believe that Apple still has a ways to go in terms of public interest and awareness of the online music store scene...which is actually an exciting opportunity for them.
5% sounds about right (Score:4, Interesting)
Arms race (Score:4, Insightful)
In the end, though, if this stays a technology arms race, Apple will lose. Why? Because most of the smart people in the world don't work for Apple. (That's also true even for Microsoft, incidentally.)
Apple will have to take another tack if they want to preserve the integrity of the iTunes DRM. What that'll be, I dunno, but I hope they don't resort to suing their customers.
Re:Arms race (Score:5, Insightful)
That however doesn't mean you don't attempt to enforce those allowances (legally in general they need to do that to insure proper precedents are set). I believe Apple will try to do that without causing problems for its customers, without punishing folks for the acts of a few, at least based on comments by Steve and company. Apple also has to attempt enforcement to likely placate record companies and artists listing song on the store.
Anyway, it is like the issue of cassette tapes back in the day... folks worried that rampant pirating of music would take place and kill sales. Well pirating did take place but the connivence of the tape form factor allowed things like tape players in cars, smaller/cheaper/easier to use stereos, and portable players like the Walkmans. This grew the market size for music and the large gains in market size easily offset the loss do to piracy.
You make a good way to buy and listen to music, one easier to use, more convenient and reasonably priced to out compete the illegal channels (generally most folks like to do the right thing). This is the thinking that Steve and company has stated a few times.
Personally I see hacking around FairPlay as a waste of time, it yields me nothing that I cannot already do based on my needs. If it pushes the business world to more draconian DRM and/or stronger legal actions that "punishes" everyone then it is doing folks more of a disservice then a service.
Parent
Good? (Score:4, Insightful)
How is this authentication Cracked. (Score:5, Interesting)
Authentication cracked means that you cand take an encrypted password and retreive the plain text for and already existing account.
All this guy seems to be able to do is figure out where and how iTunes sends its login information, so he can put it in his own application.
Sounds like an ego thing to me (Score:5, Insightful)
Ok, you're a clever guy. We get the message.
But is your ego helping those of us who would like the RIAA to see the light and start being more open in their approach to digital music?
Hooray! (Score:5, Insightful)
But wait, that's not really what they wanted. What they really want is stores with no cash registers and libraries of thousands of pieces of music representing the creative efforts of generations of people while valuing those libraries at zero.
Oh, and they also want to complain about greed.
Re:Hooray! (Score:5, Funny)
Parent
Dear God... (Score:5, Insightful)
To those who couldn't find where to insert your code on iTunes. USE YOUR EYES. It was right there on the front page: "PEPSI iTUNES GIVEAWAY." With a Pepsi logo with headphones on it. Click on it, insert your code, then it says ONE FREE SONG in the upper right hand corner. Find a song, click DONWLOAD, and it downloads it free.
To those complaining about having to use a credit card: How else are you going to pay for the songs you download? Food stamps?!
And about the DRM. c'mon people. Apple has to play the game of the law and the game of the recording industry in order to sell these things. But you tell me. How many other service let you KEEP the rights to the songs you bought, allowing them to be burned with the only restriction: Can only burn the same PLAYLIST 7 times to CD....Hell, Add or subtract a song from that playlist and you have a whole new playlist ready to burn.
People...just have no sense of reason. This is the BEST legal download service available on the market. Plus, the software is free, and is THE BEST jukebox software, on ANY platform.
Even WINBLOWS users are stating that "opinion." Should be more like fact if you compare all the others.
So (Score:5, Funny)
So iTunes is a failure.
Let's close it up. Unplug the servers and shut down the site.
They haven't sold enough Macs either, so let's close that down too. Can't make a dime unless they're the #1 record-setting, fastest-growing business in the history of civilization.
That DRM must be a breaze to crack! (Score:5, Insightful)
(1) I spend 99c downloading a song
(2) I spend the next X hours of my life writing or downloading an Apple DRM decoder
(3) I end up with a non-DRM song and a 99c credit card bill
I can see why this is easier than just performing step 1 and quitting. I mean, since I have 6 computers I need to play the song on, or I want to burn 8 of the identical CD, or I have no life.
Re:That was quick (Score:5, Interesting)
This isn't about DRM, it is about access to the music store, sharing, etc. outside of the iTunes application.
And despite the poster's assertion, there's no real reason to think the authentication scheme was intended to break compatibility; as most developers know, sometimes you need to make changes for other reasons that force a break in compatibility. If this WERE about DRM, I'd say it was likely, but I see no reason to think this separate change was deliberate. It may have been, but no one's given any reason to think it.
Parent
Right-- fairplay still works. (Score:4, Informative)
Fairplay still works without any changes. A "friend" did the following last night:
1. Using an old version of itunes on a pc, purchased a new song from the music store.
2. Launched VLC on the PC, and found it had no problem playing it. Checked c:\documents and settings\[username]\application data\drms and there was a new file: XXXXXXXX.005, in addition to the other two files that were already there. They had extensions
3. Upgraded itunes on the PC to 4.5. Bought another song. It shows fairplay v2 when you look at it's info.
4. VLC can also play this one. No new file in the drms directory was created.
5. Copied both songs.m4p and the key files from drms to the mac running the latest itunes. Put the keys in ~/.drms
6. Ran playfair (v 0.5.0) against the two songs. They decoded into
7. Just to double check, bought a third song using itunes on the mac. Ran playfair against it (still using the keys from the PC) and it decoded and plays fine.
My conclusion is that as long as you have the keys, you can still use playfair. My friend gets the keys from the PC running VLC. I don't know if other techniques may have been broken by the new itunes.
I don't have any problem with the ethics of removing the protection. I don't-- I mean, *wouldn't* use it to illegally share the music. It's just nice to have clean files in case Apple quits developing itunes for the PC, or some other unlikely scenario.
Parent
Re:Why do "free" songs require credit card numbers (Score:5, Informative)
No, you didn't. I got two free, no credit card required.
Parent
No they didn't (Score:5, Insightful)
Parent
Re:Why do "free" songs require credit card numbers (Score:5, Informative)
Parent
Re:Why do "free" songs require credit card numbers (Score:4, Insightful)
Other people's comments aside (about the CC field as optional for a signup), why would you say they fucked themselves?
They got the PR associated with giving away $100M worth of stuff. They only had to pay out $5M (less, since this certainly doesn't cost them as much as it would cost an actual customer). And you say they fucked themselves?
More like they fucked us. At least they used lube, but still... "Distribution problems" my ass. For anyone who considers every aspect of this as anything but well thought out and perfectly coordinated, I have a bridge to sell you...
Parent
Re:Why do "free" songs require credit card numbers (Score:5, Informative)
Parent
Re:Fantastic. (Score:5, Funny)
Parent
Re:What stopped me from downloading (Score:5, Funny)
Parent
Re:Yay for hackers!!! (Score:5, Insightful)
"I don't know why they bother trying to up the security. There is no way to secure media content that is compatible with mass distribution."
It's the "a little goes a long way" paradigm. There's not a car lock that will stop a sophisticated thief who wants your car, but it stops 90% of the punters. Same with locks on doors and copy protection on computer games and gaming consoles. There are likely professional car thieves who also wonder out loud why the car manufacturers don't just give up because it's a losing battle, etc., but it's not going to happen, either.
"They need to work on their business model, because this piecemeal anti-cracking stuff is a joke."
Apple has sold 70 million songs in their first year, and the iTMS is the most wildly successful of any of the legitimate download services, by a wide margin. I think their business model suits them just fine. Remember, Slashdot readers != the general populace. The little annoyances of playing cat-and-mouse with the "all music must be free" crowd is just one part of doing business and is similar to the fraud and theft issues that many other retailers deal with.
Parent
Re:5million, because they want a credit card. (Score:5, Informative)
They ask for it if you want set up the ability to purchase music at the time you open the account but you do NOT have to provide it to redeem a free song.
Parent