var json_comments = new Array("
\"user-pic\"
csparks
November 18, 2009 4:52 PM
Moderate | Flag for review

It seems as using credit cards for a lock in protection could pose a security risk. It would be like using cc numbers as the salt in password encryption, and I would never do that.

Reply
3 replies
\"user-pic\"
P=mv
November 18, 2009 4:52 PM
Moderate |Flag for review

@csparks: Yet again one of the many reasons I have yet to consider buying an ereader or ebooks.

Reply
\"user-pic\"
kerry
November 18, 2009 4:52 PM
Moderate |Flag for review

@csparks: eReader.com (and all of its previous iterations) has been using this DRM scheme for a decade, and B&N has been using it ever since they bought eReader. One of the reasons it works is people don't want to give away their CC# to unlock the books, so people don't share the files.

Reply
\"user-pic\"
humphrmi
November 18, 2009 4:52 PM
Moderate |Flag for review

@kerry: It's still a security risk. That means that your name and credit card number are floating around somewhere, ready to be used by the \"unlock\" device. Where? On the reader? On their servers? How is my name and credit card number secured in those places?

Reply
\"user-pic\"
kerry
November 18, 2009 4:52 PM
Moderate |Flag for review

@humphrmi: Name and CC# aren't \"floating around,\" they're stored on your device, in the software which reads the books. It's more secure than saving your credit card statement to your hard drive, or using a password storage program. To access the name and credit card number on the software I believe you'd have to hack into it pretty hard. It can't be called up by the end user.

Reply
","
\"user-pic\"
clairedeloony
November 18, 2009 4:52 PM
Moderate |Flag for review

Yay!! I get countless B&N gift cards each year for Christmas because I have unimaginative relatives (not that I'm complaining, it's way better than bath products). I may have some left over this year after I pool them to buy a Nook, so this is very nice.


I already use eReader on my Blackberry and it doesn't seem like it'd be difficult to rearrange the unlocking mechanism. Maybe buy the books with gift cards, but you still have to put in a credit card number (never charged) to unlock them?

Reply
2 replies
\"user-pic\"
kerry
November 18, 2009 4:52 PM
Moderate |Flag for review

@clairedeloony: This is how it already works at eReader.com, so I'm guessing that's how B&N is going to set it up. Your books are unlocked with your default CC# on file, but paid for with store credit via the gift card.

Reply
","","","
\"user-pic\"
XTC46
November 18, 2009 4:52 PM
Moderate |Flag for review

I find this interesting from a security standpoint. Using the Credit card info as a DRM method seems like a bad idea.


I havent looked much into it, but how hard would it be to crack a kindle users account, redownload one of the files they bought, then attack the file to get the CC number.


Here is what I come up with off the top of my head.


1. Find a few kindle users account
2. Crack the account on Amazons site
3. Retireve saved account info (usually the last 4 digits of the CC as well as billing address)
4. Download a file and attack it using a known key pattern (if they are using it as a key, the patter is going to be the same)
5. brute force the CC number. You already have 4 of the 16 digits, you know its a set length and you know its only digital.


So that 10 trillion possible combinations, assuming you dont know anyof the other numbers. You could then use say the 10 most common banks that distribute cards, and you then have the first 8 digits of the card, which leave just a few hundred thousand compbinations, which can be cracked in minutes.


Once you have the software written with the correct parameters set, its just a matter of collecting the account info from amazon, which I doubt is very hard becasue most people dont consider their kindle accounts to be sensetive like a bank account, and use weak passwords.


I bet you could get a fair number of credit card numbers and their billing info pretty quick.


I have to imagine there is stuff in place to prevent this, but DRM as a whole gets cracked quickly becasue to be amble to distrbute and manage it, it needs to be predictable (there has to be a set alogrythm in the software to hash the data and create the key for the lock) This is why Key genorators and the like get produced so quickly and continue working, and why a CC number being used as that key is a terrible idea.

Reply
1 replies
\"user-pic\"
Darklighter
November 18, 2009 4:52 PM
Moderate |Flag for review

@xtc46 - thinksmarter on twitter: First off, we're talking about the nook, not the Kindle, and Barnes & Noble, not Amazon.

Second, there's no way in hell B&N is using raw credit card info as keys, precisely because it would be stupidly insecure. If I had to guess, they're using some sort of internal key combined with a hash of the billing information to create the final key.

Reply
","
\"user-pic\"
Tijil
November 18, 2009 4:52 PM
Moderate |Flag for review

\"The 'unlock' device is the billing name and credit card number of the primary credit card on your Barnes & Noble account.\"

Does this mean that when I change card numbers (or even banks) that it will have (1) assorted books unlocked with different CC numbers, (2) older purchases no longer unlockable because the primary CC number no longer matches, or (3) that all the unlocking codes will change on all files?

What about name changes (marriage, etc.)? Will that change the accessibility?

Will one have to remember which credit card was active, and what name was on it for books one bought in order to restore them?

I see potential interesting problems depending on exactly how the information is stored and reteieved.

Tomas

Reply
1 replies
\"user-pic\"
kerry
November 18, 2009 4:52 PM
Moderate |Flag for review

@Tijil: It means that if you change credit card numbers you may need to re-download books to be accessed with your new credit card. It's a hassle, and I hope B&N finds a way around it. eReader never has.

Reply
","
\"user-pic\"
badgeman46
November 18, 2009 4:52 PM
Moderate |Flag for review

Does that mean you can't pay for these things in cash? Why would anyone buy something they don't really own. I'll stick with paper.

Reply
1 replies
\"user-pic\"
pecan 3.14159265
November 18, 2009 4:52 PM
Moderate |Flag for review

@badgeman46: How would you buy an eBook in cash? There are no physical locations for you to go to and get what is not physically existent. It's an eBook. Self explanatory.

Reply
","","","","
\"user-pic\"
parrotuya
November 18, 2009 4:52 PM
Moderate |Flag for review

Woo-Hoo!

Reply
","","","","","
\"user-pic\"
zerj
November 18, 2009 4:52 PM
Moderate |Flag for review

With how often my bank loses my credit card info, Credit Card #'s don't seem all that secure to me. I wonder if you have to redownload all your ebooks each time your bank issues a new number. That would be a hassle.

Reply
","
\"user-pic\"
absherlock
November 18, 2009 4:52 PM
Moderate |Flag for review

Maybe I'm just being a pessimist, but without a firm guaranteed date from Barnes & Noble, this just seems like an attempt to not lose out on lucrative gift card sales right before the holiday season. I can easily see B&N pushing the date back to January and then coming back in the new year saying they can't figure out a workaround to the problem and they won't be offering refunds on the cards.

Reply
","
\"user-pic\"
RedCatLinux
November 18, 2009 4:53 PM
Moderate |Flag for review

The first thing I thought of is what if I no longer use a card anymore and have closed the account? Or if my card number changes? Or if I just use a new card as the primary that has better rewards?


Do you have to use a different number for each purchase if you had a different primary? Sounds like it's encrypted in the file, so you'd have to. What if you like to use a credit card, but not leave that info stored on their servers?


That so totally sucks.

Reply
");