Monday

DRM done wrong: The stamp of incompetence

From Heise.de:

A user registers with Stampit and then can buy a type of virtual stamp in the form of smart PDFs. When the stamp is printed from the user's computer system the PDF contacts the Post Office server to check if it is still valid. It does this without the user registering - it is just the stamp itself "phoning home". In this transaction, the unique identifier of the stamp is cancelled on the server so that no further printings of that stamp can be made.

A pity if the paper jams then, or if the printer turned out to be out of toner. heise Security has heard from readers so frustrated with this problem that they have ended up creating special printer definitions in their systems that will print the stamp to a normal pdf so that it can then be printed again - and again. They do this not because they want to cheat the Post Office, but because problems so often arise when printing they want the security of being able to try again.

The full article also gives examples on how it's done right. Never forget user satisfaction when implementing DRM.

0 comments: