Windows Phone 7 DRM Broken?

[admin]

It hasn't been a good day for DRM, as following the PS3 hack, it appears Windows Phone 7's DRM has also been hacked.

A new video has surfaced that shows the breaking of the Windows Phone Marketplace DRM, which then would allow any purchased apps to be shared with anyone. It is only a proof of concept, but it shows that, yes, it can be done.

Mobile app DRM is deemed important for developers and also for companies like Apple, Google and Microsoft that run the app markets, because the intense competition between the various phone ecosystems means that, in order to lure developers to their platform, security and anti-piracy features are a big drawcard.

However, none of the ecosystems today remains unhacked, and piracy is relatively easy on all the major platforms, and despite this, sales are booming in the apps market. This is most likely due to the low price of apps, which makes them "non-decisions" for buyers, and the fact that buying apps, once the market payment options have been set up, is so so easy.

Still, the hacking of the Windows Phone 7 DRM, so soon after the OS's release, is bad news for Microsoft.

Here's the video:



More:

http://www.geek.com/articles/mobile/warez-ahoy-windows-phone-7-drm-has-been-broken-20101230/

[drfsupercenter]

I have an Android phone, and thankfully there's pretty much no DRM to speak of. yes, there's the app-private folder, but rooted phones can browse it and copy the .apk files to an SD card easily. I've gotten several new Android phones under warranty due to bad hardware and was able to restore all my apps in a matter of minutes, none of that DRM crap.

[admin]

I'm actually working on an Android app at the moment, and have done a bit of research on DRM. There is a type of DRM that can be deployed, based on a license server check. The way it works by default (or at least the recommended settings) is that it will check back with Google's license servers to see if you have license for the paid app (only paid apps can use licensing). Once it authenticates, it will stores the license in a local cache so that the app never needs to check with the license server again. The license check is tied to the user account (the email account used for Market), so this means that if you move an app to a new phone, you'll still be able to use the app, as long as you authenticate the first time you use it on the new phone.

App developers can customize this DRM in any way they wish, including license checking at each startup, so there is still a chance that some Android apps will end up with a draconian DRM system.

But it's still better than iPhone's DRM, considering that even free apps has to have it (whereas Google enforces the rule that you can't use their licensing server on free apps)

[drfsupercenter]

I've...never seen any apps that do that, I know MyBackup Pro says 'authenticating' every time it opens, but I've installed it on other phones besides my main one and it works fine. Even with no gmail account. So I really don't know, LOL

Point being I've never come across an Android marketplace app I couldn't backup and restore.

[admin]

When you paid for the app via Market, you used Google Checkout, right? The email account associated with your Google Checkout account is the one linked to the app I think, if the app uses Google's licensing severs. Google licensing was only introduced in August of last year, so not a lot of apps are using it yet. Many app developers used to create their own custom licensing engine, which is actually bad from a "DRM breaking" point of view, because you end up having to break each app's DRM separately if they're all using custom solutions. A centralised DRM is actually easier to break

What Google has done, cleverly, with Google license verification library is that it leaves much of the implementation up to the developer, so every DRM created using Google LVL can be a bit different, making it potentially hard to break (well, hard as in you have to break each app one by one). But if you only use the example code provided, it's fairly easy to break because it was cracked almost immediately after the release of LVL.

Anyway, the point is that even with DRM on Android, it's pretty light unless developers go crazy. And if developers want to do that, then they always could have, just by making their own custom DRM. Luckily, most developers don't see the need.

[Budreaux]

My personal opinion about the Android apps is that there is usually a Free version of each app for you to try before you buy. If you like it, the Apps are so dern cheap and easily bought through Google checkout that there is just no need for anyone to not buy them. We've discussed this before when it comes to game. Give the consumer a good product and a fair price and you do not have to worry about the miniscule piracy that may occur as a result.

[admin]

Totally agree. With apps costing as little as $0.99, it's not worth the effort or even money to download a pirated version (which costs you in terms of lost time and extra bandwidth, not to mention the risk of getting an Android virus/trojan).