TiVo Awarded Patent For Password You Can't Hack 291
Davis Freeberg writes "TiVo has always been known for thinking outside of the box, but this week they were awarded an unusual patent related to locking down content on their hard drives. According to the patent, they've invented a way to create password security that is so tough, it would take you longer than the life of a hard drive in order to figure it out. They could be using this technology to prevent the sharing of content or it could be related to their advertising or guide data, but if their encryption technology is really that good, it's an interesting solution for solving the problem of securing networks."
Re:A really long one? (Score:3, Interesting)
I suppose if I ever figured out how to put a newline into my password I would have one heck of a time logging on.
Clone Drives? (Score:5, Interesting)
Its hard to make something undefeatable and if you claim such it is only going to attract people as a challenge. Maybe that is what they want?
Of course if someone proves that it isnt 'impossible' then does that void the patent?
Blog spam is just plain wrong (Score:5, Interesting)
This has nothing to do with networks at all. The patent is about making sure a hard disk can only talk to a certain host.
Its just another attempt to prevent people form using their own hardware how they want to.
Man in the middle? (Score:1, Interesting)
Or maybe the password is just "Iceberg" -- "Even if they hit that key, it won't cause a crack."
Hamel's Folly (Score:5, Interesting)
On the dangers of assuming keyspace => security:
from ''Computer Security and Cryptography'', Alan G. Konheim.
A good way to lose their business (Score:4, Interesting)
Re:Man in the middle? (Score:4, Interesting)
Read the patent... (Score:3, Interesting)
The problem is still, the user has HIS content, he can do whatever he wants with it as long as he can see it. Unless you encrypt the lightwaves that reach our eyes and plant a DRM chip in our brain, we're going to be able to copy your precious content.
Re:Yet another reason not to get a Series3 TiVo (Score:3, Interesting)
Why It Does and Does Not Matter (Score:5, Interesting)
Quickly, before Cringely ruins it with bad math, I need to point out some very obvious weaknesses in making this work correctly:
Okay, you all can go back to your regularly scheduled cheap shots.
Re:Sure, uncrackable like every uncrackable code (Score:1, Interesting)
What I'm trying to ask is: does photosensitivity make it practically impossible to examine the guts of the chip, or does it merely make it harder?
what if i made some 1:1 s? (Score:3, Interesting)
So it's security is that a brute-force/birthday attack is just so improbable that the drive will wear out before i can test enough possibilities to have a measurable chance of getting it? Besides, twofish, blowfish, AES, any virtually any other standard encryption algorithm could boast the same thing. Tell me if I'm wrong, but couldn't i make a bunch of 1:1 copies of the disk and use those to crack it?
I'm no security expert... (Score:5, Interesting)
Give your friend a deck of cards. Turn around and have them shuffle it, select a card at random, memorize the card and put it back in the deck. Have them shuffle it some more (without you looking at it). Take the deck from them and take a card from it and say 'this was your card'.
In the long run, you'll be right about 1 in 52 times. If you happen to be right the first time with a particular friend, and never do the trick again, they will be scratching their head for a long time trying to figure out how you did it.
So, the point I'm trying to make is that it could take longer than the life of a hard drive to crack the super secret code, or you get get it right on the first guess (or the second one, or the third one...). So it seems rather silly to claim that it is uncrackable.
Re:Yet another reason not to get a Series3 TiVo (Score:3, Interesting)
There are a lot of reasons:
As for restrictions, the box itself doesn't do much of anything to restrict me as far as I've read. And, of course, for what I'd be using it for (a DAAP client), it's really an ideal solution (lack of S-Video and composite outputs notwithstanding). It's easy to use, can connect to a DAAP share on the MythTV backend box easily (it looks like an iTunes share), etc. Output formats fr older TVs notwithstanding, it's a plug-in-and-go solution that can easily integrate with the MythTV setup, but is still tweakable under the hood if I feel the need to do so at some point in the future.
That's what I look for in technology products---products that (as much as possible) just work when you plug them in, but are still sufficiently easy to mod to add features if/when I outgrow their functionality. The AppleTV gives me a lot more room to grow than an Xbox. That means that I'll be able to keep using an AppleTV long after I'd need to replace the Xbox with something else. That long-term viability is worth an extra hundred dollars to me.
Am I infringing on the patent? (Score:3, Interesting)
When I read this I though "Okay, so you have to steal the box to get the content or do a lot of work to get the data off of the drive using the chip in the machine.. no big deal right?"
Then it occurred to me, maybe the host computer isn't the local Tivo box, maybe it is Tivo's system (remote) that they're calling the host. What does that mean? Now you can't get data off of the drive unless the Tivo calls home, swaps keys, and stores a decryption key/algorithm in RAM. This means that if Tivo says no, you can't get at data on the device you now own. So... well if you can hack the OS then you can just have the keys stored after/during exchange or you could read out of RAM, but maybe the OS is built off of a network boot scenario with the initial sending of the system happening only after the handshake. Tricky.
If (big if) that is the case then the way to beat it will have to be capturing the data in RAM from a running system. It sounds tough but I suspect you could do it by setting up a virtual machine that intercepts the call coming from the box, and on return sends all output from the chip normally destined for real RAM into virtual RAM (which is really filesystem based, heck make it a ram drive so it is as fast as RAM but readable as a file.) Copy the virtual ram file, and you've got an unencrypted OS. Hack your unencrypted OS to store the keys, and now you have your drive decryption key, your "call home" key and a hackable OS. Want to do something Tivo doesn't like? Make your OS think the commands came from Tivo, not too difficult now. Maybe they have a changing algorithm where the chip uses a new key (in predicted order) for each call home, incrementing after each successful exchange. Maybe then you have to talk to the chip every time with your Virtual Machine, but it still accomplishes the goal of having complete access and control.
Okay, what I think they really have is a scheme to make sure that a chip and drive are tied together so you can't get at the drive without the chip, thus no Tivo drive swapping and they really don't care right now anyway and just wanted to get the patent because they think their method might be marketable some day. I wonder if I'm giving them ideas.. nah, they'll never read this post, right?
Re:So.... (Score:5, Interesting)
On the other hand, yes, this does appear to be a simple patent on tying a hard drive to an electronics unit. Viable attack vectors are already obvious.
TV Sucks , Slightly Off-Topic (Score:2, Interesting)
Think about how much head space you will be saving yourself. Hell, I still have commercials floating around in my head from the late 80's. I certinatly don't need any more of that filth polluting my thoughts.
In conclusion, T.V. sucks. Stop watching T.V.
This patent sucks (Score:4, Interesting)
Re:So.... (Score:3, Interesting)
Re:longer than the life of a hard drive in order . (Score:2, Interesting)
Re:Does it matter? (Score:4, Interesting)
But if this patents is invalidated, it is meaningful in several ways. First is other devices might be forced into using it by the media companies or something and this will raise the costs of consumer electronics. The next thing is, suppose someone discovers this as a way to keep usable information out of anyone's hands who don't have permission to use it. There is another royalty that needs to be payed and it will come out of our pockets too. But most importantly, A patent takes an entire piece of software off the market for most. Imagine if the word processor was patented when it originally was developed. Whatever the first word processor was and anyone willing to pay the royalties to them are the only word processors we would have. Openoffice.org wouldn't be here, Microsoft could have bought the patent and stopped everyone from using it other then them, so on and so on.
So what happens when computers are fast enough that to be somewhat reasonable secure, you need this patent. If it is still valid, again, everyone pays TIVO to use it. But if it was copy written instead of patented, then many other players could attempt to do similar things and hopefully competition would make things better and all. But if we are stuck with this one implementation and it turns out not to work, any working implementations from other companies will have a payment to TIVO associated with any costs.