Hacker News Reader

Comment by stcredzero | Hacker News Reader

People need to realize that DRM is simply a tool. Absent pernicious laws like the DMCA, forms of DRM are like fences, locks, and cameras. Such tools can be used to oppress people. The same tools could also be used to protect individual's privacy and act as a check on what organizations can do with people's data.

Those who control products and infrastructure shouldn't be allowed to set up such tools to grant themselves disproportionate power. However, individuals need to realize that such tools could help protect them as well. (Analogy: Camera phones and police misconduct.)

View on HN

DRM should not be confused with cryptography.

DRM uses cryptographic methods, but I've never heard of a use case where a user chose a DRM product rather than a more straight forward cryptographic product to protect themselves.

Full disk encryption is a better tool for protecting yourself than SecuROM. In fact using SecuROM may well leave you more vulnerable to attack due to it's hacky obfuscation methods.

DRM should not be confused with cryptography.

I am not confusing DRM with cryptography. See the cousin comments in this thread.

Full disk encryption is a better tool for protecting yourself than SecuROM.

Doesn't help when you have to share data with companies and governments, and the information ends up on someone else's disk.

> Doesn't help when you have to share data with companies and governments, and the information ends up on someone else's disk.

FDE was an example among a vast array of encryption products. Attacking an non-comprehensive example as non-comprehensive isn't very enlightening. I still fail to see which DRM product you are suggesting is the proper tool for this situation. Even further, cryptography and careful allocation of trust seem to be a better solution than DRM for disseminating sensitive information since DRM is generally only a barrier, and not robust against concerted attack.

That is to say, if you are disseminating information to untrustworthy sources via DRM, then in the great majority of cases, you can consider the information compromised. Most DRMed content is copyable with as simple a solution as recording your screen. Even HDCP can be defeated with a simple camcorder.

I still fail to see which DRM product you are suggesting is the proper tool for this situation.

I am and always was talking about the abstract concept of trusted execution. As of yet, there is no environment which is trustworthy from a technical or a political standpoint.

Today's society's attitudes towards DRM are like what one would expect from the world of Orwell's 1984 towards cameras. We've only experienced a certain tool's use for oppression, so people's brains have turned off and they can't imagine the implications of the same tool being in the hands of the masses.

It's also worth noting that while many DRM systems do use cryptography, cryptography is not required to implement DRM and cryptography alone is insufficient to implement DRM. Cryptography only keeps data away from people who don't have the decryption key - it can't provide a way for people to read the data without copying it. But that is the goal of DRM. Because reading and copying data are fundamentally the same thing, the only way to achieve that particular goal is to modify the operating system so that it lies to the user. That is called a rootkit.

Good note. The line would be more accurate if it read:

>DRM /often/ uses cryptographic methods [...]

Too late to edit though.

What would favorable DRM look like? How could I use it to protect my privacy or limit what organizations can do with my data?

Look at Active Directory Rights Management Services, prime example.

To give one practically useful example, the same kinds of technology that could potentially restrict access to content on your own devices could also restrict the use of information in the workplace, preventing the leakage of sensitive personal data due to inside jobs. This is a legitimate and very practical concern for organisations operating in fields like healthcare, finance and defence.

So for example, my medical records might be DRMd with the keys in my possession, and I could give them to a clinic and give them read rights, but the DRM means they would have a hard time sending that data elsewhere without my permission?

I suppose you could do that, though given the nature of medical records, keeping everything locked up so tightly that only the (potentially impaired) patient can give access seems unwise.

I was more thinking that those organisations who do process medical records on your behalf -- your doctor, hospital, etc. -- could and should take steps to prevent the often very large number of staff they have from accessing an individual's records without proper authorisation. This would limit the ability for anything sensitive to be accessed by anyone without a reasonable clinical need for it or to be readily transferred to other systems, as well as creating a robust audit trail of access to sensitive data as well.

So you mean what happens already in sensible systems?

You'd think so, but unfortunately many, many systems that deal with sensitive data are not "sensible". Just look at the leaks from some of the most security conscious organisations in the world in recent years.

But that's not DRM! That's regular access control! The whole idea behind DRM is to control what users who are allowed to access the content can do with it.

Otherwise, even UNIX file permissions would be DRM.

Preventing access at all is regular access control.

The technologies that let someone access the data from their PC at the hospital but not, for example, save a copy to a USB stick, are much closer to what others use for DRM purposes.

The best technology to prevent copying data to a USB stick isn't DRM, it's epoxy. (Or, for a more mundane approach, disabling USB storage devices at the OS level.)

What happens in your version when someone needs to get data onto their system from a USB stick?

That shouldn't ever be necessary. Why does a medical records system need information loaded from USB sticks by random workers?

Edit: if it is for some reason necessary, it's actually easy to allow. Have separate "import" computers set up with accessible USB ports and write-only access to the system.

I suspect you are vastly overestimating how systematic IT in an average hospital or doctor's/dentist's surgery is. Medical IT is a scary field to observe.

Also, we seem to have latched onto medical records somewhere along the line, but please remember my original point was much more general. These technologies are relevant anywhere you have a need for access to sensitive information but also a need to control how that information can be used: finance, corporate R&D, obviously defence and security related fields, criminal justice, and the list goes on.

I'm not discussing how IT at these places is, merely how it could be. We are discussing hypothetical use cases, are we not?

As for the more general point, that's fair, but people keep bringing up things that are not DRM as examples, or use cases where DRM is not a good solution.

I think my original idea of individuals applying DRM to their own medical records is a way better example of how DRM could potentially be useful to protect privacy and give people control of their own information.

That sort of system isn't DRM. Limiting access to data is just regular access control, which is common and works decently well. The unique thing about DRM is that it provides access to data but attempts to limit what you can do with that access, for example allowing you to view it only on certain devices. That's much harder and less useful. I can see how it could help prevent bad actors from causing trouble here, but it's secondary to having proper access control.

The unique thing about DRM is that it provides access to data but attempts to limit what you can do with that access, for example allowing you to view it only on certain devices.

And that sort of thing is what I'm talking about. There are numerous applications where someone has a legitimate need to access certain data under certain conditions and for certain purposes, yet that same person does not need and should not have the ability to do other things with the same data.

And if you think that's not useful, I would remind you that a very substantial proportion of all white collar crime is based on inside jobs.

What if your email correspondence from companies was entirely handled through DRM that you controlled? What if you could revoke the right for a company to use your email? Basically, if such infrastructure were widespread, no company would actually have your email, unless they were to circumvent the DRM. Furthermore, such circumvention would then be covered under the DMCA, and mass circumvention would open up companies to class action lawsuits. (If properly implemented, either lawbreakers could be tracked, or the company that let the protected address fall into the wrong hands would be identified.)

You could not say that such a circumstance would be unfavorable. Typically, people come up with an argument saying that DRM doesn't work, and that such tools wouldn't be available in a true and trustworthy form to individuals anyhow.

Also, email isn't such a great example anymore, but having such control over one's medical records would be desirable.

What you describe would be way easier to implement by handing out unique tokens to each company, and then revoking tokens on my end. You can even do that right now by using a catch-all address, or the pretty common username+companynameandwhatever@example.com technique.

I do say that email isn't such a good example anymore. Medical records would be a better example. But such tokens would be included in DRM protected addresses, and their circumvention harder to deny. (Tokens by themselves are deniable.)

First of all, you're talking about a doubly edged knife. You wouldn't "actually have" the received email either. Now imagine you're sexually harassed or blackmailed, but couldn't prove it, because your email vanishes just after you've read it.

But more problematic is that you're forgetting about the analogue loophole. As long as I can take a photo of your crappy email, you only have the illusion of safety. Add to that the fact that currently there is no such thing as unbreakable DRM, mostly because it's a fundamentally flawed concept that can't work. DRM is security theater at best.

> having such control over one's medical records would be desirable

One thing that always bothered me is that programmers have the arrogance to think that technology can fix a broken society. Given that DRM is a broken concept, it wouldn't stop global adversaries like the NSA from mining your medical records. And then when your insurance company demands whatever records they want to do however they please, including selling that data to the highest bidder, threatening to reject your contract or claim, good luck explaining them about DRM and control.

You wouldn't "actually have" the received email either.

That's a straw man. The contents of communication would be proof from repudiation, but permission to send would be subject to revocation.

Given that DRM is a broken concept, it wouldn't stop global adversaries like the NSA from mining your medical records.

Begging the question. Our experience so far of DRM is broken. And there are plenty of adversaries below the capability of the NSA people need protection from.

Begging the question. Our experience so far of DRM is broken.

No, DRM as a concept is broken. The whole idea rests on giving someone the encrypted content and the key to decrypted, while obfuscating the way the two are combined in a machine the user controls.

That's why most DRM has been broken, often mere days after release, despite the many millions buried in its development.

This is really less useful of an example than say, medical records. With AD RMS I can ensure every document floating through an organization is protected with RMS, allowing only users with the proper permission access to the document. If someone tries to be sneaky and exfiltrate PHI out of the network it is useless, since nobody outside of the organization can open the file even if they have it. I can also revoke access to specific individuals or groups of people, so even if they had access at one point they can't use it any more.

DRM for documents is more about preventing sensitive data from escaping than it is securing communications between parties. The analog loophole always exists, mind you, so it still only makes life more difficult - but it does prevent mass transmission to a large extent.

Reply on news.ycombinator.com