Comments on: Security Review: iTunes Movie Rentals http://cubist.cs.washington.edu/Security/2008/02/03/security-review-itunes-movie-rentals/ Mon, 06 Oct 2008 14:03:22 +0000 http://wordpress.org/?v=2.6.2 By: Justin McOmie http://cubist.cs.washington.edu/Security/2008/02/03/security-review-itunes-movie-rentals/#comment-233 Justin McOmie Mon, 04 Feb 2008 07:47:47 +0000 http://cubist.cs.washington.edu/Security/2008/02/03/security-review-itunes-movie-rentals/#comment-233 I hope that the DRM systems for movie rentals prove to be sustainable for Apple and others because, unlike with typical DRM, the DRM that applies to rentals doesn't exist under false pretenses. With typical forms of DRM, such as the DRM applied to all non-rental tracks on the iTunes store, there is the pretense of "ownership" with the purchase. There is no real form of ownership involved however. The only aspect of the arrangement that might be construed as ownership is the conditional right a purchaser has to play their media on up to 5 sanctioned machines. With rentals the terms are fairly clear at the outset, and since a point of expiration is pre-agreed by both parties prior to the purchase, there is little need for concern that future changes to the agreement (by Apple or others) might be retroactively applied. On the other hand this little nugget from the iTunes “Terms of Service” should interest anyone who has paid for non-rental media from the iTunes Store: "Apple reserves the right, at any time and from time to time, to update, revise, supplement, and otherwise modify this Agreement and to impose new or additional rules, policies, terms, or conditions on your use of the Service." I hope that the DRM systems for movie rentals prove to be sustainable for Apple and others because, unlike with typical DRM, the DRM that applies to rentals doesn’t exist under false pretenses.

With typical forms of DRM, such as the DRM applied to all non-rental tracks on the iTunes store, there is the pretense of “ownership” with the purchase. There is no real form of ownership involved however. The only aspect of the arrangement that might be construed as ownership is the conditional right a purchaser has to play their media on up to 5 sanctioned machines.

With rentals the terms are fairly clear at the outset, and since a point of expiration is pre-agreed by both parties prior to the purchase, there is little need for concern that future changes to the agreement (by Apple or others) might be retroactively applied.

On the other hand this little nugget from the iTunes “Terms of Service” should interest anyone who has paid for non-rental media from the iTunes Store:

“Apple reserves the right, at any time and from time to time, to update, revise, supplement, and otherwise modify this Agreement and to impose new or additional rules, policies, terms, or conditions on your use of the Service.”

]]> By: robertm2 http://cubist.cs.washington.edu/Security/2008/02/03/security-review-itunes-movie-rentals/#comment-231 robertm2 Mon, 04 Feb 2008 07:24:05 +0000 http://cubist.cs.washington.edu/Security/2008/02/03/security-review-itunes-movie-rentals/#comment-231 I think the new Itunes Rental store is particularly interesting from a security standpoint since the files are actually downloaded and stored on the users' computers. It seems like it would be easier to tamper with the system, as opposed to something like a pay-per-view movies through a Comcast box. And it appears that it would be in Apple's best interest to make sure the movies are protected and are viewed only in its intended way as to not lose the trust from the movie companies. As already mentioned, the rentals are based on a time-expiration system and I too wonder how this is implemented. I doubt that iTunes requires an internet connection at all times so that it can check the time against a iTunes server as this would be significantly inconvenient for the customers. So it must depend on the system clock. In which case, if people can figure out a way to tamper with this, it seems that you can at least movies that you can own for a very long time for a cheaper rental price. I think the new Itunes Rental store is particularly interesting from a security standpoint since the files are actually downloaded and stored on the users’ computers. It seems like it would be easier to tamper with the system, as opposed to something like a pay-per-view movies through a Comcast box. And it appears that it would be in Apple’s best interest to make sure the movies are protected and are viewed only in its intended way as to not lose the trust from the movie companies.

As already mentioned, the rentals are based on a time-expiration system and I too wonder how this is implemented. I doubt that iTunes requires an internet connection at all times so that it can check the time against a iTunes server as this would be significantly inconvenient for the customers. So it must depend on the system clock. In which case, if people can figure out a way to tamper with this, it seems that you can at least movies that you can own for a very long time for a cheaper rental price.

]]>